POPIA enforcement is real but fragile, and information officers carry more weight than the Act gives them
Introduction
The Protection of Personal Information Act 4 of 2013 is old enough now to be judged on what it has done rather than what it promised. Most of it started operating on 1 July 2020, with the last pieces following on 30 June 2021 (Protection of Personal Information Act 4 of 2013; Government Gazette 43461, 2020). Since then the Information Regulator has served a short run of enforcement notices, imposed a few administrative fines, and watched two of those fines go before judges (Information Regulator, 2026a; 2026b). That is enough of a record to say something about how the Act actually bites, and where it does not.
This paper argues that the early enforcement record is real but fragile. The fines so far followed a refusal to obey an enforcement notice, not the original breach, and one was set aside by a High Court (Information Regulator, 2025) while another was halved (Information Regulator, 2026b). The person the Act leans on to keep an organisation compliant, the information officer, gets thin statutory support (Bronstein, 2022). At the same time the privacy problems that matter most online, such as trackers, automated decisions and offshore processing, have barely been reached by enforcement (Schultz and Freedman, 2024; Novazi, 2025). The paper looks at the information officer’s role, then the enforcement record, then why the fines are shaky, and then the digital gaps.
What the Act asks of an information officer
Section 55 of the Act makes the information officer responsible for encouraging compliance with the conditions for lawful processing, dealing with requests, working with the Regulator on investigations, and otherwise making sure the body complies, and it says the officer may only start once the responsible party has registered them with the Regulator (Protection of Personal Information Act 4 of 2013, s 55). Section 56 adds that every public and private body must provide for deputies, to whom powers can be delegated. The Regulator’s guidance note of 1 April 2021 fills in the detail. In a company the chief executive is the information officer unless they authorise someone else in writing, in a national department it is the Director-General, and in a municipality the municipal manager (Information Regulator, 2021). Deputies should be at management level, should report to the highest office and should be given time, resources and funding, and the officer stays accountable for anything delegated. The note also treats registration as a precondition for starting, asks for details to be updated at intervals of no more than a year, and wants them to match the body’s PAIA manual.
Where the statute itself is thin, the guidance and regulations carry the weight. The guidance note says regulation 4 obliges information officers to keep a compliance framework, to carry out a personal information impact assessment, to run internal awareness sessions and to maintain the PAIA manual (Information Regulator, 2021). Bronstein (2022) reads the Act itself rather differently, observing that it seldom requires responsible parties to create or keep documentation and has nothing equivalent to the data protection impact assessment found in the European regulation. Both can be true. The duty exists, but it appears to sit in subordinate legislation and guidance, not in the sections of the Act that an organisation’s board would actually read. I could find nothing in sections 55 and 56 about independence, reporting lines or protection for an officer who raises an awkward finding.
That matters because accountability under POPIA is basically personal and institutional at once. The guidance note says liability may fall on the information officer or on the responsible party depending on the circumstances (Information Regulator, 2021), which is a polite way of saying nobody can be sure which, and which leaves an officer with real duties and an unclear exposure. Bronstein (2022) adds that the Regulator itself carries an unusually heavy load, since it has to grant many exemptions and prior approvals, and she expects it to be a target for criticism. So the system depends on a designated person inside each organisation doing quietly what the Regulator has no capacity to do from outside. The enforcement record shows how that has gone when the person, or the resources behind them, fell short.
What the Regulator has actually done
The Regulator’s enforcement notices page lists ten notices, the earliest dated May 2023, of which seven were issued under POPIA and three under PAIA (Information Regulator, 2026e). The first big one went to the Department of Justice and Constitutional Development. A ransomware infection had made roughly 1,204 files unreadable, and the department’s security monitoring, intrusion detection and antivirus licences had expired in 2020 without being renewed. The notice of 9 May 2023 found breaches of section 19 on security safeguards and section 22 on telling the Regulator and affected people, and it told the Director-General to prove the licences were renewed, begin disciplinary proceedings against the officials responsible, train staff and update the incident response plan, all within 31 days (Information Regulator, 2023a). It imposed no fine.
The private-sector example is Dis-Chem. A brute-force attack on its service provider, Grapevine, gave an unauthorised party access to an e-statement database in April and May 2022, and about 3.6 million records of names, email addresses and cellphone numbers were reached. The Regulator’s notice, issued on 31 August 2023, found that Dis-Chem had not stopped weak passwords, had not monitored for unlawful access, and had no operator agreement with Grapevine setting out security and breach reporting (Information Regulator, 2023c). Again the directions were practical, with an impact assessment, an incident response plan, written operator contracts and a compliance framework. No fine accompanied the notice. More recently, on 22 May 2026, a notice went to Central Johannesburg TVET College for sharing special personal information, including criminal charges and convictions, internally for staff vetting without legal justification and for failing to notify under section 22 (Information Regulator, 2026c).
What stands out is the pattern. Each notice orders specific remedial steps, and a fine only appears when the steps are ignored, which is a fairly cautious way of using a sanction that can reach R10 million. The Department of Justice let the 31-day period expire on 9 June 2023 without a report, and on 3 July 2023 it received an infringement notice carrying an administrative fine of R5 million, with 30 days to pay, agree instalments or elect to be tried in court (Information Regulator, 2023b). The same Regulator statement notes that the maximum administrative fine is R10 million. I could not find a source saying whether the department paid. Bronstein (2022) calls POPIA predominantly command-and-control, and this looks like exactly that: instruct, wait, then escalate, with the penalty reserved for disobedience.
Why the fines are fragile
The Department of Basic Education case shows the weakness plainly, and it may turn out to be the biggest test the Regulator has faced so far. In November 2024 the Regulator ordered the department to stop publishing matric results in newspapers and to give an undertaking within 31 days. When no undertaking arrived it issued an infringement notice on 23 December 2024 imposing a R5 million fine (Information Regulator, 2024). By December 2025 the full bench of the Pretoria High Court had set aside both the enforcement notice and the infringement notice, and the Regulator said it was disappointed and would study the ruling (Information Regulator, 2025). It then applied for leave to appeal, and by late August 2026 it was describing the matter as one before the Supreme Court of Appeal (Information Regulator, 2026a; 2026d). The statements I could open do not give the High Court’s reasons, so I cannot say why the notices failed.
The Blouberg Local Municipality matter points the same way from a different angle. A staff member’s personal information had been published on the municipality’s website, the Regulator issued an enforcement notice and then an infringement notice, and the municipality took the information down but missed the deadlines. The Regulator had set the fine at R500,000 and asked the Polokwane High Court to confirm it under section 109(5), which allows an administrative fine to be made a court order. In early April 2026 the judge thought that figure excessive and confirmed R250,000, noting that only one person was affected, the municipality had taken corrective steps and this was its first violation (Information Regulator, 2026b). Put plainly, a fine under section 109 is only as firm as the court that confirms it (Protection of Personal Information Act 4 of 2013, s 109). So the Regulator’s fining power is real, but a court can cut the number in half.
Time is part of the problem too. The Department of Justice went from enforcement notice to R5 million infringement notice in under two months in 2023, whereas the Basic Education notice dates from November 2024 and was still being argued in 2026 (Information Regulator, 2023b; 2026d). Two further things follow, with some caution. First, the heaviest penalties so far have fallen on state bodies, and a fine paid by one department to the fiscus is a transfer inside the state, which suggests it may say little about whether the officials responsible feel any consequence (Information Regulator, 2023a). The more telling parts of the Department of Justice notice were the instruction to discipline the officials responsible and to train staff, which land on individuals. Second, an information officer in the private sector has seen notices but, in the sources I could open, no fine, so the deterrent for companies remains an expectation more than an experience (Information Regulator, 2023c). If the Supreme Court of Appeal upholds the High Court in the Basic Education matter, that expectation may weaken further. The honest summary is that, when it comes to deterrence, the enforcement machinery works up to the point where somebody refuses to comply and a judge has to look at it.
Privacy in the digital age and the gaps enforcement has not reached
The most revealing evidence about everyday compliance comes from outside the Regulator’s casework. Da Veiga et al. (2024) assessed 50 South African e-commerce websites against 57 criteria mapped to POPIA and found that some sites met the requirements while others needed improvement, with the weakest areas being consent to processing, password management and data quality, and with many privacy policies failing to cover all the conditions. Their recommendations read like a checklist for an information officer, with clearer collection practices, explicit purposes, consent, marketing preferences, third-party sharing, data quality and stronger passwords all on it. Consent matters well beyond shopping. Swales (2022) argues, in the setting of health research, that POPIA requires consent to be specific as well as informed, and that specific consent is best practice. If ordinary retail sites struggle with consent, an information officer working alone in a mid-sized firm is not going to catch every failing, however diligent.
Trackers and automated decisions sit even further from enforcement. Schultz and Freedman (2024) examine social plugins, the embedded buttons that process visitors’ personal information without telling them what is collected, why, or by whom. They draw on the European Fashion ID decision because South Africa has so little case law of its own, and they ask who is a joint responsible party and who must get consent. Novazi (2025) looks at section 71 and finds that POPIA does not expressly give anyone a right to an explanation of an automated decision, that the phrase ‘solely automated’ is hard to pin down, and that token human involvement could let an organisation avoid the protection. None of the notices I could open deals with either problem, which is less a criticism than a sign of how early it still is.
Borders are the third gap. Coetzee (2024a) argues that section 3, which decides whether the Act reaches a responsible party at all, is open to readings that could leave foreign-based processing outside it or let businesses move processing offshore to dodge liability. Her second article finds that section 72 on transfers out of the country is weaker than its European counterpart and suggests a guidance note from the Regulator as one fix (Coetzee, 2024b). Warikandwa (2021) raises a related worry about financial services, a sector so digitised that cyber risk is built in, and assesses whether POPIA is adequate there by comparing it with the European regulation. Ka Mtuze (2022) traces where cybercrime law and the Act intersect, which matters when an incident like the Department of Justice ransomware attack is both a crime and a failure of safeguards.
Underneath all of this sits a conceptual problem. Katzav (2022) points out that POPIA is modelled on European data protection law yet says its purpose is to give effect to privacy, and he argues that its substantive provisions cannot be fully explained by privacy alone. Confining the Act to privacy, he suggests, either restricts how it is read or stretches privacy until the law becomes uncertain. For the digital age that is not an abstract quarrel. A tracker that follows a visitor across sites, or an algorithm that scores a customer, may cause no obvious loss of privacy in the old sense and still be exactly what the Act should control. A Regulator working with a privacy-only idea of harm would struggle to prioritise those cases (Bronstein, 2022).
Bronstein (2022) offers one route out. Her argument is that POPIA copies the command-and-control side of the European regulation but leaves out many of its collaborative mechanisms, including certification and a data protection impact assessment, and that codes of conduct under the Act are more prescriptive than collaborative. Those tools matter for information officers in particular. Certification and shared codes could give a lone officer something concrete to point to when asking the board for money (Information Regulator, 2021), and they might take some pressure off a Regulator that cannot inspect everyone. Whether South Africa would adopt them is another question, and I have seen no sign that it is about to.
Conclusion
POPIA enforcement has started, and the record shows a Regulator willing to name departments, firms and a municipality. It also shows a pattern of notices first and fines last, one fine set aside, another halved, and a body of everyday compliance and online practice that the casework has barely touched (Information Regulator, 2026a; 2026b; Da Veiga et al., 2024). The information officer sits at the centre of that picture, carrying duties set mostly by guidance and regulation, with no statutory protection that I could find and with liability that is unclear (Information Regulator, 2021; Bronstein, 2022).
My view is that the next step is not harsher fines. It is clearer support for the people inside organisations who are meant to prevent the problem, together with guidance on the digital questions that the cases so far have not reached, as Coetzee (2024b) suggests for transfers and as Bronstein’s (2022) point about missing collaborative tools implies. The Basic Education appeal will say a good deal about how far the fining power can be pushed, and the Blouberg ruling already suggests that judges will want proportionality (Information Regulator, 2026b; 2026d). Until it does, the Act’s promise in the digital age is better described as untested than as failed.
Reference list
Bronstein, V. (2022) Prioritising command-and-control over collaborative governance: the role of the Information Regulator under the Protection of Personal Information Act. Potchefstroom Electronic Law Journal, 25, pp. 1-41. doi:https://doi.org/10.17159/1727-3781/2022/v25i0a11661
Coetzee, J. (2024a) Cross-border data flows and the Protection of Personal Information Act 4 of 2013 – Part I: the territorial scope provision. Potchefstroom Electronic Law Journal, 27, pp. 1-25. doi:https://doi.org/10.17159/1727-3781/2024/v27i0a15233
Coetzee, J. (2024b) Cross-border data flows and the Protection of Personal Information Act 4 of 2013 – Part II: the data transfer provision. Potchefstroom Electronic Law Journal, 27, pp. 1-29. doi:https://doi.org/10.17159/1727-3781/2024/v27i0a15234
Da Veiga, A., Abdullah, H., Eybers, S., Ochola, E., Mujinga, M. and Mwim, E. (2024) Evaluating data privacy compliance of South African e-commerce websites against POPIA. Journal of Information Systems and Informatics, 6(4), pp. 2693-2732. doi:https://doi.org/10.51519/journalisi.v6i4.917
Ka Mtuze, S.S. (2022) The convergence of legislation on cybercrime and data protection in South Africa: a practical approach to the Cybercrimes Act 19 of 2020 and the Protection of Personal Information Act 4 of 2013. Obiter, 43(3). doi:https://doi.org/10.17159/obiter.v43i3.14883
Katzav, G. (2022) Compartmentalised data protection in South Africa: the right to privacy in the Protection of Personal Information Act. South African Law Journal, 139(2), pp. 432-470. doi:https://doi.org/10.47348/salj/v139/i2a8
Novazi, Z. (2025) Automated decision-making and the right to an explanation under POPIA in South Africa: a legal perspective. Law, Technology and Humans, 7(3), pp. 146-161. doi:https://doi.org/10.5204/lthj.4081
Schultz, H. and Freedman, W. (2024) Plugins and POPI: a critical discussion into the legal implications of social plugins and the protection of personal information. Potchefstroom Electronic Law Journal, 27, pp. 1-32. doi:https://doi.org/10.17159/1727-3781/2023/v26i0a15758
Swales, L. (2022) The Protection of Personal Information Act 4 of 2013 in the context of health research: enabler of privacy rights or roadblock? Potchefstroom Electronic Law Journal, 25, pp. 1-32. doi:https://doi.org/10.17159/1727-3781/2022/v25i0a11180
Warikandwa, T.V. (2021) Personal data security in South Africa’s financial services market: the Protection of Personal Information Act 4 of 2013 and the European Union General Data Protection Regulation compared. Potchefstroom Electronic Law Journal, 24, pp. 1-32. doi:https://doi.org/10.17159/1727-3781/2021/v24i0a10727
Legislation and case law
Government Gazette 43461 (2020) Protection of Personal Information Act 4 of 2013: commencement of certain sections, Proclamation, 22 June. Available at: https://www.gov.za/sites/default/files/gcis_document/202006/43461rg11136pr21.pdf (Accessed: 18 October 2026).
Information Regulator (2021) Guidance note on information officers and deputy information officers, 1 April. Available at: https://inforegulator.org.za/wp-content/uploads/2025/07/Guidance_Note_on_Information_Officers_.pdf (Accessed: 18 October 2026).
Information Regulator (2023a) Enforcement notice issued to the Department of Justice and Constitutional Development, 9 May. Available at: https://inforegulator.org.za/wp-content/uploads/2020/07/ENFORCEMENT-NOTICE-DOJCD-MATTER-090523.pdf (Accessed: 18 October 2026).
Information Regulator (2023b) Media statement: infringement notice issued to the Department of Justice and Constitutional Development, 4 July. Available at: https://inforegulator.org.za/wp-content/uploads/2020/07/MEDIA-STATEMENT-INFRINGEMENT-NOTICE-ISSUED-TO-THE-DEPARTMENT-OF-JUSTICE-AND-CONSTITUTIONAL.pdf (Accessed: 18 October 2026).
Information Regulator (2023c) Media statement: enforcement notice issued to Dis-Chem Pharmacies Ltd, 1 September. Available at: https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-STATEMENT-ENFORCEMENT-NOTICE-ISSUED-TO-DISCHEM-PHARMACIES-LTD.pdf (Accessed: 18 October 2026).
Information Regulator (2024) Media statement: infringement notice issued to the Department of Basic Education, 23 December. Available at: https://inforegulator.org.za/wp-content/uploads/2025/01/Media-Statement-Infringement-Notice-DBE.pdf (Accessed: 18 October 2026).
Information Regulator (2025) Media statement: the Regulator to study the court judgment on matric results, 12 December. Available at: https://inforegulator.org.za/wp-content/uploads/2026/01/MEDIA-STATEMENT-THE-REGULATOR-TO-STUDY-THE-COURT-JUDGEMENT-ON-MATRIC-RESULTS-December-2025.pdf (Accessed: 18 October 2026).
Information Regulator (2026a) Media statement: the Regulator appeals the judgment on publication of matric results, listed 21 January. Available at: https://inforegulator.org.za/wp-content/uploads/2026/01/MEDIA-STATEMENT-THE-REGULATOR-APPEALS-THE-JUDGEMENT-ON-PUBLICATION-OF-MATRIC-RESULTS-31-DEC-2025.pdf (Accessed: 18 October 2026).
Information Regulator (2026b) Media statement: Information Regulator turns to the courts to fine Blouberg Local Municipality for contravention of POPIA, April. Available at: https://inforegulator.org.za/wp-content/uploads/2026/04/INFORMATION-REGULATOR-TURNS-TO-THE-COURTS-TO-FINE-BLOUBERG-LOCAL-MUNICIPALITY-FOR-CONTRAVENTION-OF-POPIA_.pdf (Accessed: 18 October 2026).
Information Regulator (2026c) Media statement: Information Regulator issues enforcement notices for the contraventions of POPIA and PAIA by public and private bodies, 2 June. Available at: https://inforegulator.org.za/wp-content/uploads/2026/06/MEDIA-STATEMENT-INFORMATION-REGULATOR-ISSUES-ENFORCEMENT-NOTICES-FOR-THE-CONTRAVENTIONS-OF-POPIA-AND-PAIA-BY-PUBLIC-AND-PRIVATE-BODIES.pdf (Accessed: 18 October 2026).
Information Regulator (2026d) Media invite: Information Regulator to host media briefing on high-profile cases, enforcements and investigations into POPIA and PAIA contraventions, 26 August. Available at: https://inforegulator.org.za/wp-content/uploads/2026/08/MEDIA-INVITE-INFORMATION-REGULATOR-TO-HOST-MEDIA-BRIEFING-ON-HIGH-PROFILE-CASES-ENFORCEMENTS-AND-INVESTIGATIONS-INTO-POPIA-AND-PAIA-CONTRAVENTIONS.pdf (Accessed: 18 October 2026).
Information Regulator (2026e) Enforcement notices. Available at: https://inforegulator.org.za/enforcement-notices/ (Accessed: 18 October 2026).
Protection of Personal Information Act 4 of 2013. Available at: https://www.gov.za/documents/protection-personal-information-act (Accessed: 18 October 2026).