Personal Data Protection Act, 2022, security and breach notification
Personal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 May 2023.
A breach notification rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Protect personal data with security safeguards reasonable in the circumstances.
- Notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data you process.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data controller must protect personal data with security safeguards reasonable in the circumstances, and must notify the Personal Data Protection Commission without undue delay of any security breach affecting personal data being processed by or on behalf of the controller. The Act sets no fixed notification deadline and imposes no separate statutory duty on the controller to notify the affected data subject directly.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot