Incident Response Under POPIA: What "Reasonable Time" Really Means

POPIA requires that data breaches be reported to the Information Regulator and affect individuals "as soon as reasonably possible" after the responsible party becomes aware of the compromise. Unlike some international laws that specify a strict 72-hour window, POPIA's language is deliberately open — but that doesn't mean businesses have unlimited time to figure things out.

Why Ambiguity Isn't a Loophole

"Reasonable" is judged against what a prudent organization, in a similar position, with similar resources, would have done. If it takes you three weeks to even detect that a breach occurred, that delay itself may be scrutinized — not just the time between detection and notification. Poor logging, no monitoring, and no designated incident response owner all extend your effective response time, and all count against you.

The Anatomy of a Compliant Response

A defensible incident response process typically includes:

1. Detection — monitoring systems and alerts that flag anomalies quickly, rather than relying on customers or third parties to notice first.
2. Containment — isolating affected systems to prevent further data loss while preserving evidence.
3. Assessment — determining what data was affected, how many data subjects are impacted, and the likely harm.
4. Notification — informing the Information Regulator and affected individuals, including the nature of the breach and recommended protective measures.
5. Remediation — closing the vulnerability and documenting lessons learned.

The Cost of Winging It

Organizations without a documented, tested response plan tend to make two costly mistakes: they delay notification while internally debating "how bad is this really," and they under-communicate to affected individuals out of fear of reputational damage. Both compound legal risks rather than reducing it.

Practice Makes Compliant

A response plan sitting in a folder is not the same as a response plan that works under pressure. Tabletop exercises — simulated breach scenarios run with your actual team — expose gaps in roles, communication, and technical readiness long before a real incident does.

The Takeaway

"Reasonable time" is not a fixed number, but it is measurable against your preparedness. The businesses that fare best under POPIA scrutiny are the ones that can show a clear, fast, and well-documented chain of events from detection to disclosure — not the ones who simply hope a breach never happens.