HNM ATTORNEYS

Responding to a data security compromise under the Protection of Personal Information Act 4 of 2013

Many security compromises are not sophisticated cyber-attacks. They are misdirected emails, lost
laptops and spreadsheets shared too widely. The Protection of Personal Information Act 4 of 2013
(“POPIA”) treats them alike. What concerns the Information Regulator (“the Regulator”) is not how
serious the incident was, but whether the organisation responded lawfully, promptly and transparently.

Reported compromises rose by roughly 40% in the 2024/25 financial year, to more than 2 300
notifications, and the Regulator has made clear that it is now moving from education to enforcement.1
This guide sets out what POPIA requires of an organisation when a compromise occurs and what it
should have in place before one does. It is structured to follow the life cycle of an incident, from
recognising a compromise and containing it, to reporting it to the Regulator and notifying those
affected. It is intended as a practical reference for Information Officers, executives and compliance
teams, and should be read alongside specific legal advice on the facts of any particular incident.

Read the full guide here: HNM DATA BREACHES & POPIA GUIDE