3 September 2026LANTEK Computers
This article describes how the question is generally approached. It is not legal advice, and the decision about whether to notify is one to take with your attorney, because it turns on a judgement about your specific facts.
With that said, the shape of it is worth understanding before you need it, because the decision arrives at a bad moment and under pressure.
The test is about access, not about damage
POPIA’s notification duty is triggered where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.
Two things about that wording matter more than anything else here.
It is accessed or acquired, not misused. You do not have to be able to show that anything was done with the information. Somebody having been able to reach it is the trigger. This surprises people who reason that no harm appears to have followed, so there is nothing to report.
It is reasonable grounds to believe, not certainty. You are not required to prove it, and you cannot wait for proof. Equally, a vague possibility is not reasonable grounds. It sits between those, which is exactly why it is a judgement rather than a calculation, and exactly why your attorney is in this conversation.
Things that are frequently notifiable
Not a determination for your situation, but these are the cases where the answer commonly comes out as yes.
A mailbox compromised, where the mailbox contained personal information about clients or staff, which for most businesses it does. A laptop stolen without disk encryption. Ransomware where the attacker had access to file shares before encrypting, which is now typical rather than exceptional. A misdirected email or attachment containing other people’s information. A system exposed to the internet without authentication for a period. A departing employee taking a client list.
Things that frequently are not
Equally, plenty of incidents do not meet the threshold, and treating everything as notifiable is its own problem.
A failed sign-in attempt, or many of them, where none succeeded. Phishing that nobody acted on. Malware detected and blocked before execution. A stolen laptop that was encrypted and powered off, though this depends on the encryption actually having been on. An outage with no unauthorised access. And an incident affecting information that is not personal information at all.
The distinction in several of those is whether anybody actually got in. An attempt is not an access.
Write down the reasoning either way
This is the practical advice that matters most, and it is the step almost everybody skips.
If you assess an incident and conclude it is not notifiable, record that assessment: what happened, what you established, what you could not establish, who was involved in the decision, what you decided and why.
Two reasons. If the position is ever questioned, a contemporaneous record of a reasoned decision is a completely different thing to a recollection. And the discipline of writing it forces the assessment to be real rather than assumed, which is worth something on its own.
The same argument applies to the running log described in the first 24 hours. Start the document early, because reconstructing times afterwards is unreliable.
Who has to be told
Two separate duties, and they are frequently conflated.
The Information Regulator. Notified using the Regulator’s own form and process.
The people affected. POPIA requires the data subjects to be notified as well, in a manner the Act specifies, so that they can take protective steps themselves. This is the harder half in practice, because it is the one your clients will see.
There are limited circumstances in which notifying individuals may be delayed, for instance where a public body says immediate notification would impede a criminal investigation. That is a narrow provision and not a general licence to wait, and whether it applies is a question for your attorney.
The timing question
POPIA frames it as as soon as reasonably possible after discovering the compromise.
Note what that is not: it is not a fixed number of days. You will see specific deadlines quoted, and they are usually somebody importing a figure from another jurisdiction. We are deliberately not printing a number, because doing so would be inventing a deadline the Act does not set.
What as soon as reasonably possible does allow is the time needed to establish the facts, which is legitimate: notifying with a materially wrong scope, then correcting it, is worse than a short delay to get it right. What it does not allow is delay for convenience, or while deciding whether to tell anybody.
What a notification contains
Enough detail for the recipient to understand and act. In broad terms that means a description of what happened, what kind of information was involved, what the likely consequences are, what you have done and are doing about it, and what the affected person can do to protect themselves.
The last of those is the part people underweight, and it is the part your clients will actually read. If email addresses and passwords were exposed, telling somebody to change that password anywhere else they used it is genuinely useful advice.
Where businesses go wrong
Concluding too early. First assessments are usually too narrow. Establish what an account could reach, not what you can see it touched.
Deciding informally. A conversation in a corridor is not an assessment. Write it down.
Assuming the provider will handle it. Your IT provider establishes the technical facts. The notification duty is the business’s, and it sits with the Information Officer, which per the Information Officer role is probably the head of the business.
Saying publicly that no data was affected before that is established. Correcting it later does more damage than the initial silence would have.
Not knowing who to call. The attorney’s number, the insurer’s number and the provider’s after hours number should be written down somewhere that does not require email access to reach.
What to do before any of this
Decide now who makes this decision, and with which attorney. Confirm whether you have cyber cover and what it requires. And make sure your systems retain enough logging that the scope question can actually be answered, because you cannot assess access you have no record of.
That last one is quietly the most important, and it is the argument for continuous monitoring beyond detection: it is what makes the after-the-fact question answerable.
How the security half of POPIA is built into what we do is on Compliant by design. If you are in the middle of something now, telephone us, and telephone your attorney.