African Executives Confident in Data Recovery, Despite Lack of Testing

A recent ITWeb and Veeam survey conducted earlier this year across 14 African countries, with a significant South African representation, revealed a critical "confidence gap" among senior executives regarding data recovery post-ransomware attacks.

The survey, which gathered insights from 140 senior IT, data, and cybersecurity leaders, found that while 52% of executives expressed high confidence in their ability to recover clean, usable data after a ransomware attack, a concerning 32% admitted to never having performed a full technical recovery test, not having tested in over a year, or being unaware of their last test date. Even among organisations that did conduct end-to-end recovery tests, 45% reported only partial success, significant gaps, or outright failure. Beyond ransomware, the survey also assessed organisational preparedness for adopting, governing, and scaling enterprise-wide AI initiatives, alongside current and planned investments in data protection, cyber resilience, and AI governance technologies.

This disparity between perceived confidence and actual preparedness carries substantial legal and financial risks for organisations operating in South Africa and across the continent. Non-compliance with stringent data protection legislation, such as the Protection of Personal Information Act (POPIA) in South Africa, which mandates adequate security safeguards and data integrity, could lead to severe administrative penalties, reputational damage, and potential civil liability. The inability to effectively recover data directly impacts an organisation's capacity to meet its legal obligations concerning data availability, confidentiality, and integrity, particularly in the wake of a cyber incident.

In South Africa, the legal context is primarily shaped by POPIA, specifically Section 19, which obliges responsible parties to implement appropriate technical and organisational measures to prevent loss, damage, unauthorised destruction, or unlawful access to personal information. The Cybercrimes Act (No. 19 of 2020) further criminalises various cyber offences and imposes reporting duties on certain entities. While the survey itself is not a legal ruling, its findings underscore the practical challenges organisations face in achieving compliance with these statutory requirements. Key parties involved include ITWeb and Veeam as the survey conductors, Tahir Latif from Veeam, the 140 senior IT, data, and cybersecurity leaders who participated, and implicitly, the Information Regulator as the primary enforcement authority for POPIA.

Attorneys should urgently advise their clients to move beyond mere confidence and conduct rigorous, regular, and documented stress tests of their data recovery and cyber resilience strategies. Businesses must ensure these strategies align demonstrably with their legal obligations under POPIA and other relevant data protection frameworks. Proactive engagement with cybersecurity experts to identify vulnerabilities, coupled with legal counsel to develop robust incident response plans and ensure compliance, is crucial. Documenting all recovery efforts and their outcomes is essential for mitigating legal exposure and potential regulatory fines, transforming perceived confidence into verifiable resilience.