A stolen laptop, a mailbox taken over, a database exposed by a misconfigured server. The moment you have reasonable grounds to believe personal information has reached someone unauthorised, section 22 of POPIA applies, and it comes with a clock. The businesses that handle this well decided everything in advance. The ones that handle it badly start drafting their first breach notice during the breach.
What section 22 requires
You must notify the Information Regulator and the affected people as soon as reasonably possible after discovery. The Act allows delay for two reasons only: the legitimate needs of law enforcement, or the time genuinely needed to establish the scope of the compromise and restore your systems. Neither covers waiting to see whether anyone notices. The threshold is also lower than many expect: reasonable grounds to believe, so an email sent to the wrong recipient or a ransomware event where you cannot prove data was taken can both qualify.
Since 1 April 2025 the notice to the Regulator must go through its eServices portal. The earlier form sent by email is no longer accepted. The notice to affected people must be concrete enough for them to protect themselves: what happened, what information was involved, what you have done about it, and what they should do next, such as changing passwords or watching for fraud.
Decide it all before the incident
- Name the owner: one person who decides that section 22 has been triggered and signs the notification.
- Prepare the paperwork now: see what the Regulator’s portal asks for, and draft the customer notice with blanks for the facts.
- Know your channels: how you would reach every affected person, and what you would publish if you cannot identify them individually.
- Keep an incident log from the first hour, because “as soon as reasonably possible” is judged on what you knew and when.
The reputational read
Companies rarely lose public trust because they were breached. They lose it when the notification arrives late, vague, or after the press already has the story. A fast and plain notice is the strongest signal a business can send that it was in control of anything at all that week.
Could you send a compliant breach notice this week if you had to? Tell us what’s on fire
Updated 1 October 2026: breach notifications to the Regulator now go through its eServices portal.