A payroll file goes to the wrong address. What POPIA requires next, and why preparation matters.
It is 07:58 on a Monday. A payroll file with 214 employees' ID numbers, salaries and bank details has just been emailed to the wrong address. What now?
Notify: section 22 of POPIA requires you to notify the Information Regulator and the affected employees as soon as reasonably possible after discovering the compromise. The notice must give enough information for people to protect themselves.
Who responds? Your Information Officer is responsible. If one has not been registered with the Information Regulator, that is a second problem on top of the first.
The risk: administrative fines of up to R10 million, enforcement notices, and civil claims from affected people.
Be ready before it happens: register your Information Officer; write a breach response procedure that names who does what; keep a register of incidents; train staff who handle personal information, especially payroll and HR; and limit who can send personal information outside the organisation.
Breaches happen to well-run organisations too. What separates a manageable incident from a crisis is a response that is already planned.
This article is general information, not legal advice for your specific situation. Speak to a MetaCo consultant about your organisation.