The Gauteng e-Panic Button has become the centre of a growing dispute over cybersecurity, with the Democratic Alliance (DA) calling for an investigation into a reported data breach while the provincial Department of e-Government insists that no residents’ personal information was compromised.

The DA says it will report the matter to the Information Regulator of South Africa and wants an investigation into whether the incident breached the Protection of Personal Information Act (POPIA), how the exposure occurred and how the Gauteng government responded.

The dispute follows a report by GroundUp which raised concerns about sensitive information linked to the provincial e-Panic Button system.

According to GroundUp, the system had exposed information belonging to people who used the platform to report crimes, including names and personal details, crime reports, photographs, GPS locations and location histories.

The report said information relating to domestic violence and assault was among the data that could be accessed. It also reported that one-time PINs used to access the application were exposed.

The DA’s Gauteng spokesperson for e-Government, Michael Waters, said the exposure raised serious questions about the department’s responsibility to protect information provided by residents seeking help.

The party wants the Gauteng Department of e-Government to appear before the Gauteng Legislature’s Portfolio Committee on e-Government to explain the circumstances surrounding the incident.

Among the questions the DA wants answered are how long the information was exposed, whether unauthorised people accessed it and whether access logs have been independently examined.

The DA has also questioned the department’s decision to invest in digital emergency-response technology while cybersecurity remains a concern.

Waters said the matter was particularly serious because the e-Panic Button is used by people reporting sensitive and potentially life-threatening situations.

However, the Department of e-Government has rejected the suggestion that residents’ personal information was compromised.

In its response, issued on Tuesday, the department said it had identified an attempted security breach involving the e-Panic Button environment and acted to address the identified vulnerabilities.

The department said its technical teams implemented corrective measures and strengthened the platform’s security controls.

MEC for e-Government, Research and Development Bonginkosi Dhlamini said the security of government systems and the protection of residents’ personal information remained a priority.

“The security of our systems and the protection of residents’ personal information are non-negotiable. The vulnerability was identified, our technical teams implemented corrective measures promptly,” Dhlamini said.

The MEC also disputed the suggestion that the incident involved a vulnerability that could simply be replicated by an ordinary IT practitioner.

He said the incident involved a highly specialised organisation with advanced cybersecurity expertise and capabilities in vulnerability identification and security testing.

The department said it had gone further by requesting additional testing and verification to establish that the necessary security requirements had been addressed.

“Cybersecurity is not a once-off exercise. It requires continuous testing, monitoring, strengthening and improvement,” Dhlamini said.

The conflicting accounts leave a number of questions about the extent and nature of the reported incident.

While the DA is calling for an investigation into what it describes as the exposure of sensitive information, the department’s position is that an attempted security breach was identified and addressed and that no citizens’ personal information was compromised.

The Information Regulator’s involvement could provide an independent assessment of whether the incident constituted a breach of POPIA and whether the provincial government met its obligations regarding the protection and handling of personal information.

The controversy is significant because the e-Panic Button was designed to provide residents with another way to access emergency assistance during criminal incidents, medical emergencies, gender-based violence, fires and other life-threatening situations.

The Gauteng government has particularly promoted the application in township and vulnerable communities, where residents may face barriers in accessing conventional emergency and safety services.

The department said the platform had recorded 288,307 active users, 114,414 emergency call-outs, 27,929 citizens assisted and 59,394 crimes reported.

It also reported that 12,051 lives had been saved through the platform and that its average response time was 15 minutes and 57 seconds.

The figures are being cited by the department as evidence of the role the technology has played in the province’s public safety response.

But the dispute over cybersecurity has placed the protection of information at the centre of questions about the platform.

For residents reporting domestic violence, assault or other serious crimes, the information submitted through an emergency platform can be highly sensitive. Concerns about who can access such information and how it is protected could affect public confidence in digital reporting systems.

The DA says residents deserve a full explanation of what happened, whether information was accessed, whether affected users need to be notified and what measures have been implemented to prevent a repeat incident.

The department, meanwhile, says it remains committed to continuous testing and strengthening of the platform and insists that protecting residents’ information is central to its operation.

The next step will be whether the DA’s planned referral to the Information Regulator results in an investigation and whether the Gauteng Legislature’s oversight structures require the department to account for the incident.

Until those questions are independently addressed, the competing claims over the reported security incident leave the public with two sharply different accounts of what happened to information held by the provincial e-Panic Button system.