Information Security Incident Readiness Under POPIA

Information security incidents can affect personal information, business operations, customer trust, and regulatory compliance. An organisation may have firewalls, access controls, and security software in place, but these measures do not guarantee that an incident will never occur.

Effective preparation requires clear responsibilities, tested response procedures, reliable evidence, and an understanding of POPIA reporting duties. Organisations that wait until an incident occurs may struggle to identify what happened, contain the threat, notify the correct parties, and restore the affected systems.

Why Information Security Readiness Matters

An information security incident may involve unauthorised access, lost equipment, malicious software, compromised email accounts, accidental disclosure, or information sent to the wrong recipient.

The Information Regulator explains that a security compromise occurs when personal information has been accessed or acquired by an unauthorised person. POPIA does not provide a minimum reporting threshold, meaning organisations should not assume that an incident is too small to require attention.

A well-prepared organisation can respond more quickly, reduce uncertainty, and maintain better records of the decisions made during the incident.

Define Incident Response Responsibilities

Employees should know who must be contacted when suspicious activity is identified. An incident response plan should assign responsibilities to relevant personnel, including:

• The Information Officer
• Information technology personnel
• Information security specialists
• Legal and compliance representatives
• Communications teams
• Human resources
• Senior management
• Relevant service providers

The plan should also identify who has the authority to isolate systems, contact affected individuals, appoint external specialists, and communicate with regulators.

These responsibilities must be documented before an incident occurs. Delays often happen when employees are uncertain about who can make urgent decisions.

Understand POPIA Reporting Duties

Section 22 of POPIA requires a responsible party to notify the Information Regulator and affected data subjects when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

The notification must be made as soon as reasonably possible after the compromise is discovered. Since 1 April 2025, security compromise reports have been submitted through the Information Regulator’s eServices portal.

When an operator, such as a cloud provider, payroll company, or outsourced service provider, experiences a compromise involving information controlled by another organisation, the operator must notify the responsible party. The responsible party remains responsible for notifying the Regulator and affected data subjects.

Preserve Evidence from the Beginning

An organisation must understand what happened before it can make informed decisions.

Incident records may include:

• The date and time the incident was detected
• The systems and information affected
• Initial alerts and employee reports
• User access records
• Communication with service providers
• Containment actions
• Investigation findings
• Regulatory notifications
• Corrective actions
• Recovery decisions

Employees should avoid deleting suspicious emails, resetting affected devices without guidance, or changing records that may be required during an investigation.

Evidence preservation supports regulatory reporting, insurance claims, disciplinary processes, legal reviews, and future improvements.

Use ISO 27001 to Strengthen Preparation

ISO/IEC 27001:2022 provides a structured approach to managing information security risks through an Information Security Management System. It helps organisations establish, implement, maintain, and continually improve controls that reflect their operations and risk profile.

ISO/IEC 27035-1:2023 provides additional guidance on preparing for, detecting, reporting, assessing, responding to, and learning from information security incidents.

ISO/IEC 27701:2025 focuses specifically on privacy information management. It sets requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System for organisations acting as controllers or processors of personally identifiable information. This makes it particularly relevant to POPIA, as it supports more structured management of personal information, privacy responsibilities, and related controls.

Together, these standards can support incident readiness through risk assessments, access management, supplier controls, employee awareness, privacy governance, incident procedures, and post-incident reviews.

However, certification against ISO/IEC 27001 or ISO/IEC 27701 does not automatically guarantee POPIA compliance. The management systems must still reflect applicable legal duties, the organisation’s actual processing activities, and the way personal information is managed in practice.

Test the Response Plan

An untested incident response plan may fail when it is needed most. Organisations should conduct scenario-based exercises involving situations such as ransomware, stolen devices, compromised email accounts, supplier breaches, or accidental disclosures.

Testing helps determine whether employees can identify an incident, escalate it correctly, access important contact details, preserve evidence, and make timely decisions. Each exercise should produce improvement actions, assigned responsibilities, and completion dates.

Build a Defensible Incident Response Process

Information security incident readiness is not only a technical responsibility. It requires coordination between technology, management, legal, compliance, communications, and operational teams.

WWISE assists organisations with ISO/IEC 27001 and ISO/IEC 27701 implementation, information security and privacy risk assessments, internal audits, POPIA compliance reviews, and incident readiness planning. A well-designed response process can help your organisation act quickly, meet its reporting responsibilities, protect personal information, and learn from security incidents.