AI-assisted Cyberattacks: When Does POPIA Require Notification?

Cyberattacks are not new. What is changing is the speed, scale and sophistication at which they can be carried out.

Artificial intelligence ("AI") is increasingly being used by threat actors to generate convincing phishing messages, impersonate individuals, automate reconnaissance and accelerate parts of the attack lifecycle. Its most immediate impact is not necessarily to create entirely new forms of attack, but to increase the speed, scale, accessibility and personalisation of familiar techniques, sometimes with limited human intervention.

For South African businesses, this raises an important legal question: as the threat evolves, what does POPIA require organisations to do, and when must a security compromise be notified?