Discovering that someone may have accessed your customers' or employees' personal information is stressful enough. Then comes the question most small business owners have never had to answer: do we have to report this, and to whom?
Under the Protection of Personal Information Act (POPIA), the answer is often yes. This guide walks you through what section 22 requires, step by step, in plain language, and gives you a notice template you can adapt.
This is practical guidance, not legal advice. If you're facing a real incident, involve an attorney or data protection specialist early, especially before you send anything to affected people.
What counts as a "security compromise"?
POPIA uses the term security compromise. Section 22 applies when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.
Two things are worth noticing:
- You don't need proof. "Reasonable grounds to believe" is a lower bar than certainty. If ransomware hit a computer that held client files, you probably have reasonable grounds, even if you can't yet prove the files were copied.
- It's not only about hackers. A staff member emailing a payroll spreadsheet to the wrong person, a stolen unencrypted laptop, or a former employee who still has access to the shared drive can all be security compromises.
Common examples for small businesses:
- ransomware or other malware on a device that holds personal information
- a compromised email account, since mailboxes are full of personal information
- a lost or stolen laptop or phone that isn't encrypted
- documents sent to the wrong recipient
- a supplier or IT provider (an operator) telling you they've had a breach involving your data
Who you have to tell
Section 22 requires you to notify two parties:
- The Information Regulator.
- The affected people, whom POPIA calls data subjects.
There's one narrow exception: you may only skip notifying the data subjects if their identity can't be established.
If your operator (an IT provider, payroll bureau or cloud service processing information for you) suffers the breach, section 21 requires them to notify you immediately. The duty to notify the Regulator and data subjects stays with you, as the responsible party.
When you have to tell them
POPIA says "as soon as reasonably possible after the discovery" of the compromise. There's no fixed number of hours, but don't read that as "whenever is convenient". The Act allows you to take into account:
- the legitimate needs of law enforcement, and
- reasonable steps needed to work out how big the breach is and restore the integrity of your systems.
You can delay notifying data subjects only if a public body responsible for investigating crime, or the Regulator itself, decides that notification would impede a criminal investigation.
In practice: start the process within days, not weeks. Delays that can't be justified look like concealment.
Step by step
Step 1: Contain the incident
Before you report anything, stop the bleeding. Disconnect affected devices from the network (don't switch them off), reset compromised passwords from a clean device, and revoke access for any account that shouldn't have it. If it's ransomware, see our guide on what to do in the first hour.
Step 2: Write things down, starting now
Open a simple incident log and keep it updated. Record:
- when and how you discovered the incident
- which devices, accounts and systems are involved
- what personal information they held, and whose
- every action you take, with times and names
This log becomes the backbone of your notification, and your evidence that you acted responsibly.
Step 3: Work out what was affected
With your IT provider, answer these questions as best you can:
- Which records? Customer lists, ID numbers, bank details, medical records, payslips?
- How many people? Rough numbers are fine at first.
- Is any of it special personal information? Health, biometrics, criminal records, religion or children's information raises the stakes.
- Was it accessed, or actually taken? Even if you're unsure, note what you know.
Step 4: Involve your Information Officer
Every business has an Information Officer. By default it's the head of the business, such as the owner, CEO or managing partner. They are accountable for the notification, so bring them in now, together with your attorney and your cyber insurer if you have cover. Many policies require prompt notice.
Step 5: Notify the Information Regulator
The Regulator publishes the current form and submission process for security compromise notifications on its website, inforegulator.org.za, and accepts notifications through its online portal. Check there for the latest requirements before you submit, as the process has been updated in recent years.
Be ready to provide:
- your organisation's details and your Information Officer's contact details
- what happened and when it was discovered
- the categories of personal information and the approximate number of people affected
- the possible consequences for those people
- what you've done and plan to do to contain the incident and prevent it happening again
- whether, when and how you've notified the affected people
It's fine to submit what you know and update the Regulator as your investigation progresses. Waiting for perfect information is usually the bigger mistake.
Step 6: Notify the people affected
Section 22 says the notice must be in writing, sent in at least one of these ways:
- by post to their last known physical or postal address
- by email to their last known email address
- by placing it prominently on your website
- by publishing it in the news media
- as the Regulator directs
The notice must give people enough information to protect themselves. At minimum, it must include:
- a description of the possible consequences of the compromise
- a description of the measures you've taken or intend to take to address it
- a recommendation of what they can do to reduce the possible harm
- the identity of the unauthorised person, if you know it
Write it in plain language. Skip the legal jargon, and don't play down what happened.
Step 7: Report the crime, and other regulators if they apply
Most breaches involve a crime under the Cybercrimes Act, so open a case with the SAPS and note the case number. Your insurer will usually ask for it. Some sectors have extra reporting duties. Financial institutions, for example, have their own reporting deadlines and regulators, so check whether any apply to you.
Step 8: Fix the cause and keep the evidence
Once the immediate crisis is over, deal with how it happened: the unpatched server, the missing multi-factor authentication, the shared password. Keep your incident log, the notifications you sent and the evidence of your fixes. If the Regulator follows up, this is what shows you took reasonable measures under section 19.
A notice template you can adapt
Subject: Important: a security incident involving your personal information
Dear [Name],
On [date], we discovered that [brief, plain description, e.g. "an unauthorised person gained access to an email account used by our accounts team"]. We believe the following information about you may have been accessed: [list, e.g. "your name, email address, ID number and banking details"].
What this could mean for you: [possible consequences, e.g. "someone could try to use these details to impersonate you or to send you convincing fraudulent emails or invoices"].
What we have done: [e.g. "We secured the account within an hour, reset all staff passwords, switched on additional security checks and appointed a specialist to investigate. We have reported the incident to the Information Regulator and the South African Police Service."]
What we recommend you do: [e.g. "Be cautious of emails or calls asking you to change banking details or make payments, even if they appear to come from us. Contact us on [known phone number] to confirm any request. Consider asking your bank to monitor your account."]
[If known: "We believe the incident was carried out by [identity of unauthorised person]."]
We're sorry this happened. If you have questions, please contact our Information Officer, [Name], at [email] or [phone].
[Business name]
Adapt it to the facts. Don't promise things you can't confirm, and have your attorney review it if you can.
Mistakes to avoid
- Waiting for certainty. "Reasonable grounds to believe" is the trigger, not proof.
- Telling people too little. A vague notice that doesn't help people protect themselves doesn't meet the requirement.
- Only telling the Regulator. Data subjects must be told too, unless their identity can't be established.
- Deleting evidence. Wiping and reinstalling a device before anyone has looked at it can make it impossible to know what was taken.
- Assuming it's your supplier's problem. If your operator is breached, notifying the Regulator and your customers is still your job.
You can only report what you can see
The hardest part of section 22 isn't filling in a form. It's knowing that something happened, and being able to say what, where and when. Many small businesses only find out months later, when a client calls.
That's the gap EZ Cyber Guard was built to close. It monitors your laptops, desktops and servers around the clock, alerts you to suspicious activity in plain language, and records which device was involved and when, so that if you ever do have to notify, you start with facts instead of guesses. See how it supports POPIA on our POPIA compliance monitoring page, or check where your business stands with the free POPIA Security Readiness Check.