Cybersecurity law & regulation in South Africa (2026)

Legal framework

No single comprehensive cybersecurity law. Obligations arise from a patchwork: the Cybercrimes Act 19 of 2020 (offences), POPIA (data-breach/security-compromise notification, overseen by the Information Regulator), the Critical Infrastructure Protection Act 8 of 2019, and the FSCA/Prudential Authority Joint Standard 2 of 2024 for financial institutions, sitting under the policy-level National Cybersecurity Policy Framework (NCPF, 2015).

Key points: cybersecurity in South Africa

1. 01Cybercrimes Act 19 of 2020

   Signed into law 26 May 2021; most operative provisions (offences such as unlawful access, interception and cyber-fraud, plus investigation powers) commenced 1 December 2021 by Proclamation R42 of 2021. Several chapters (e.g. Part VI on certain malicious-communications/structures and capacity provisions) remain not yet in force.

   gov.za gov.za

2. 02POPIA breach notification

   Section 22 of the Protection of Personal Information Act requires responsible parties to notify the Information Regulator and affected data subjects of any 'security compromise' as soon as reasonably possible after discovery; there is no risk threshold, so all compromises must be reported.

   inforegulator.org.za dlapiperdataprotection.com

3. 03Mandatory eServices Portal reporting

   From 1 April 2025 the Information Regulator requires all public and private bodies to submit security-compromise notifications via its online eServices Portal; email submissions are no longer accepted. Non-compliance can attract enforcement, including administrative fines up to R10 million.

   inforegulator.org.za insideprivacy.com

4. 04Financial-sector Joint Standard 2 of 2024

   The FSCA and Prudential Authority published Joint Standard 2 of 2024 on Cybersecurity and Cyber Resilience on 16 May 2024, effective 1 June 2025, setting minimum cybersecurity governance, risk-management, control and resilience requirements for banks, insurers, retirement funds, CIS managers, market infrastructures and certain third-party IT providers.

   resbank.co.za jutacomplinews.co.za

5. 05Critical Infrastructure Protection Act 8 of 2019

   Enacted November 2019 (replacing the National Key Points Act), CIPA covers infrastructure including ICT/'critical information infrastructure', mandates risk assessments, security plans, inspections and a Critical Infrastructure Council; the Cybercrimes Act separately creates aggravated offences (up to 10-20 years' imprisonment) for unlawful interference with critical-infrastructure systems.

   gov.za gov.za

6. 06National Cybersecurity Policy Framework & CSIRT

   The NCPF, adopted by Cabinet in 2012 and gazetted in December 2015, is the overarching coordination policy (led historically by the State Security Agency). South Africa's national CSIRT, the Cybersecurity Hub, was established in October 2015 to coordinate incident response across sectors.

   gov.za gov.za

Timeline of decisions

1. 23 Dec 2024Enforcement · official
   Information Regulator issues second POPIA administrative fine, R5 million against the Department of Basic Education

   The Information Regulator fined the Department of Basic Education R5 million for failing to comply with a November 2024 enforcement notice relating to inadequate data security measures and breach notifications. It is only the second administrative fine ever issued under POPIA, demonstrating escalating enforcement against public-sector bodies.

   Information Regulator of South Africa

2. 1 Dec 2021Law · official
   Cybercrimes Act 19 of 2020: core provisions enter into force (GG 45562)

   Presidential Proclamation No. 42 brought the substantive cybercrime offences (Chapters 1-4), forensic investigation powers (Chapter 7), and jurisdiction/extradition provisions into effect. Section 54, the critical 72-hour mandatory breach-reporting obligation for electronic communications providers and financial institutions, was explicitly excluded pending ministerial regulations, leaving that key obligation still outstanding.

   Department of Justice and Constitutional Development — GG 45562, Proclamation 42

3. 6 Sept 2021Incident
   DoJ&CD ransomware attack encrypts all departmental electronic systems

   A ransomware attack encrypted all DoJ&CD information systems, disrupting court filings, email, bail services, and child-maintenance payments for several weeks; more than 1,200 personal-information files were compromised. The incident triggered POPIA security-breach reporting obligations and directly led to South Africa's first POPIA regulatory fine (2023).

   FinTech Global

4. 22 Jul 2021Incident
   Transnet 'Death Kitty' ransomware attack paralyses South African container ports

   'Death Kitty / Hello Kitty' ransomware crippled state logistics company Transnet, forcing force-majeure declarations across all container terminals including Durban Port, which handles 60% of national container throughput. The attack, one of the most economically disruptive cyber incidents in South African history, galvanised momentum to bring the Cybercrimes Act into force.

   Wikipedia (citing Bloomberg and official Transnet statements)

5. 26 May 2021Law · official
   President Ramaphosa assents to the Cybercrimes Act 19 of 2020

   President Cyril Ramaphosa signed the Cybercrimes Act into law (gazetted GG 44651, 1 June 2021), replacing the limited cybercrime provisions of the 2002 ECT Act. The Act criminalises unlawful access to data and computer systems, ransomware deployment, cyberfraud, malicious communications, and provides for mutual legal assistance in cross-border cybercrime investigations.

   South African Government (gov.za) — GG 44651

6. 1 Aug 2020Incident
   Experian South Africa data breach exposes 24 million individuals' personal information

   A fraudster posing as a legitimate client deceived Experian into releasing bulk personal data on approximately 24 million South Africans and 793,000 businesses; data later appeared on public file-sharing sites despite an Anton Piller court order. The Information Regulator publicly condemned Experian's handling and it remains the largest personal-data exposure ever recorded in South Africa.

   Experian South Africa (official incident statement)

7. 4 Dec 2015Guidance · official
   Revised National Cybersecurity Policy Framework published in Government Gazette No. 39475

   The State Security Agency published the revised NCPF, formalising South Africa's national cybersecurity governance structure: the SSA as national coordinator, a Cybersecurity Hub as the national CSIRT, and mandatory sectoral incident-response teams for critical-information infrastructure. The NCPF remains the primary policy document governing cybersecurity obligations across government and regulated industries.

   South African Government (gov.za) — GG 39475

8. 11 Mar 2012Guidance · official
   Cabinet approves South Africa's inaugural National Cybersecurity Policy Framework

   Cabinet approved the first NCPF, establishing South Africa's initial whole-of-government cybersecurity strategy. It tasked the State Security Agency with coordinating national cyber defence, called for the creation of Computer Security Incident Response Teams, and initiated the legislative review process that ultimately produced the Cybercrimes Act eight years later.

   South African Government (gov.za) — Cabinet media statement

9. 30 Aug 2002Law · official
   Electronic Communications and Transactions Act 25 of 2002: South Africa's first cybercrime statute

   South Africa's foundational e-commerce law created the first statutory cybercrime offences, including unauthorised access to data, interception, system interference, and computer-related fraud and extortion (Chapter XIII). It served as the sole cybercrime legal framework for nearly two decades, though the provision for cyber inspectors under section 82 was never operationalised.

   South African Government (gov.za)

Sources

1. 1.gov.za/documents/acts/cybercrimes-act-19-2020-english-afrikaans-01-jun-2021
2. 2.gov.za/sites/default/files/gcis_document/202106/44651gon324.pdf
3. 3.inforegulator.org.za/2025/08/19/fact-sheet-handling-of-security-compromises/
4. 4.insideprivacy.com/data-security/data-breaches/south-africa-introduces-mandatory-e-porta
5. 5.resbank.co.za/en/home/publications/publication-detail-pages/prudential-authority/pa
6. 6.jutacomplinews.co.za/media/filestore/2024/07/Joint_Standard_2_of_2024__Cybersecurity__Cybe
7. 7.gov.za/documents/acts/critical-infrastructure-protection-act-8-2019-english-
8. 8.gov.za/sites/default/files/gcis_document/201911/4286628-11act8of2019critical
9. 9.gov.za/documents/national-cybersecurity-policy-framework-4-dec-2015-0000
10. 10.gov.za/sites/default/files/gcis_document/201512/39475gon609.pdf
11. 11.dlapiperdataprotection.com/index.html?t=breach-notification&c=ZA