South AfricaProtection of Personal Information Act, notification of security compromises
POPIA, s. 22 (notification of security compromises)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Information Regulator of a security compromise as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person; the Act sets no fixed hour or day limit, only this standard.
- Notify the affected data subject of the same security compromise as soon as reasonably possible after discovery, in writing, unless a law-enforcement body or the Regulator determines that notifying would impede a criminal investigation, or the data subject's identity cannot be established.
- In the notification to the data subject, describe the compromise's likely consequences, the measures you have taken or intend to take to address it, a recommendation of what the data subject should do, and, if known, the identity of the unauthorised person.
- As an operator, notify the responsible party immediately once you have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 22 requires the responsible party to notify the Information Regulator and the data subject of a security compromise as soon as reasonably possible, to say what the notice must contain, and to publicise the compromise if the Regulator directs. It asks the responsible party to keep no log or register of compromises and gives the Regulator no power to check one. Section 17 (documentation of processing operations) sits in the general row, not this one.
- Kind
- None
- As of
What this law does
Section 22(1) requires a responsible party, where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, to notify both the Information Regulator and the affected data subject, unless the data subject's identity cannot be established.
Section 22(2) fixes the moment the notification is due from the discovery of the compromise: notification must be made as soon as reasonably possible after that discovery, taking into account the legitimate needs of law enforcement and any measures needed to determine the compromise's scope and restore the responsible party's information system.
Section 22(3) lets the responsible party delay only the data subject's notification, and only where a law-enforcement body or the Regulator determines that notifying would impede a criminal investigation; section 22(4) requires the data subject's notification to be in writing, by at least one of several listed channels, and section 22(5) requires it to describe the compromise's likely consequences, the measures taken or proposed to address it, a recommendation for the data subject, and, if known, the unauthorised person's identity.
Section 21(2) separately requires an operator processing personal information for a responsible party to notify that responsible party immediately on the same reasonable grounds.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .