--- title: "POPIA and Cyber Security: What SMEs Must Do Before and After a Breach" description: What POPIA requires South African SMEs to do about cyber security, how to report a breach to the Information Regulator, and how to prepare. --- # [POPIA and Cyber Security: What SMEs Must Do Before and After a Breach](https://www.cyber-guard.co.za/cyber-guard-blog/popia-and-cyber-security-what-smes-must-do-before-and-after-a-breach) Written by [Jayson](https://www.cyber-guard.co.za/cyber-guard-blog/author/jayson) | Oct 25, 2026, 1:05:02 PM **POPIA requires every South African business that handles personal information to keep it secure with reasonable technical and organisational measures (section 19), and to report any security breach to the Information Regulator and the people affected as soon as reasonably possible (section 22).** Since April 2025, breaches must be reported through the Regulator's online eServices portal. For an SME, that means having real security in place before an incident, and a plan for what to do after one. *This article is general information, not legal advice.* ## Does POPIA apply to my small business? Almost certainly. If you keep names, ID numbers, contact details, banking details, medical information or staff records of identifiable people, POPIA applies to you, whatever the size of your business. ## What does "reasonable security" mean in practice? POPIA doesn't name specific products. It requires you to identify risks to personal information, put sensible safeguards in place, check they work and keep them up to date. For a typical SME today, that includes: - Multi-factor authentication on email and cloud systems - Protection on every device that holds personal information - Email security and staff who know how to spot phishing - Encrypted, tested backups - Access control, so people only see the data their job needs - Up-to-date software and operating systems - A written plan for what to do if something goes wrong - Contracts that require your service providers to protect data too ## What counts as a security breach under POPIA? POPIA calls it a "security compromise": any situation where there are reasonable grounds to believe personal information has been accessed or taken by someone without permission. Common SME examples: - A hacked mailbox containing client or patient emails - Ransomware on a server or laptop that holds personal data - A stolen laptop that wasn't encrypted - An employee emailing a spreadsheet of client details to the wrong person The Regulator has made clear that breaches must be reported whatever their size, and that an honest mistake does not remove the duty to report. Not sure if your security is "reasonable"? Our free cyber risk assessment shows where your business is exposed and what to fix first. [Get my free risk assessment](https://www.cyber-guard.co.za/free-risk-assessment) ## How do I report a breach to the Information Regulator? 1. **Contain it:** isolate affected devices, reset passwords and sign out all sessions. 2. **Get the facts:** what happened, when, which information was involved and how many people are affected. 3. **Notify the Regulator** through the eServices portal at [eservices.inforegulator.org.za](https://eservices.inforegulator.org.za). Your Information Officer should be registered on the portal before you ever need it. 4. **Notify the people affected** in writing. Explain what happened, the possible consequences, what you're doing about it and what they should do to protect themselves. 5. **Keep a record** of everything, and fix the cause. ## What happens if I don't comply with POPIA? The Regulator can issue enforcement notices and administrative fines of up to R10 million, and can investigate complaints from affected people. In its first enforcement notice of 2026, the Regulator cited a business for failing to register its Information Officer, failing to put security measures in place and failing to report a breach. Affected clients may also bring claims against you, and for most businesses the damage to trust is the biggest cost of all. ## A 10-point POPIA cyber security checklist for SMEs - ☐ Information Officer appointed and registered on the eServices portal - ☐ A list of where personal information is stored - ☐ MFA on all email and cloud accounts - ☐ Managed protection on every device - ☐ Email filtering plus SPF, DKIM and DMARC on your domain - ☐ Encrypted, tested backups - ☐ Phishing awareness for staff at least every quarter - ☐ A written breach response and notification plan - ☐ Data protection agreements with your IT, payroll and cloud providers - ☐ A yearly review of your risks and controls Email is the most common way breaches start. Our [guide to business email security](https://www.cyber-guard.co.za/cyber-guard-blog/business-email-security-in-south-africa-a-practical-guide-for-smes) covers the practical steps. If a hacked mailbox has been used to send fake invoices, read [how business email compromise works and what to do if you've paid](https://www.cyber-guard.co.za/cyber-guard-blog/business-email-compromise-and-invoice-fraud-how-the-scam-works-in-south-africa). ## How Cyber Guard helps with POPIA Cyber Guard is a Johannesburg-based managed security provider powered by Trend Micro. We provide the technical safeguards POPIA expects, and the reports to show them: - Protection for email, laptops, desktops, phones and Microsoft 365 - 24/7 detection and response by Trend Micro AI and the Cyber Guard team - Reports and controls that help you show reasonable security safeguards - Guidance on policies and your Information Officer duties - A [cyber warranty](https://www.cyber-guard.co.za/cyber-warranty) of up to R1,000,000, underwritten by Hollard, that covers regulatory fines after a privacy breach, legal advice, dealing with the Regulator, notifying affected people and claims made against you - Plans from R69 per user per month, month-to-month. [See pricing](https://www.cyber-guard.co.za/pricing). Try Cyber Guard free for 30 days Up to 25 devices. No card needed. Choose a plan or let it expire. [Start my free trial](https://www.cyber-guard.co.za/free-trial-1) ## Frequently asked questions ### How quickly must I report a POPIA breach? "As soon as reasonably possible" after discovering it. The Act doesn't set a fixed number of hours, but any delay must be justifiable. ### Can I still report a breach by email? No. Since 1 April 2025 the Regulator only accepts breach reports through its eServices portal. ### Does buying security software make me POPIA compliant? It helps with the security requirement, but compliance also needs policies, a registered Information Officer, staff training and a response plan. ### Who is the Information Officer in a small business? By default, the head of the business, such as the owner or CEO, unless the role is delegated. They must be registered with the Regulator. ### Can a POPIA fine be covered? The Cyber Guard cyber warranty covers fines imposed by a government regulator due to a privacy breach, along with legal costs and notifying affected people, subject to the policy terms. Good security is still your best defence, because cover doesn't remove your duty to protect personal information. See [how a cyber warranty compares with cyber insurance](https://www.cyber-guard.co.za/cyber-guard-blog/cyber-warranty-vs-cyber-insurance-what-south-african-smes-should-know). ### Is a hacked mailbox a POPIA breach? If personal information in it was accessed by someone without permission, yes. You must notify the Regulator and the people affected. *Sources: [ITWeb: InfoReg takes data breach reporting online](https://itweb.co.za/article/inforeg-takes-data-breach-reporting-online/Pero3qZ38GdvQb6m); [ENSafrica: Information Regulator's first enforcement notice for 2026](https://www.ensafrica.com/news/detail/11899/information-regulators-first-enforcement-noti); [ACTS: Regulator guide on reporting security compromises](https://www.acts.co.za/news/blog/2025/09/information-regulator-security-compromise-reporting-guide).* [View full post](https://www.cyber-guard.co.za/cyber-guard-blog/popia-and-cyber-security-what-smes-must-do-before-and-after-a-breach) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Jayson" }, "dateModified" : "2026-10-25T13:12:50.478Z", "datePublished" : "2026-10-25T13:05:02Z", "headline" : "POPIA and Cyber Security: What SMEs Must Do Before and After a Breach", "image" : { "@type" : "ImageObject", "height" : 630, "url" : "https://149448193.fs1.hubspotusercontent-eu1.net/hubfs/149448193/article-4-popia-cyber-security.png", "width" : 1200 }, "mainEntityOfPage" : "https://www.cyber-guard.co.za/cyber-guard-blog/popia-and-cyber-security-what-smes-must-do-before-and-after-a-breach", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "name" : "Cyber Guard Security Guides" } } ```