What section 22 requires
Section 22 of POPIA applies where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person. The responsible party must notify the Information Regulator and, unless the identity of the data subject cannot be established, the data subject.
Notification must be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement and the measures needed to determine the scope of the compromise and restore the integrity of the system. A delay is allowed only where a public body responsible for investigations, or the Regulator, decides notification would impede a criminal investigation.
Why many teams work to 72 hours
POPIA does not fix a number of hours, and the Regulator judges what was reasonable in the circumstances. Many South African organisations adopt 72 hours as an internal outer limit, matching the GDPR and most African laws, because it is defensible and keeps the response moving. hlola uses 72 hours as its working default for South African entities for the same reason.
Notifying data subjects
Notice to data subjects must be in writing, by mail to their last known address, by email, by placement on your website, by publication in the news media, or as the Regulator directs. It must give enough information for them to take protective measures, including:
- A description of the possible consequences of the compromise
- The measures you intend to take or have taken
- A recommendation on what they should do to mitigate the effects
- If known, the identity of the unauthorised person
The Regulator's prescribed notification form is submitted through its online portal. hlola's incident register records discovery time, the notification decision and the Regulator's acknowledgement as evidence.
Common questions
How long do you have to report a breach under POPIA?
POPIA sets no fixed number of hours. Section 22 requires notification as soon as reasonably possible after discovering the compromise; many organisations use 72 hours as an internal outer limit.
Who do you notify under POPIA section 22?
The Information Regulator, and the affected data subjects unless their identity cannot be established.
Can notification be delayed?
Only where a public body responsible for investigations, or the Regulator, determines that notification would impede a criminal investigation.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.