InfoReg concerned by ‘alarming’ rate of data breaches

The Information Regulator (InfoReg) in South Africa has received over 8,000 reports of data breaches so far in the 2026/2027 financial year, with 1,220 incidents reported in April alone. InfoReg chairperson Advocate Pansy Tlakula highlighted the severity of the situation, stating that the trend could lead to more than 3,000 incidents by the end of the year.

Data breaches and cyber attacks have exposed personal information of millions of citizens, causing potential disruptions to essential services, damaging institutional credibility, undermining public confidence, and having significant economic consequences. While South Africa ranks among the highest globally in terms of cyber security, it is unclear if public and private bodies share the same level of alarm.

Many organizations do not report security compromises due to inadequate security controls, such as weak passwords, malware, ransomware, and phishing attacks. The regulator emphasizes the importance of reporting security compromises as soon as they are identified, regardless of confirmation. The Protection of Personal Information Act (POPIA) mandates organizations to safeguard the data privacy of South Africans, with consequences including fines, criminal persecution, and reputational loss.

Direct marketing through unsolicited electronic communications is a significant concern, with the regulator receiving over 3,800 complaints last year, mostly related to direct marketing. Two direct marketing cases involving OUTsurance and MTN have been referred to the InfoReg's enforcement committee for further investigation. The regulator welcomes recent amendments to the Consumer Protection Act, including the pre-emptive block register, aimed at addressing the issue of unwanted direct marketing.