South AfricaElectronic Communications and Transactions Act, Protection of Critical Databases
Electronic Communications and Transactions Act 25 of 2002, Chapter IX (ss. 52 to 58)
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Licensing
As of .
What it requires
- This binds a critical database administrator, the person responsible for the management and control of a critical database, which is a collection in electronic form of data the Minister has declared by notice in the Gazette to be of importance to the protection of the national security of the Republic or the economic and social well-being of its citizens (sections 1, 52 and 53; reached by declaring that you operate an essential service).
- Register the critical database with the Department or the body the Minister specifies, recording your full name, address and contact details, the location of the database and a general description of the categories of information it holds, in the manner the Minister determines by notice in the Gazette (section 54).
- Meet the minimum standards and prohibitions the Minister prescribes for the general management of the critical database, access to, transfer and control of it, the rules for securing the integrity and authenticity of critical data, its storage and archiving, and disaster recovery plans (section 55(1)).
- Allow the Director-General to audit your compliance with Chapter IX, by cyber inspectors or an independent auditor (section 57).
- Where an audit finds non-compliance and the Director-General notifies you in writing, take the remedial action within the period the notice states (section 58).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
A critical database administrator that fails to take the remedial action within the period stated in an audit non-compliance notice is guilty of an offence (section 58(2)), punishable on conviction by a fine or imprisonment for a period not exceeding 12 months (section 89, as substituted by the Cybercrimes Act 19 of 2020).
Who enforces it
Enforcement body
The Director-General of the Department of Communications named in section 1, who may audit a critical database administrator and notify it of non-compliance (sections 57 and 58).
Settledness
- As of
- Open questions
- Has the Minister declared any class of information to be critical data by notice in the Gazette under section 53?
What this law does
Section 52 of the Electronic Communications and Transactions Act provides that Chapter IX applies only to a critical database administrator and critical databases or parts thereof. Section 1 defines a critical database administrator as the person responsible for the management and control of a critical database.
Section 53 lets the Minister, by notice in the Gazette, declare classes of information of importance to the protection of the national security of the Republic or the economic and social well-being of its citizens to be critical data. Section 54(3) defines registration of a critical database as recording specified information about it in a register maintained by the Department or by another body the Minister specifies.
Section 55(1) lets the Minister prescribe minimum standards or prohibitions for the general management of critical databases and for access to, transfer and control of them. Section 57 lets the Director-General cause audits to be performed at a critical database administrator to evaluate compliance with Chapter IX, by cyber inspectors or by an independent auditor.
Section 58(2) makes it an offence for a critical database administrator to fail to take the remedial action within the period stated in an audit non-compliance notice. Section 89 of the Act, as substituted by the Cybercrimes Act, punishes a person convicted of an offence under section 58(2) with a fine or imprisonment for a period not exceeding 12 months. The Electronic Communications and Transactions Act commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.