South AfricaCybercrimes Act, Duty to Report Cybercrime Offences to the Police
Cybercrimes Act 19 of 2020, s. 54
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Section 54 of the Cybercrimes Act is not yet in operation: the proclamation that brought most of the Act into operation on excluded it, and the duty below binds only once it is proclaimed and the Cabinet member responsible for policing has prescribed the offences to be reported.
- This binds an electronic communications service provider, a person who provides an electronic communications service under a licence issued under the Electronic Communications Act, 2005 (or who is deemed licensed or exempt), and a financial institution as defined in the Financial Sector Regulation Act, 2017 (reached by declaring that you provide telecom services or financial services).
- When you become aware that your electronic communications service or network is involved in an offence in Part I of Chapter 2 of the Act that the Cabinet member responsible for policing has prescribed, report the offence to the South African Police Service in the prescribed form and manner without undue delay and, where feasible, not later than 72 hours after becoming aware of it (section 54(1)(a)).
- Preserve any information which may be of assistance to the South African Police Service in investigating the offence (section 54(1)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
An electronic communications service provider or financial institution that fails to comply with section 54(1) is guilty of an offence and liable on conviction to a fine not exceeding R50 000 (section 54(3)), once the section is in operation.
Penalty structure
Section 54(3) sets a fine not exceeding R50 000 for a failure to comply with the reporting duty in section 54(1); it states no term of imprisonment for that failure.
- Rule
- Fixed only
- As of
- Currency
- ZAR
- Fixed cap
- 50,000
Who enforces it
Enforcement body
The South African Police Service, to which the offence is reported (section 54(1)(a)).
Settledness
- As of
- Open questions
- When will section 54 be brought into operation, and which offences will the Cabinet member responsible for policing prescribe under section 54(2)?
What this law does
Section 54(1) of the Cybercrimes Act requires an electronic communications service provider or financial institution that becomes aware that its electronic communications service or network is involved in an offence in Part I of Chapter 2 determined under subsection (2) to report the offence to the South African Police Service without undue delay and, where feasible, not later than 72 hours after becoming aware of it.
Section 54(1)(b) requires the provider or institution to preserve any information which may be of assistance to the South African Police Service in investigating the offence. Section 54(2) requires the Cabinet member responsible for policing to prescribe by notice in the Gazette the category or class of offences that must be reported.
Section 54(3) makes an electronic communications service provider or financial institution that fails to comply with subsection (1) guilty of an offence liable on conviction to a fine not exceeding R50 000. Section 1 defines an electronic communications service provider to include a person who provides an electronic communications service under an electronic communications service licence issued under the Electronic Communications Act, 2005.
Section 1 defines a financial institution as a financial institution as defined in section 1 of the Financial Sector Regulation Act, 2017. The proclamation published in Government Gazette 45562 of under section 60 of the Cybercrimes Act fixed for the commencement of Chapter 8, with the exclusion of section 54. The President assented to the Cybercrimes Act on .
When LexLint raises it
When your app profile says your app provides telecom services or provides financial services.