The Gauteng Department of e-Government waited two weeks to report the e-Panic data breach to the Information Regulator, the Democratic Alliance (DA) has revealed. The department was alerted to the data breach on 21 September 2026.
Michael Waters, DA Gauteng Spokesperson for e-Government, demands the release of the original security assessments and the full findings regarding the e-Panic Button data breach, as well as an explanation for the delayed notification to the Information Regulator. The data breach allegedly exposed highly sensitive personal information of hundreds of thousands of residents.
Two-Week Delay and Independence Concerns
Waters expressed concern that the department allowed the company responsible for developing and hosting the e-Panic button app, Evolve, to appoint its own investigator into the security breach. This emerged during a joint meeting of the Portfolio Committee on e-Government and Community Safety.
“Allowing the company to choose the person investigating those measures raises significant concerns about the credibility and independence of the process,” Waters said. The preliminary investigation report is only expected on 20 October 2026.
Waters added: “The department cannot tell residents that their information is safe while simultaneously admitting to the Legislature that it has not established the extent of the exposure.”
POPIA Obligations and Delayed Notification
Section 22 of the Protection of Personal Information Act (POPIA) requires notification as soon as reasonably possible where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.
Waters said the DA will table questions in the Gauteng Provincial Legislature (GPL) to the MEC for e-Government, Bonginkosi Dhlamini, to determine:
-
Why it took the department two weeks to notify the Regulator and whether this delay complied with its legal obligations.
-
Whether the department conducted proper due diligence before the system was implemented.
-
Whether independent penetration tests were conducted.
-
Who authorised its deployment; and
-
What assurances were given that residents’ personal information would be protected.
Criminal Case Against Whistleblower
Instead of fixing the security issues flagged in GroundUp, the South African Police Service (SAPS) has advised Evolve to open a criminal case against the person who exposed the vulnerability.
The department confirmed that the system has more than 280,000 registered users and has recorded approximately 60,000 alerts. It also admitted that the investigation has yet to establish when the vulnerability first arose.
“This means the department still cannot account for how long sensitive information may have been exposed or how many residents may have been affected,” Waters said.
Residents Deserve Answers, Not Premature Assurances
Waters welcomed the Portfolio Committees’ demand for an investigation independent of Evolve’s investigation.
“Residents who use an emergency application to seek protection from criminals should never have to fear that the system intended to protect them could expose their identities, locations, and personal circumstances,” he said.
“The Gauteng Provincial Government owes those residents answers, not premature assurances and an investigation whose independence remains in question.”
How Gauteng’s New Panic App Exposed Your Data
