Cybersecurity Law

Cybersecurity or information security is a crucial part of information management. We are experts on the legal aspects regards the security of information (infosec). You can read our advice, or about the products or services we offer related to this focus area below:

Your cloud logs are evidence. Will they still exist when legal needs them?

Businesses have moved many of the systems they once ran on their own hardware into the cloud. They use services such as AWS, Microsoft Azure and Google Cloud to host applications, manage accounts and store information. Cloud evidence preservation has [...]

CRA vulnerability reporting: when does the clock start?

Cyber Resilience Act (CRA) vulnerability reporting can turn on a few hours' notice. Monday morning, 8 am. A security researcher emails your vulnerability reporting address. They have found a remote-code-execution vulnerability in one of your products. They attach working proof-of-concept [...]

No cookies? ePrivacy may still apply

Your company is building a mobile app. Developers add a third-party software development kit (SDK), such as an analytics or attribution tool. That is where ePrivacy device access can become relevant. The privacy review starts with the usual GDPR questions. [...]

Information Security Team: Your task force for securing information and responding to incidents

A group can achieve a goal faster and more effectively than one person working alone. Information security law compliance is difficult and requires an information security team of people to do it properly. Your team should include people from [...]

EU Data Act switching: cloud exits

A company group with a subsidiary in the EU decides that the cloud SaaS platform it has used for years is no longer the right fit. EU Data Act switching rules now shape what happens next. Legal counsel is asked [...]

Cybersecurity flow-down clauses – Whose compliance obligations?

A security addendum arrives from a customer. They want incident notification within 24 hours, the right to audit you on site, approval before you change a subcontractor, and cooperation with their penetration testing. These are cybersecurity flow-down clauses: contractual terms [...]

By |2026-08-12T13:35:29+02:00August 12th, 2026|Categories: Cybersecurity Law, POPI and Data Protection|Tags: , , , , |

Gated Access Code of Conduct under POPIA

On 30 April 2026, the Information Regulator published the draft Gated Access Code of Conduct under POPIA. It applies to owners, managers, and their security and technology service providers at any gated premises, including residential estates and office parks. The [...]

By |2026-06-23T15:42:55+02:00May 5th, 2026|Categories: Cybersecurity Law, POPI and Data Protection|Tags: , , |

Standard Bank | Data breach

Standard Bank, Africa’s largest bank, has disclosed a data breach affecting a number of its clients. This raises concerns about rising cybersecurity risks across South Africa’s financial sector. Standard Bank directly communicated with their clients and confirmed that someone had […]

Regulation of Cybersecurity Services in South Africa by PSiRA

PSiRA may expand its regulation of cybersecurity services in South Africa. What would this mean for cybersecurity service providers? How do you, as a cybersecurity service provider, feel about being regulated by the Private Security Industry Regulatory Authority (PSiRA)? PSiRA, [...]

By |2026-03-23T14:09:45+02:00March 17th, 2026|Categories: Cybercrime, Cybersecurity Law|Tags: , , , |

POPIA’s security requirement – A cybersecurity primer for IOs

Think of security compliance the way you think of a vehicle’s roadworthiness test. The certificate matters, but you only stay safe if the brakes still work today. POPIA's security requirement is not a maintenance checklist or a once-off project. POPIA […]

By |2026-03-04T09:56:05+02:00March 3rd, 2026|Categories: Cybersecurity Law|Tags: |

Intengo Imoto v Zoutpansberg Motor Wholesalers | EFT fraud and BECs

In Intengo Imoto v Zoutpansberg Motor Wholesalers, the Supreme Court of Appeal held that a purchaser (debtor) who falls victim to EFT fraud through email interception, paying into a fraudulent bank account, has not discharged its payment obligation to the […]

The law in 2026 – our predictions

Welcome to the law in 2026! At the beginning of each year, we look ahead to help you prioritise your next steps. This is the law regarding digital, data and tech in 2026. We try to predict what will happen [...]