Media, Creators & Digital Communities

Source: Information Regulator South Africa, Annual Report for the year ended 31 March 2025, 2025

Scope: Information Regulator South Africa, Annual Report for 2023/24 Financial Year and Annual Report for the year ended 31 March 2025. The 590, 1,727, and 2,374 values are security compromise notifications received by the Information Regulator for the stated financial years and must not be presented as confirmed compromises, confirmed breaches, successful attacks, unique affected organisations, unique affected data subjects, criminal case counts, or all cyber incidents in South Africa. These metrics are reported under the Information Regulator's POPIA mandate and must not be presented as general cybersecurity incidents, a national cyber incident registry, or a South African CSIRT incident registry. Year-to-year increases in notification volumes may reflect regulatory maturity, awareness growth, portal changes, and changes in notification behaviour — not only changes in underlying attack volume. The 5 enforcement notices value refers to enforcement notices issued in respect of POPIA investigations and assessments in 2024/2025 and must not be presented as five resolved incidents, five confirmed cyberattacks, five certified organisations, or five protected organisations. Do not present any admitted indicator as total South African cybercrime prevalence, total business incident prevalence, hidden incident prevalence, all-sector incident rate, breached-organisation count, resolved incident count, protected-organisation count, compliance achievement, certification, proof of security, or guaranteed protection.

Methodology: Official Information Regulator South Africa annual report statistics published under the Information Regulator's POPIA / personal-information protection mandate. This source covers the 2024/2025 financial year (2,374 notifications and 5 enforcement notices). The 2,374 value is security compromise notifications received by the Information Regulator in the 2024/2025 financial year and must not be presented as confirmed compromises, confirmed breaches, successful attacks, unique affected organisations, unique affected data subjects, or criminal case counts. These metrics are reported under the Information Regulator's POPIA mandate and must not be presented as general cybersecurity incidents or all cyber incidents in South Africa. Year-to-year increases in notification volumes may reflect regulatory maturity, awareness growth, portal changes, and changes in notification behaviour — not only changes in underlying attack volume. Do not present any increase as proof that actual national cyberattack volume increased at the same rate. The 5 enforcement notices metric refers to enforcement notices issued in respect of POPIA investigations and assessments in the 2024/2025 financial year and must not be presented as five resolved incidents, five confirmed cyberattacks, five certified organisations, or five protected organisations. Do not present any admitted indicator as a national cyber incident registry, South African CSIRT incident registry, confirmed cyberattack count, total South African cybercrime prevalence, total business incident prevalence, hidden incident prevalence, all-sector incident rate, breached-organisation count, resolved incident count, protected-organisation count, compliance achievement, certification, proof of security, or guaranteed protection.