Below are three copy-paste templates, written in plain, defensible language, aligned with POPIA Section 22 and ISO practice.

No fluff. No admissions of fault. No speculation.

📢 POPIA BREACH NOTIFICATION TEMPLATES

TechStackBase

1️⃣ INTERNAL INCIDENT RECORD (MANDATORY)

📁 Store internally
📄 Not sent externally

/docs/incidents/INC-YYYY-MM-DD.md
# Security Incident Record

## Incident ID
INC-2026-01-XX

## Date Discovered
YYYY-MM-DD HH:MM (SAST)

## Incident Type
☐ Unauthorised access  
☐ Data exposure  
☐ Credential compromise  
☐ System misuse  
☐ Other: ___________

## Description
Brief factual description of what was discovered.

## Systems Affected
- Admin UI
- API
- Database (audit_logs / users / companies)

## Personal Information Potentially Affected
- Email addresses
- Names
- User identifiers
- Other: ___________

## Initial Containment Actions
- Account disabled
- Credentials rotated
- Access restricted

## Audit Evidence
- Audit log entries from YYYY-MM-DD to YYYY-MM-DD
- Export hash: SHA-256: ____________________

## Assessment
☐ Confirmed access  
☐ Suspected access  
☐ No evidence of access

## Notification Decision
☐ Notification required  
☐ Notification not required (reason below)

## Reason (if not notifying)
_________________________________________________

## Prepared By
Name / Role

## Approved By
Name / Role


✔ This satisfies POPIA accountability
✔ Auditors will ask for this first

2️⃣ DATA SUBJECT NOTIFICATION (CUSTOMERS / USERS)

📤 Sent to affected individuals
📨 Email / secure message

✉️ TEMPLATE — Data Subject Notification
Subject: Important Security Notice Regarding Your Information

Dear [Name],

We are writing to inform you of a security incident that may have affected some of your personal information.

What happened  
On [date], we identified unauthorised activity within one of our systems. We immediately took steps to contain the incident and prevent further access.

What information may be affected  
The information involved may include:
- [e.g. email address]
- [e.g. user identifier]

At this time, there is no evidence that your information has been misused.

What we have done  
We have:
- Secured the affected systems
- Restricted access where necessary
- Reviewed audit records to assess impact

What you can do  
As a precaution, we recommend:
- Changing your password
- Being alert to suspicious communications

Contact information  
If you have questions, please contact us at:
[security@yourdomain.co.za]

We take the protection of your information seriously and regret any inconvenience this may cause.

Sincerely,  
[Name]  
[Title]  
[Company Name]


🔒 Important wording notes

“may have affected” ✔

“no evidence of misuse” ✔

No admission of negligence ❌

No technical jargon ❌

3️⃣ INFORMATION REGULATOR NOTIFICATION (SOUTH AFRICA)

📤 Mandatory if risk exists
📨 Email / official submission

✉️ TEMPLATE — Information Regulator Notification
Subject: Notification of Security Compromise – POPIA Section 22

To: The Information Regulator of South Africa

In accordance with Section 22 of the Protection of Personal Information Act (POPIA), we hereby notify the Regulator of a security compromise.

Responsible Party  
Company Name: [Your Company Name]  
Registration Number: [If applicable]  
Contact Person: [Name, Role]  
Contact Email: [Email]  
Contact Phone: [Phone]

Date of Discovery  
[YYYY-MM-DD HH:MM SAST]

Description of Incident  
We identified unauthorised access to one of our systems. Upon discovery, immediate steps were taken to contain the incident and assess its scope.

Personal Information Involved  
The personal information potentially affected includes:
- [e.g. email addresses]
- [e.g. user identifiers]

Number of Data Subjects Affected  
[Exact number or estimate]

Containment and Remedial Actions  
- Access restricted
- Credentials rotated
- Audit logs reviewed
- Systems secured

Notification to Data Subjects  
☐ Completed  
☐ In progress  
☐ Not required (reason provided)

Additional Information  
Further details can be provided upon request.

Prepared By  
Name / Role  
Date


✔ Matches POPIA s22 wording
✔ Neutral, factual tone
✔ No speculation

4️⃣ WHEN YOU MUST SEND NOTIFICATIONS (DECISION RULE)

Notify if any of the following are true:

Personal data was accessed

You cannot rule out access

Admin credentials were compromised

Audit logs indicate suspicious access

Do not notify if:

Incident was fully contained

No access to personal data

Evidence confirms no exposure

📌 Always document the decision either way.

5️⃣ HOW THIS CONNECTS TO YOUR SYSTEM

Your TechStackBase stack already provides:

Immutable audit_logs

Signed audit exports

Actor attribution

Time-stamped evidence

➡ These templates reference that evidence without exposing internals.

✅ COMPLIANCE STATUS
Requirement	Covered
POPIA s22	✅
Data subject notice	✅
Regulator notice	✅
Evidence traceability	✅
Legal defensibility	✅