Cybersecurity is often imagined as a battle against hackers, but businesses can expose information without a hacker ever entering their systems. For a business holding customer names, ID numbers or financial information, ordinary operational mistakes can become information-security incidents — POPIA compliance is a people-and-process responsibility, not only an IT one.
Source: Information Regulator (South Africa)
Frequently Asked Questions
What is a security compromise?
It is a compromise involving the security, confidentiality, integrity or availability of personal information.
Does a data breach have to involve hacking?
No — accidental disclosure or loss can also constitute a security compromise.
What should a business do after discovering a compromise?
The Information Regulator advises responsible parties to identify the incident, mitigate harm and follow the required notification process.