Data Breach Response Plan: [Organisation name]
Effective from [Plan effective date]. Owner: [Information Officer], Information Officer. This plan is reviewed at least once a year.
1. Purpose
This plan sets out how [Organisation name] responds when personal information may have been accessed, lost, destroyed or disclosed without authority (a "security compromise"), so that we limit harm and meet our duties under the Protection of Personal Information Act 4 of 2013 ("POPIA").
2. Response team
- Information Officer: [Information Officer], [Information Officer phone], [Information Officer email]. Leads the response and decides what is notified.
- IT or security lead: [IT or security lead], [IT or security lead phone]. Contains the incident and preserves evidence.
- Executive decision maker: [Executive decision maker], [Executive phone]. Approves communication and spending.
- Legal adviser: [Attorney or legal adviser (optional)]
- Cyber insurer: [Cyber insurer contact (optional)]
3. Anyone who suspects a breach must
- tell the Information Officer immediately, by phone if possible, and do not wait to be sure;
- write down what they saw, when and how they found out;
- not delete anything, not confront anyone and not discuss it outside the response team.
4. Step 1: Contain (first hours)
- Stop the leak: disable affected accounts, change passwords and keys, remove access, isolate affected devices or systems.
- Preserve evidence: keep logs, emails and affected devices. Do not wipe or rebuild until the IT lead confirms evidence is saved.
- Recover what can be recovered, for example by asking a wrong recipient to delete an email and confirm in writing.
- Open an incident record with the date and time discovered, who reported it and what is known.
5. Step 2: Assess
The Information Officer works with the IT lead to answer:
- What information was involved, and whose (customers, staff, suppliers, children)?
- How many people are affected?
- Was the information encrypted or otherwise unreadable?
- Was it accessed or acquired by an unauthorised person, or only exposed?
- What harm could result, for example fraud, identity theft, financial loss, distress or reputational damage?
- Does it include special personal information, such as health, biometric or financial data?
Record the assessment and the reasons for the decision to notify or not.
6. Step 3: Notify
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, notify, as soon as reasonably possible after discovery:
- the Information Regulator, using its prescribed notification form and process; and
- each affected person, unless their identity cannot be established, in a way that reaches them (for example by email or post), written so that they can take protective steps.
A notice to affected people should say what happened, what information was involved, what we have done, what they can do to protect themselves, and who to contact. Where a public body or the Regulator directs it, delay notification only if it would impede a criminal investigation. Also consider: reporting to the South African Police Service, informing the cyber insurer (check policy notice periods), and informing affected clients under contract.
7. Step 4: Learn
- Within 30 days, hold a review: what happened, what worked, what did not.
- Fix the root cause and record the actions, owners and dates.
- Update this plan, training and supplier agreements as needed.
- File the incident record, assessment, notifications and fixes as POPIA evidence.
8. Records
The Information Officer keeps a register of every security compromise and near miss, whether or not it was notified, with the decision and reasons. Keep it for as long as our retention schedule says.
9. Testing
We run a short tabletop exercise at least once a year and record the date, attendees and improvements.