FlySafair Data Exposure Highlights POPIA Compliance Risks in Technical Oversights Earlier this month, South African airline FlySafair disclosed a data exposure incident during its annual birthday ticket sale, where customer names and email addresses were temporarily made public due to a technical vulnerability in a chat feature integrated into the sales process. The airline described the breach as "limited in nature" and confirmed it had been reported to regulators, as required under South Africa’s Protection of Personal Information Act (POPIA). The incident underscores that POPIA’s reporting obligations apply regardless of whether a breach stems from a cyberattack or a technical error. Under Section 19 of POPIA, organizations must implement "reasonable technical and organizational measures" to prevent unauthorized access to personal data, including safeguards against design flaws, misconfigurations, or human error. The law does not differentiate between malicious breaches and accidental exposures any unauthorized access triggers a reporting requirement, even if no misuse of data occurs. POPIA mandates notification to the Information Regulator and affected individuals when there are reasonable grounds to believe personal data has been accessed by unauthorized parties. In this case, the public display of customer information constituted unauthorized access, as data subjects did not consent to its exposure. The breach serves as a reminder that POPIA compliance extends beyond cybersecurity defenses. Organizations must embed data protection into system design, operational processes, and regular policy reviews to address evolving risks whether from malicious actors or inadvertent technical failures. Failure to do so carries regulatory consequences, regardless of intent.