South Africa
Cybercrimes Act compliance, made simple
11 yes/no questions on how the Cybercrimes Act touches your business: not committing cyber offences, protecting systems, preserving evidence, reporting, and the extra duties of electronic communications service providers and financial institutions. You get a score for each area and a list of gaps with what to do about each one.
ComplianceDesk gives you 6 pre-built Cybercrimes Act controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving Cybercrimes Act compliance stops being a spreadsheet exercise.
Take the free self-assessment: a score for each area and a list of gaps to close.
What is Cybercrimes Act?
11 yes/no questions on how the Cybercrimes Act touches your business: not committing cyber offences, protecting systems, preserving evidence, reporting, and the extra duties of electronic communications service providers and financial institutions. You get a score for each area and a list of gaps with what to do about each one.
- Official name
- Cybercrimes Act
- Status
- In force. Shown as in force as we understand it. Check the current text with the regulator or an attorney, since provisions can be amended or commence at different times.
Who it applies to
- Whether it applies to you depends on your size, activities and licences. Use the free "Which laws apply to me?" checker, or read the first section of the self-assessment.
- The Cybercrimes Act puts a reporting duty (section 54) on electronic communications service providers and financial institutions that become aware their systems are involved in certain offences. Sources disagree on whether section 54 is yet in force, and one reported a 72-hour reporting window that I could not confirm. Check the current position. Answer Not applicable if you are neither.
What you have to do
Staying on the right side of the offences
A business should be able to show that it can answer yes to these: Do your staff know that unlawful access to a computer system or data, interception of data, and interfering with data or systems are criminal offences? Do your staff know they must not use or share passwords, access codes or software designed to break into systems, or use others' credentials without permission? Do your staff know that sending messages that incite violence or damage to property, or threaten people, or share intimate images without consent, can be a crime? Do you avoid cyber fraud, forgery and extortion in your own dealings, including fake invoices and misleading online messages?
Protecting systems and keeping evidence
A business should be able to show that it can answer yes to these: Do you protect your systems with sensible security measures, such as access control, updates, backups and monitoring, so that you are not easily used to commit a crime? If you suffer a cyber attack, do you know to keep logs and other evidence, and not to wipe or alter affected systems before the evidence is secured? Do you know that a court or the police can order you to preserve, disclose or hand over data in a cybercrime investigation, and who deals with such an order? Do you keep a contact list for reporting incidents to the South African Police Service, the Information Regulator and your insurer?
Reporting duties
A business should be able to show that it can answer yes to these: If you are an electronic communications service provider or a financial institution, do you know the reporting duty and the offences it covers? If you are covered, can you report to the South African Police Service within the time allowed and preserve information that may help them? Even if you are not covered by section 54, do you report personal data breaches to the Information Regulator and the people affected, as POPIA requires?
How to comply, step by step
- Staying on the right side of the offences. Include a short statement of these offences in your acceptable use policy and induction. Put the rule in your policy and discipline breaches under your disciplinary code. Cover malicious communications in your acceptable use and harassment policies. Put invoice approval and supplier bank change checks in your finance procedures.
- Protecting systems and keeping evidence. Write your security rules in one place. Add evidence preservation to your incident response steps. Name the person who receives such requests. Take legal advice before responding. Keep the contact list with your incident response plan, and test it.
- Reporting duties. Read the current section 54 and regulations, and write a reporting procedure. Set a clear internal route and time limit for reporting, and note that failure to comply is an offence with a fine. See the POPIA assessment, and adopt a breach response plan.
Sources and review status
Compiled from the public sources below. It is not legal advice and has not been reviewed by a lawyer. Last researched 2026-11-01. This is general information, not legal advice. Laws change, so check the current text and the regulator's notices before relying on it.
- Cybercrimes Act 19 of 2020 (gov.za)
- Cybercrimes Act section 54: obligations of electronic communications service providers (Acts Online)
- The Cybercrimes Act: cyber fraud and private sector reporting obligations (Cliffe Dekker Hofmeyr)
- Unpacking the Cybercrimes Act (Mondaq)
- Entities will be required to report cybercrime within 72 hours (Engineering News)
Every Cybercrimes Act control, organised for you
The real control library ComplianceDesk seeds the moment you activate Cybercrimes Act — 6 controls across 4 categories.
Unauthorised Access Prevention
- CYBER-1.1 Access controls prevent unauthorised data access
- CYBER-1.2 Interception/monitoring controls comply with lawful authority
Data & System Integrity Controls
- CYBER-2.1 Malware and data interference protections deployed
- CYBER-2.2 Policy addressing malicious electronic communications
Incident Reporting Obligations
- CYBER-3.1 Cybercrime incident reporting process to authorities
Evidence Preservation
- CYBER-4.1 Evidence preservation procedure for cyber incidents
Frequently asked questions
How can I check where my business stands on Cybercrimes Act?
Take the free self-assessment. It scores each area, lists your gaps with what to do about each one, and does not say you are compliant. You can save the result to ComplianceDesk to turn each gap into a task with an owner and a due date.
Is this guide written by a lawyer?
No. It was assembled from the public sources listed below and has not been reviewed by a lawyer. Treat it as a starting point and check the current law before relying on it.
How many controls does ComplianceDesk track for Cybercrimes Act?
6, organised into 4 categories, ready to assign to an owner as soon as you activate the framework.
Can I track Cybercrimes Act alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up Cybercrimes Act in ComplianceDesk?
Activating Cybercrimes Act instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Other South Africa frameworks
See your full compliance picture
193 frameworks, one system of record.