The Cybercrime Act: Corporate Liability for SA Executives

A New Legal Reality for the C-Suite

The enactment of the South African Cybercrime Act of 2020 has fundamentally altered the legal landscape for corporate executives. No longer is cybersecurity viewed merely as a technical issue for the IT department; it is now a critical matter of legal compliance and personal liability. In 2026, directors and officers must be acutely aware of their responsibilities under the Act and the potential consequences of failing to protect the organization's digital assets. The Act, alongside the King IV Report, establishes a clear expectation that technology and information risk must be governed with the same rigor as financial risk.

Key Provisions Affecting Businesses

The Cybercrime Act criminalizes a wide range of activities, including unauthorized access to computer systems, data interference, and cyber-extortion. For businesses, the most significant implications relate to:

• Reporting Obligations: Certain institutions, particularly financial firms and telecommunications providers, have a mandatory duty to report specific cybercrimes to the South African Police Service (SAPS).
• Preservation of Evidence: The Act provides SAPS with extensive powers for the search and seizure of digital information. Companies must have processes in place to cooperate with these investigations while protecting their own legal interests.
• Corporate Liability: Section 52 of the Act explicitly addresses the liability of "juristic persons." If a cybercrime is committed by a director or employee for the benefit of the company, and it can be shown that the company failed to take reasonable steps to prevent it, the organization itself can be prosecuted and fined.

The Executive's Duty of Care

Under the Companies Act and the principles of King IV, directors have a fiduciary duty to act with due care, skill, and diligence. In 2026, this duty extends to the oversight of cybersecurity. Executives are expected to ensure that the organization has:

• A Robust Security Strategy: A documented plan for identifying, protecting against, and responding to cyber threats.
• Adequate Resource Allocation: Ensuring that the security team has the budget and tools needed to maintain a strong defense.
• Continuous Monitoring and Reporting: Receiving regular updates on the organization's security posture and active threats.
• Incident Response Readiness: Participating in tabletop exercises and ensuring that a clear crisis management plan is in place.

Conclusion

The Cybercrime Act serves as a stark reminder that the digital world is subject to the rule of law. For South African executives, the path to minimizing liability lies in proactive governance and a demonstrable commitment to cybersecurity excellence. By treating cyber risk as a fundamental business risk and ensuring that the organization implements "reasonable technical and organisational measures," directors can protect both their firms and their own professional reputations in an increasingly litigious environment.