The first legal moves after a cyber incident

A cyber incident can trigger overlapping operational, privacy, criminal, contractual and insurance issues. Early coordination matters because rushed communications or lost evidence can worsen exposure.

Contain without destroying evidence

Technical teams should isolate affected systems where appropriate while preserving logs, messages, timestamps and device information. Record who made material decisions and why.

Establish the facts

Identify affected systems and data, the likely period of compromise, whether personal information was accessed or acquired, and which suppliers or customers may be involved.

Activate legal and contractual reporting routes

POPIA section 22 addresses notification of security compromises. The Cybercrimes Act creates cybercrime offences and includes reporting obligations for specified electronic communications service providers and financial institutions. Contracts and insurance policies may impose additional deadlines.

Control communications

Use one verified factual record. Communications should avoid speculation, preserve legal privilege where applicable and provide clear actions to affected parties when notification is required.

Remediate and learn

After immediate containment, update safeguards, supplier controls, response playbooks and staff training. Document how the business assessed risks and the measures selected.