Reporting a security compromise under POPIA: what to do, and when

Every security compromise must be reported to the Information Regulator and to the people affected. What section 22 of POPIA requires, what changed in 2025, and what to do if you're told.

Published: 2 November 2026
Reading: 4 min
Sources: 5
By: Refactθ

When there are reasonable grounds to believe that someone unauthorised has accessed or acquired personal information, South African law calls it a security compromise. The organisation responsible for that information must then tell two parties: the Information Regulator, and the people the information is about.¹ Since 1 April 2025, the report to the Regulator goes through its eServices portal instead of email.²

This advisory sets out what the Act and the Regulator's own guidance say, then what to do. It is general guidance, not legal advice.

What the law requires

Confirmed

Section 22 of the Protection of Personal Information Act (POPIA) sets these rules:¹

Who is told: the Regulator, and each person affected unless their identity can't be established.
When: as soon as reasonably possible after the compromise is discovered, allowing for the legitimate needs of law enforcement and for the steps reasonably needed to find its scope and restore the system.
Delaying notice to people affected: allowed only if the Regulator, or a public body that investigates offences, decides that notice would impede a criminal investigation.
How people are told: in writing, by post, by email, in a prominent place on the organisation's website, in the news media, or as the Regulator directs.
What the notice says: the possible consequences, what the organisation has done or will do, what the person should do to protect themselves and, if known, who accessed the information.

Service providers that process personal information for an organisation (POPIA calls them operators) must tell that organisation immediately when they have reasonable grounds to believe information has been compromised.¹

What changed in 2025

The portal is mandatory. From 1 April 2025, all organisations must report security compromises on the Regulator's eServices portal rather than by email. The Regulator publishes a step-by-step guide to registering Information Officers and submitting reports there.²
There is no threshold. The Regulator's fact sheet says POPIA has no threshold for reporting a security compromise, and that the requirement is mandatory.³
Don't wait for certainty. According to the same fact sheet, a compromise does not have to be confirmed, and an investigation does not have to be finished, before it is reported. Report what you know and update the notification as you learn more.³
Accidents count. The fact sheet lists accidental compromises, such as a misdirected email or a lost device, alongside cyber attacks and theft.³

The Regulator enforces it

On 2 June 2026 the Regulator announced an enforcement notice, dated 22 May 2026, against Central Johannesburg TVET College. Among its findings: the college failed to notify the Regulator and the people affected of a security compromise, as section 22 requires.⁴ The Regulator warned that failing to comply with an enforcement notice is an offence that can lead to a fine, imprisonment or both.⁴ On 26 October 2026 it fined the college R500,000 for not complying with the notice, including not reporting the security compromise in the prescribed manner.⁵

The same statement fined First National Bank R1 million. That assessment began with the bank's own section 22 notification and went on to find weaknesses in its section 19 security safeguards.⁵ A notification can lead to a wider compliance assessment.

For organisations

Before anything happens

Register on the portal now. Make sure your Information Officer, and any deputies, can log in to the Regulator's eServices portal. The Regulator's guide covers registration and reporting.² A breach is the wrong time to find out the account doesn't exist.
Check your operator contracts. POPIA requires a written contract making your operators keep appropriate security measures, and it requires them to tell you immediately about a suspected compromise.¹ Make sure each contract names who they tell, and how.
Prepare your notice. Draft a notice to the people affected that covers the four things section 22 asks for, so you only fill in the facts on the day.¹

When you suspect a compromise

Limit the damage. The fact sheet asks organisations to identify the compromise, take the measures needed to limit its impact, and tell their Information Officer or deputy.³
Report to the Regulator on the eServices portal as soon as reasonably possible, with what you know now.²³
Tell the people affected in writing, unless a criminal investigation requires a delay as described above.¹
Keep website notices up long enough to be seen. The fact sheet's rule of thumb is thirty to ninety days.³
Fix the cause. Section 19 already requires you to identify foreseeable risks, keep safeguards in place, check that they work and update them when new risks appear.¹

For individuals

If an organisation tells you your information was compromised

Read the notice for four things: what could happen, what the organisation is doing, what you should do, and who accessed your information if they know.¹ If something is missing, ask the organisation's Information Officer.
Change your password for that service, and anywhere else you used the same one. Turn on two-step verification where it's offered.
Be wary of contact about the breach. Treat calls, emails and SMSes that mention it with suspicion, and reach the organisation through contact details you already have.
Watch your accounts. If financial details were involved, check your statements and speak to your bank.

If you think you weren't told

If you believe an organisation compromised your personal information, you can complain to the Information Regulator on Form 5.³

Sources

Official sources are the organisation's own statement, a regulator, a government agency or a vendor advisory. Reports are news or third-party analysis; we say so in the text when a claim rests only on them.

1Protection of Personal Information Act 4 of 2013 (consolidated text)OfficialDepartment of Justice and Constitutional Development · published 26 Nov 2013 · checked 2 Nov 2026↩
2Media statement: Regulator launches online reporting platform for security compromisesOfficialInformation Regulator (South Africa) · published 7 Apr 2025 · checked 2 Nov 2026↩
3Fact sheet: handling of security compromisesOfficialInformation Regulator (South Africa) · published 19 Aug 2025 · checked 2 Nov 2026↩
4Media statement: Information Regulator issues enforcement notices for the contraventions of POPIA and PAIA by public and private bodiesOfficialInformation Regulator (South Africa) · published 2 Jun 2026 · checked 2 Nov 2026↩
5Information Regulator fines Central Johannesburg TVET College and First National Bank for POPIA contraventionOfficialInformation Regulator (South Africa) · published 26 Oct 2026 · checked 2 Nov 2026↩

Filed under

How we write: every claim links to its source and date, confirmed facts are kept apart from reports, and corrections appear at the top of the post. Facts and sources checked on 2 November 2026. Spotted an error? Email hello@refact0.com.