POPIA Section 22: Understanding Your Notification Obligations

The Core of Post-Breach Compliance

Section 22 of the Protection of Personal Information Act (POPIA) is perhaps the most critical provision for any organization that has suffered a security breach. It establishes the legal framework for "Notification of security compromises," defining when, how, and to whom a breach must be reported. Understanding the nuances of this section is vital for minimizing the regulatory and reputational fallout of a cybersecurity incident in South Africa.

When is Notification Triggered?

The duty to notify arises when there are "reasonable grounds to believe" that the personal information of a data subject has been accessed or acquired by an unauthorized person. This is an objective test. It does not require absolute certainty, but it does require more than mere suspicion. This is why having a SOC and SIEM system is invaluable; it provides the evidence needed to establish these "reasonable grounds."

The "Reasonably Possible" Standard

POPIA requires that notification be made "as soon as reasonably possible" after the discovery of the compromise. The Information Regulator acknowledges that the first priority is to secure the system and contain the breach. However, once the situation is stable, the notification must follow swiftly. Unjustified delays are a primary reason for the Regulator to issue "Enforcement Notices" and fines.

Required Content of the Notice

The notice to the data subject must provide sufficient information to allow them to take protective measures. This includes:

• A description of the potential consequences of the breach (e.g., identity theft, financial loss).
• Recommendations for mitigation (e.g., changing passwords, monitoring bank statements).
• The measures the organization is taking to address the breach.

For organizations managing large volumes of data, using Mobile Security (MDM) to secure endpoints and Server Protection to safeguard databases is the first step in ensuring these compromises don't happen in the first place.

Exemptions

In rare cases, the Information Regulator or the South African Police Service (SAPS) may direct the organization to delay notification if it would impede a criminal investigation. However, this is the exception, not the rule.

Conclusion

Section 22 is not just a regulatory hurdle; it is a tool for maintaining trust with your customers and stakeholders. By being transparent and proactive in your communications, you can demonstrate that your organization takes data privacy seriously, even in the face of a crisis.