Make it safe to own up.
Something will go wrong: the wrong data pasted, a bad answer sent to a customer. Speed matters more than blame.
Contain
First Hour
Stop the use, revoke access, pull anything already sent or published.
Assess
First Day
What data, whose, how many people, and how much harm is possible.
Notify & learn
After
If personal info was compromised, POPIA s22 means telling the Regulator and those affected, promptly.
Source: popia.co.za ↗
Report fast. Fix fast. Learn.