In September 2026 an attacker got into RelyComply, a company that runs identity checks for financial services firms. Within days EasyEquities, Satrix and Alexforbes were telling their own clients that names, identity details and account numbers may have been exposed. EasyEquities reported that none of its own systems had been touched. The breach happened at a supplier, and the letters still went out under the firms’ own names.
That is how POPIA is designed to work. If a supplier holding your client data is breached, the law gives the duties to you. This is what you owe, and to whom.
The duty stays with you
POPIA names two roles. The responsible party is the business that decides why personal information is collected and what it is used for. The operator is any supplier that handles the information on that business’s behalf: a verification service, a payroll bureau, a hosting company, a software vendor.
When an operator is breached, the Act splits the work in two. Section 21 requires the operator to tell you immediately when it has reason to believe someone unauthorised has reached the information. Section 22 then requires you, the responsible party, to notify the Information Regulator and the people affected. The supplier owes you a phone call. You owe everyone else an explanation.
What you owe the Regulator
- A notification as soon as reasonably possible. The clock starts when you have reasonable grounds to believe the information was accessed. Proof is not required.
- Through the eServices portal. Since 1 April 2025 the Regulator accepts security compromise notifications only through its online portal. The older form sent by email no longer counts.
- Whatever the size. The Act sets no minimum level of risk. A small breach is still reportable.
- Before the investigation ends. The Act allows delay only for law enforcement, or for the time needed to establish the scope and restore your systems. Report what you know and update it as the facts arrive.
What you owe your clients
Section 22 requires a notice in writing that gives people enough to protect themselves. It must reach them by post, by email, or through a prominent notice on your website or in the news media. It has to cover four things:
- The possible consequences of the breach for them.
- What you have done, or will do, about it.
- What they should do, such as watching for phishing messages that quote their real details.
- Who the intruder was, if you know.
Name the information involved. “Some personal data” tells a client nothing. “Your full name, ID number and account number” tells them which messages to distrust for the next year. Say just as plainly what was left untouched. EasyEquities told clients that balances and login details were unaffected, which answers the first question every client asks.
The first week, in order
- Get the facts in writing. Ask the supplier which records, which clients, and from what date. You cannot notify anyone accurately without that list.
- Cut the connection. Stop sending data to the supplier until it can show the intruder is out. EasyEquities disabled its link to the verification service the day after the break-in.
- Start a log. Record what you learned and when. “As soon as reasonably possible” is judged against that timeline.
- Notify the Regulator through the portal.
- Notify the affected clients with the four points above.
- Brief the people who answer the phones. Clients will call, and so will fraudsters holding the stolen details.
- Set the conditions for reconnecting. Decide what evidence the supplier must give you before any data flows again, such as an independent investigator’s report.
What the Regulator asks afterwards
The questions after a supplier breach are predictable, because the Regulator has asked them before. In 2022 an attacker reached about 3.6 million Dis-Chem customer records held by Grapevine, one of the retailer’s suppliers. On 31 August 2023 the Regulator issued Dis-Chem with an enforcement notice. One of its findings was that Dis-Chem had no operator agreement with Grapevine, which is the written contract section 21 requires. Dis-Chem made the fixes the notice ordered and was not fined.
Expect to be asked for the contract, for evidence that you checked the supplier’s security before trusting it with client data, and for the date you first knew about the breach. A business that can produce all three has a short conversation.
Three things to have before it happens
- A supplier register. List every supplier that holds client data, and exactly which data each one holds. On the day of a breach this list tells you who is affected.
- A written contract with each one. It should include the duty to notify you immediately, and a named person at the supplier who makes that call.
- A drafted client notice. Write it now with blanks for the facts, so that the first draft is not written during the incident.
Do you know which of your suppliers hold client data, and what each one holds? Tell us what’s on fire