Security Compromise (POPIA Section 22)
Also known as: Data Breach, Privacy Breach, Security Breach.
What is Security Compromise?
A security compromise, under section 22 of POPIA, is a situation where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. It triggers mandatory notification to the Information Regulator and affected data subjects "as soon as reasonably possible" after discovery.
Drafted and reviewed by
Attorney & Founder, My-Contracts.co.za · Legal Practice Council of South Africa (LPC F17333)
Definition and context
Section 22 of the Protection of Personal Information Act 4 of 2013 creates South Africa\'s mandatory breach-notification regime. Where there are reasonable grounds to believe that personal information of a data subject has been accessed or acquired by any unauthorised person, the responsible party must notify the Information Regulator and the affected data subject as soon as reasonably possible after the discovery of the compromise. Only the Regulator may authorise a delay for law-enforcement reasons or for the integrity of the investigation.
The notification must, under section 22(5), be in writing and communicated to the data subject by email, website, post or prominent media when direct communication is not reasonably practicable. It must provide sufficient information to allow the data subject to take protective measures: a description of the possible consequences; the measures the responsible party intends to take or has taken; a recommendation on what the data subject should do; the identity of the person who accessed the information, where known; and contact details for further information. The Information Regulator\'s POPIA Section 22 Notification Form (eRegulator portal) prescribes the standardised content for the Regulator notification.
Enforcement in 2022–2024 has been aggressive. The Regulator\'s enforcement notice to TransUnion (May 2023) and investigations against Dis-Chem and Experian demonstrate that delayed, partial or misleading notifications are themselves treated as separate contraventions. Well-drafted operator agreements contractually mirror section 22 obligations — usually requiring the operator to notify the responsible party within 24 to 48 hours of discovery, cooperate with forensic investigation, and indemnify the responsible party for regulatory fines arising from the operator\'s failures.
Where this term lives in law
Protection of Personal Information Act 4 of 2013
Sections: 19, 22, 73, 99, 109
Regulates the processing of personal information by public and private bodies in South Africa.
Frequently asked questions
What is a security compromise under POPIA?
A security compromise is a situation where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. It is POPIA's equivalent of the GDPR personal-data breach and triggers section 22 notification duties.
When must a POPIA security compromise be reported?
As soon as reasonably possible after discovery. Section 22 does not prescribe a fixed deadline like the GDPR's 72 hours, but the Information Regulator's practice is to treat anything beyond 72 hours as requiring detailed justification. Delay may be authorised by the Regulator for law-enforcement reasons only.
Who must be notified?
Two parties: the Information Regulator (via its prescribed form) and every affected data subject. Where direct communication is not practicable, website, email or prominent media notice is permitted under section 22(4)(d). Operators must notify the responsible party immediately so that section 22 obligations can be met.
What happens if an organisation fails to notify?
Failure to notify is itself an interference under section 73 of POPIA, attracting administrative fines of up to R10 million under section 109, possible enforcement notices, and potential civil damages under section 99. Directors may face personal accountability where negligence is established.
Contract templates using this term
2 templates reference Security Compromise (POPIA Section 22).