Cyber security compliance in South Africa

Which cybersecurity and data protection rules apply in South Africa?

Start with POPIA. The Protection of Personal Information Act applies to every public and private body that processes personal information, and its eight conditions for lawful processing include a duty in section 19 to secure personal information with appropriate technical and organisational measures. Section 22 then requires security compromises to be reported to the Information Regulator and to the people affected.

Financial institutions add the Joint Standards issued by the Financial Sector Conduct Authority and the Prudential Authority: Joint Standard 1 of 2023 on IT governance and risk management, and Joint Standard 2 of 2024 on cybersecurity and cyber resilience. The Cybercrimes Act 19 of 2020 sets the criminal offences, and listed companies apply the King Code, now King V, to their governance of data, information and technology. No general statute imposes security controls on other private organisations, so outside finance the programme is often built on an international standard such as ISO/IEC 27001, frequently because a customer or a parent company asks for it.

How does the Information Regulator enforce POPIA?

The Act's grace period ended on 30 June 2021. Since then the Regulator has issued enforcement notices and can impose administrative fines of up to R10 million, and failing to comply with an enforcement notice is a criminal offence. Its first fine, R5 million against the Department of Justice and Constitutional Development in July 2023, followed a 2021 ransomware attack and findings that the department's security software licences had lapsed. A second R5 million fine, against the Department of Basic Education in December 2024, was set aside by the High Court in December 2025, and the Regulator is pursuing an appeal.

Security compromise notifications have had to go through the Regulator's eServices portal since 1 April 2025, and the Regulations were amended on 17 April 2025 to require Information Officers to monitor and continually improve their compliance frameworks. The Regulator was reported in September 2026 to have received more than 8,000 security compromise notifications since July 2021.

What do the Joint Standards require of financial institutions?

Joint Standard 1 of 2023 has applied since 15 November 2024 and sets IT governance and risk management requirements. Joint Standard 2 of 2024 took effect on 1 June 2025 and requires a cybersecurity strategy and framework, an inventory of information assets, identity and access management, detection, incident response and recovery, threat intelligence, a testing programme and minimum hygiene practices, including multi-factor authentication for critical system functions and for internet access to applications holding sensitive information. Internet-facing systems must be penetration tested at least annually, and the framework reviewed independently every year.

Joint Notice 2 of 2026, in force since 1 September 2026, sets how material IT and cyber incidents are reported under both Standards: an initial notice within 24 ordinary hours of classifying the incident as material, the impact section within 14 calendar days and a final report within a period agreed with the authority. Banks and insurers report through the Prudential Authority's Umoja Portal; other institutions through the FSCA's Joint Standards Submission Portal. The banking industry's own figures show the pressure behind the rules: SABRIC reported digital banking crime losses of R2.4 billion in 2025, up from about R1.9 billion in 2024, with banking app crime accounting for more than 70% of those losses, and card fraud losses up 18% to R1.7 billion.

What does the Cybercrimes Act require of organisations?

The Cybercrimes Act 19 of 2020 created offences including unlawful access to and interception of data, interference with data and computer systems, and cyber fraud, forgery and extortion, most of them in force since 1 December 2021. Section 54, which would require electronic communications service providers and financial institutions to report certain cyber offences to the South African Police Service within 72 hours and to preserve evidence, has not yet been brought into force. Organisations in those sectors should still have the reporting route ready, because POPIA and the Joint Standards already require incidents to be recorded and reported.

What do King IV and King V expect of the board?

King IV's Principle 12 made the governing body responsible for governing technology and information in a way that supports the organisation in setting and achieving its strategic objectives, and the JSE Listings Requirements required listed companies to apply the Code. King V, published on 31 October 2025, replaces King IV for financial years beginning on or after 1 January 2026.

King V's Principle 10 says the governing body governs data, information and technology so that the organisation can sustain and optimise its strategy and objectives. Its recommended practices ask the board to oversee cyber security strategies, resilience and disaster recovery testing, data protection and privacy, assurance from outsourced technology providers, and accountability and human oversight for artificial intelligence. Those are assurance questions, and the Assurance domains in the GRCLens POPIA and Joint Standard 2 catalogues are built to answer them with evidence rather than statements.

Why mining and operational technology need attention

South African mining law, through the Mine Health and Safety Act 1996, deals with health and safety rather than cybersecurity, so operators look to international standards for their control systems. Attacks reach the sector: in July 2024 Sibanye-Stillwater reported a cyberattack that affected its IT systems globally. For control systems at mines, smelters, utilities and plants, IEC 62443 sets the security requirements, and ISO 45001, adopted locally as SANS/ISO 45001, is the safety management system that a cyber incident in operations ultimately threatens.

How GRCLens runs South African frameworks together

POPIA and Joint Standard 2 share one control model in GRCLens with ISO/IEC 27001, PCI DSS, ISO/IEC 42001 and IEC 62443, so a bank, insurer or mining group evidences a control such as access management or incident response once for every framework that asks for it. The section 22 notice, the 24-hour Joint Standard clock and the annual independent review are tracked as their own items. GRCLens can run in your own private cloud or fully on-premises in South Africa, with its AI assistant on a model hosted inside your own infrastructure.

Official portals and publications

• Information Regulator eServices portal, security compromise reporting
• Information Regulator, enforcement notices
• Prudential Authority, Joint Notice 2 of 2026 (material incident template)