The Bot In The Room: Does Automated Access Trigger POPIA's Breach Notification?

Section 22 of the Protection of Personal Information Act, 2013 ("POPIA") states that organisations must notify the Information Regulator and affected data subjects when "there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person". But what do these concepts actually mean? POPIA does not define "accessed", "acquired", "reasonable grounds to believe", or "unauthorised person”. Neither the Information Regulator nor the South African courts have clarified them. We must therefore look to established cybersecurity frameworks and digital forensics practices to give these terms meaningful content.

In this article, we examine these concepts and consider how they apply to modern cyber-attacks, drawing on both POPIA and the Cybercrimes Act, 2020. We do not take a definitive view, but instead, we outline the key considerations organisations should consider when determining whether notification is required.