A ransomware attack does not by itself put an organisation in breach of POPIA. What does is the state of its data protection when the attack lands. That is the clearest message from the Information Regulator’s media briefing on 31 August 2026, where it set out its enforcement action against the South African Bureau of Standards. Following a significant ransomware attack on the SABS in 2024, the Regulator carried out its own assessment and found contraventions of several conditions for lawful processing. It was explicit that it acted because of those underlying failures, not because the SABS had been the victim of a cyber attack.
What did the Regulator find at the SABS?
As reported from the briefing by ITWeb and by Werksmans, the Regulator’s assessment found that the SABS had:
- processed excessive or irrelevant personal information, contrary to the principle that processing must be adequate, relevant and not excessive;
- relied on inadequate consent mechanisms;
- maintained insufficient security safeguards; and
- failed to inform data subjects about how their information was collected.
The SABS was directed to revise its policies, conduct risk and impact assessments, and implement adequate security measures within 90 days.
Only one of those four findings is about security technology. The other three concern how much data the organisation held, on what basis, and what it told people. That is the important point for boards. A ransomware incident brings the Regulator’s attention to the whole processing environment, and the Regulator then examines the whole environment.
How many organisations are now in the same position?
The briefing also gave the clearest recent picture of reported incidents. According to ITWeb’s report, the Regulator has received more than 8,000 security compromise notifications in total, including more than 1,220 since 1 April 2026, less than five months into the 2026/27 financial year. It indicated that notifications could exceed 3,000 by the end of the financial year.
Chairperson Advocate Pansy Tlakula described the situation as “very alarming”. Advocate Tshepo Boikanyo, the Regulator’s executive for POPIA, said the source of these compromises is “inadequate security controls, which is what we pick up during our assessments”, citing employee negligence or human error, weak passwords, malware, ransomware and phishing. He added that some responsible parties do not report compromises at all.
Each notification is a point at which the Regulator can decide to look further. The SABS matter shows that it is prepared to do so on its own initiative, without waiting for a complaint.
Why does a breach lead to a wider review?
A security compromise notification under section 22 of POPIA tells the Regulator that personal information may have been accessed or acquired by an unauthorised person. To assess the risk, the Regulator needs to understand what information was held, why, and how it was protected. Those are exactly the questions that expose weaknesses in minimality, consent, openness and safeguards. The Regulator’s own guidance, as quoted by ITWeb, is that a security compromise “does not have to be confirmed before it is reported”, so the review can begin while the organisation is still investigating.
Put simply, a notification invites the question “should you have had this data, and did you protect it properly?” Organisations that have never asked themselves that question will find it asked for them, under time pressure, by a regulator.
What should an organisation be able to show before an incident?
A POPIA gap assessment compares how an organisation actually processes and protects personal information against the Act’s conditions, and produces a prioritised list of shortfalls. If the SABS findings are a guide, the evidence a responsible party should have ready includes:
- A processing register showing what personal information is held, for what purpose and on what lawful basis.
- Retention and minimisation decisions, showing why each category of data is still needed.
- Consent records and privacy notices that match actual practice, including how information is collected.
- A risk assessment of security safeguards, mapped to the systems that hold personal information, with evidence of testing.
- Personal information impact assessments for higher-risk processing.
- An incident response plan that has been exercised, with clear section 22 decision-making.
None of this is new. The difference in 2026 is that the Regulator is demonstrably using breach notifications as a route into these questions.
What to do this quarter
- Assume a notification will be followed by questions about your whole processing environment, and prepare the evidence pack above.
- Run a cybersecurity audit mapped to POPIA conditions, not only to technical controls.
- Delete what you do not need. Excessive data was a finding in its own right at the SABS, and it enlarges every breach.
- Review privacy notices and consent flows against how information is actually collected today.
- Complete or refresh risk and impact assessments for systems holding special personal information or large volumes of client data.
- Test ransomware recovery, including offline or immutable backups, so an attack does not become a prolonged outage as well as a regulatory matter. Our analysis of the Land Bank ransomware reply covers the architectural side.
Frequently asked questions
Why did the Information Regulator take action against the SABS?
After a 2024 ransomware attack, the Regulator’s own assessment found excessive processing, inadequate consent mechanisms, insufficient security safeguards and a failure to inform data subjects about collection. It said the action was taken because of these failures, not because the SABS was attacked.
How many security compromises are reported to the Information Regulator?
More than 8,000 in total, and more than 1,220 since 1 April 2026, according to the Regulator’s 31 August 2026 briefing. It indicated the annual total could exceed 3,000.
Can the Information Regulator investigate without a complaint?
Yes. The SABS matter was a regulator-initiated assessment following a security compromise, so a notification can lead to a wider compliance review.
What is a POPIA gap assessment?
It compares actual processing and protection of personal information against POPIA’s conditions and produces a prioritised list of shortfalls, giving the organisation evidence before an incident rather than after it.
How Rhentech can help
Rhentech’s cybersecurity audits assess technical safeguards and POPIA conditions together, so the findings answer the questions a Regulator would ask. Our managed IT and cybersecurity service then maintains the controls and evidence on an ongoing basis.
If a security compromise would leave you unsure what the Regulator would find, book a free initial consultation. The consultation costs nothing; audits and managed services are paid engagements, scoped to your organisation.
Sources
- Information Regulator, media invite for its briefing on high-profile cases, enforcements and investigations, 26 August 2026 (briefing held 31 August 2026).
- ITWeb, “InfoReg concerned by alarming rate of data breaches”, 31 August 2026.
- Werksmans, “The Regulator is watching: new enforcement signals for POPIA and PAIA compliance”, 31 August 2026.
- Protection of Personal Information Act 4 of 2013, sections 10, 11, 18, 19 and 22.
This article is for informational purposes. It does not constitute legal advice. Consult qualified legal counsel for compliance matters specific to your organisation.
Reviewed 20 October 2026.