Understanding Your Organisation's Data Breach Liability In Terms Of POPIA

Data breaches have become an everyday reality in the 21^st century and have, alarmingly, impacted numerous respected, large enterprises. The recent incident involving a prominent South African insurance provider, reported on 06 June 2024, saw the exposure of personal information (PI) belonging to 19 of its clients. A few of the affected clients expressed their frustration on social media, questioning the insurance company's remedial solutions for the aforementioned data breaches. This incident underscores the importance of understanding the responsibilities imposed upon a "responsible party" as outlined in the Protection of Personal Information Act 4 of 2013 (POPIA).

POPIA distinguishes between a "responsible party", who determines the purpose and means of processing PI and an "operator", who processes PI for a responsible party in terms of a mandate (Section 1 of POPIA). However, in the event of a data breach, the responsible party incurs full liability, and