Authored By: Sinethemba Lwazi Nothando Mkhize
University of South Africa
Introduction
The way we live and work is being drastically altered by the digital economy. There will be substantial legal and policy obstacles. The divergence and fragmentation of this field of law, which will be crucial in and across the digital economy, will be examined and highlighted in this study. Because of the Internet’s and the cyber domain’s overall dynamic and unpredictable nature, cyber security research in South Africa is crucial. The cyber realm cannot really be seen in isolation or on a strictly basis because it is intrinsically globalised.[1]
Cyber attacks have significantly increased in South Africa recently, impacting people’s businesses, and vital infrastructure. South Africa’s inhabitants’ privacy, economic stability, and national security are increasingly at risk due to the surge in cyber-attacks. The decadal plan’s STI priorities, ICTs and smart systems, as well as high-tech industrialization are being jeopardised by the proliferation of cyber-attacks.[2]
Understanding Cyber Security
Users, network infrastructure, hardware, software, procedures, and data on system storage media that can be linked to the internet network are all covered by cybersecurity standards. Cybersecurity standards encompass a wide range of topics, namely security controls, processes, procedures, recommendations, and baselines, as well as security aspects in cryptographic methods and applications.[3]
Preventing or mitigating cyberattacks and lowering the risk of cyberthreats are the primary goals of cyber security guidelines. Saving time, cutting expenses, boosting revenues, raising user awareness, lowering risks, and providing company continuity are all advantages of standardization. Using standards also makes it easier for a business to comply with industry best practices and procedures and offers the chance to compare security systems internationally. In order to safeguard assets from cyber threats, some organizations or enterprises have adopted cyber security standards.[4]
Information security standards and information security governance standards are the two primary categories into which cybersecurity standards are typically divided. Information security frameworks and standards, like the ISP 27000 series, ISF SOGP, NIST 800 series, SOX, and Risk IT, are primarily focused on security issues.[5] Cybersecurity frameworks are adaptable and can give customers the ability to select specific components or the entire model, techniques, or technical practices. They also offer broad, implementable rules and recommendations that can be implemented within the company.[6]
Types of Cyber Attacks in South Africa
Cyber attacks have steadily increased in recent years, and South Africa is not exempt. South Africa saw a cross-industry surge in cyber incidents in 2019, which proved crucial. This trend persisted in 2020 and was further fuelled by the COVID-19 pandemic. Two significant cyber incidents occurred in 2019 at the City of Johannesburg, a metropolitan municipality in charge of local administration. First the City of Johannesburg electrical utility, City Power, was hit by a ransomware attack in July. Second, a ransom notes from a group known as the Shadow Kill hackers led to the discovery of a network compromise in October. Numerous customer-facing systems experienced outages as a result of both cyber intrusions. The South African Bank Risk Information centre revealed that a wave of distribution denial of service attacks had attacked the banking industry following the City of Johannesburg hack.[7]
The COVID-19 pandemic in 2020 led to an increase in cyber events since it gave hackers additional avenues for attack. Employers’ private information was unintentionally exposed in May due to modifications made to the Unemployment Insurance fund website to accommodate the temporary employee/employer relief scheme. Other kinds of cyberattacks that occur include, hacking, theft of identity, malware, data breaches and online fraud, and cyberterrorism.[8]
However, even though there has been a consistent rise in cyber events in South Africa, formal reporting of these instances in uncommon. Neither the South African Police nor the National Prosecuting Authority supplies information or statistics relevant directly to local cyber occurrences. The national computer security incident response team of South Africa, known as the Cybersecurity Hub, offers a facility for stakeholders to report cyber problems, however it does not notify the general public of such incidents. Additionally, there are not many peer reviewed publications that asses cyber occurrences in South Africa.[9]
The Significance of Cyber Security
These days, organizations, governments, educational institutions, businesses, families, and individuals all view cybersecurity as crucial. Protecting children and family members from online fraud is crucial for families and parents. Securing our financial information is essential for financial security since it may have an impact on our own financial situation. Faculty, students, staff, and educational institutions all benefit greatly from the internet, which offers numerous learning opportunities along with a number of online risks.[10]
Internet users must learn how to safeguard themselves against identity theft and online fraud. Reduced vulnerabilities and a safer online environment are the outcomes of appropriate learning about online conduct and system protection.[11] Due to a lack of finances and suitable cyber security expertise, small and medium sized businesses also face a variety of security related difficulties. The quick development of technology is also making cyber security more difficult because there are no long-term fixes for the issues at hand. Even though we are actively working to safeguard out network and data with a variety of frameworks and technologies, these solutions only offer temporary protection.[12]
Nonetheless, we may lessen financial and reputational harm and safeguard trade secrets and intellectual property with improved security knowledge and suitable tactics, large volumes of data and private documents are stored online by federal, state, and local governments, making them the main target of cyberattacks. Most of the time, little financing, poor infrastructure, and lack of knowledge cause problems for governments. It is crucial that government agencies preserve private information, maintain good citizen government relations, and offer dependable services to the public.[13]
Cybercrimes and South African Legislation
The Cybercrimes Act was passed into law by the President of the Republic of South Africa on June 1st, 2021. This is the law that makes illegal activity on the internet illegal. The president issued a presidential minute stating that, with the exception of a few clauses, the entire Cybercrimes Act went into effect on December 1st, 2021.[14]
Common law concepts used to be applied as broadly as feasible to enable the arrest and successful prosecution of online offenders prior to the enactment of legislation that criminalized specific unlawful cyber behaviour. S v Howard was one of the well-known decisions that used common law principles to a cybercrime offense.[15][16] When the accused installed harmful code onto a computer network system owned by his employer, Edgars Consolidated Stores, causing intangible data to be erased, the court had to determine whether the accused had committed the common law offense of malicious damage to property.[17][18]
It was evident that a statutory tool was required to control illegal activity in cyberspace, even though common law could handle some of these crimes. As a result, a new law on cybercrimes was passed by the legislature. The Electronic Communications and Transactions Act came into effect in 2002.[19] It should be mentioned that various law instruments that addressed certain areas of cybercrime existed in addition to the ECT Act, for example, the Films and Publications Act 65 of 1996 criminalized child pornography, while the Financial Intelligence Centre Act 38 of 2001 or the Prevention of Organized Crimes Act 121 of 1998 pursued organized crime.[20]
Section 85 to 90 of Chapter 13 of the ECT Act addressed cybercrime. The ECT’s section 85 made it possible to regulate unlawful access to data without purposefully acquiring access to it. Unauthorized access, data interception, interference, and denial of service attacks are further regulated by section 86 of the ECT Act.[21] Since the ECT Act went into effect, the accused in several Regional Court cases have been successfully prosecuted for unlawful data access under section 86(1) of the ECT Act.[22]
The ECT Act;s section 87 also addresses extortion, fraud, and forgeries involving computers. Section 88 of the ECT Act also included attempts, assisting and abetting cybercrimes. Penalties for those founf guilty of violating the ECT Act’s restrictions are outlined in section 89. The ECT Acts’s section 89 has come under fire for not being strict enough to discourage hackers, for instance, the maximum sentence for section 86 offenses was 12 months, whereas the maximum sentence for section 86 offenses was 12 months, whereas the maximum penalty for offenses like fraud, extortion, and forgery was a fine and up to five years in prison.[23]
The Cybercrimes Act makes new acts related to the illegal used of computer systems illegal and increases the number of offenses covered by the ECT Act.[24][25] There are nine chapters in all. Definitions and interpretation are covered in chapter 1. The many types of cybercrimes, malicious communications, penalties, and oders to shield complaints from the negative effects of malicious communications are all covered in chapter 2. Chapter 3 deals with jurisdictional matters. Law enforcements investigative, search, access and seizure powers are outlined in chapter 4. Provisions for mutual aid between South Africa and other nations are found in Chapter 5. The creation and duties of a designated point of contract are covered in chapter 6.[26]
The adduction of evidence through sworn statements is covered in chapter 7. The requirements of financial institutions and electronic communications service providers to report cybercrime offenses and to preserve any information that could be useful for an investigation are outlined in chapter 8.[27] General provisions found in chapter 9 include that executive office’s power to make agreements, the insertion of rules, the repeal and revision of specific laws, and the Acts beginning.[28][29]
Conclusion
Cybersecurity is now a crucial legal and national security problem rather than just a technological one. The legal framework in South Africa, especially the Cybercrimes Act and POPIA, provide a crucial basis for preventing cybercrime and safeguarding private data. To handle the changing nature of cyber dangers, however, ongoing legal development, efficient enforcement, public awareness, and international cooperation are still crucial.
However, laws by themselves are unable to eradicate cyberthreats. Collaboration between the government, law enforcement, private organizations, educational institutions, and individual internet users is necessary for effective cybersecurity. Strengthening South Africa’s cyber resilience requires increased public awareness, investments in cybersecurity infrastructure, frequent reporting of cyber incidents, and ongoing training of cybersecurity professionals.
In order to protect personal data, maintain national security, and foster trust in the nation’s expanding digital economy, South Africa must constantly assess and improve its laws, regulations, and cybersecurity tactics as cyber threats continue to change.
Reference(S):
Cases
S v Howard. (Unreported case no. 41/258/02, Johannesburg regional magistrate court
Legislation
Electronic Communications and Transactions Act 25 of 2002
Cybercrimes Act 19 of 2020
Bibliography
M Grobler, J Vuuren, L Leenen. 2012. Implementation of a Cyber Security Policy in South Africa: Reflection on Progress and the way forward. Council for Scientific and Industrial Research Pretoria, South Africa.
F Tinonetsana. 2025 Addressing the rise of cyber attacks in South Africa. Human Science Research Council. June. https://hsrc.ac.za/wp-content/uploads/2025/06/Faith-Tinonetsane-PB.pdf. Accessed 19 July 2026
H Taherdoost. 2022.Understanding Cybersecurity Frameworks and Information Security Standards. University Canada West. https://www.mdpi.com/2079-9292/11/14/2181 Accessed 19 July 2026
H Pieterse, 2021. The Cyber Threat Landscape in South Afric: A 10 year Review. Johannesburg Scielo. https://www.scielo.org.za/scielo.php?pid=S207772132021000200003&script=sci_arttext Accessed 19 July 2026
R Kumar Goutam. 2015. Importance of Cyber Security. University of Lucknow, Lucknow. Vol 111 No. 7. February
S Mtuze and M Musoni. 2023. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8 Accessed 19 July 2026
[1] M Grobler et al. 2012. Implementation of a Cyber Security Policy in South Africa: Reflection on Progress and The way forward. Council for Scientific and Industrial Research Pretoria, South Africa.
[2] F Tinonetsana. Addressing the rise of cyber attacks in South Africa. Human Science Research Council. June, 2025. https://hsrc.ac.za/wp-content/uploads/2025/06/Faith-Tinonetsane-PB.pdf.
[3] H Taherdoost. Understanding Cybersecurity Frameworks and Information Security Standards. University Canada West, 2022. https://www.mdpi.com/2079-9292/11/14/2181
[4] H Taherdoost. Understanding Cybersecurity Frameworks and Information Security Standards. University Canada West, 2022. https://www.mdpi.com/2079-9292/11/14/2181
[5] H Taherdoost. Understanding Cybersecurity Frameworks and Information Security Standards. University Canada West, 2022. https://www.mdpi.com/2079-9292/11/14/2181
[6] H Taherdoost. Understanding Cybersecurity Frameworks and Information Security Standards. University Canada West, 2022. https://www.mdpi.com/2079-9292/11/14/2181
[7] H Pieterse, The Cyber Threat Landscape in South Afric: A 10 year Review. 2021, Johannesburg Scielo. https://www.scielo.org.za/scielo.php?pid=S2077-72132021000200003&script=sci_arttext
[8] H Pieterse, The Cyber Threat Landscape in South Afric: A 10 year Review. 2021, Johannesburg Scielo. https://www.scielo.org.za/scielo.php?pid=S2077-72132021000200003&script=sci_arttext
[9] H Pieterse, The Cyber Threat Landscape in South Afric: A 10 year Review. 2021, Johannesburg Scielo. https://www.scielo.org.za/scielo.php?pid=S2077-72132021000200003&script=sci_arttext
[10] R Kumar Goutam. Importance of Cyber Security. University of Lucknow, Lucknow. Vol 111 No. 7. February 2015.
[11] R Kumar Goutam. Importance of Cyber Security. University of Lucknow, Lucknow. Vol 111 No. 7. February
[12] R Kumar Goutam. Importance of Cyber Security. University of Lucknow, Lucknow. Vol 111 No. 7 February 2015.
[13] R Kumar Goutam. Importance of Cyber Security. University of Lucknow, Lucknow. Vol 111 No. 7 February 2015.
[14] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[15] S v Howard. (Unreported case no. 41/258/02, Johannesburg regional magistrate court
[16] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[17] S v Howard. (Unreported case no. 41/258/02, Johannesburg regional magistrate court
[18] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[19] Electronic Communications and Transactions Act 25 of 2002
[20] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[21] Electronic Communications and Transactions Act 25 of 2002
[22] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[23] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[24] Cybercrimes Act 19 of 2020
[25] Electronic Communications and Transactions Act 25 of 2002
[26] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
[27] Electronic Communications and Transactions Act 25 of 2002
[28] Cybercrimes Act 19 of 2020
[29] S Mtuze and M Musoni. An overview of cybercime law in South Africa. International cybersecurity law Review vol4. June 2023. https://link.springer.com/article/10.1365/s43439-023-00089-8
