South Africa Strengthens Enforcement of POPIA Data Protection Rules

South Africa's Information Regulator is taking a more active approach to enforcing data protection rules under the Protection of Personal Information Act (POPIA). Recent enforcement actions show that organisations can face scrutiny not only after a major cyberattack but also when their everyday data-handling practices fail to meet privacy requirements.

The Information Regulator issued an enforcement notice against Central Johannesburg TVET College in May 2026. The Regulator has also taken further enforcement action and continued its compliance work during 2026. The year marks the Regulator's 10th anniversary and five years since POPIA's enforcement provisions came into effect.

Source: Werksmans Attorneys — The regulator is watching: new enforcement signals for POPIA and PAIA compliance.

SABS Case Highlights the Need for Strong Privacy Controls

The South African Bureau of Standards (SABS) offers a clear example of how a cybersecurity incident can trigger a broader privacy review.

After a ransomware attack disrupted SABS systems and operations in 2024, the Information Regulator conducted its own assessment. The assessment identified several POPIA compliance problems. These included excessive or irrelevant information processing, weak consent processes, inadequate security safeguards, and a failure to properly inform data subjects about how their information was collected.

The case shows that a cyberattack can highlight wider weaknesses in an organisation's data management. A company may suffer a cyber incident without causing it deliberately. However, it still needs to show that it collects relevant information, protects that information, and follows the required privacy processes.

The Regulator directed SABS to review its policies, conduct risk and impact assessments, and improve its security measures within 90 days.

POPIA Violations Can Result in Financial Penalties

POPIA allows the Information Regulator to impose administrative fines of up to R10 million.

The Regulator has already imposed fines on several organisations. The amounts disclosed in August 2026 included R5 million penalties involving the Department of Justice and Constitutional Development and the Department of Basic Education. Other cases involved fines of R100,000 and R500,000. Some of these matters remain in dispute or are before the courts.

However, financial penalties are only one part of the risk for organisations. An enforcement notice can require an organisation to correct its processes within a specific period and provide evidence of compliance.

What Organisations Should Do Next to Strengthen Data Privacy?

Organisations can start by identifying the personal information they collect and understanding why they need it.

They should also appoint and register an Information Officer and make sure the person has a real role in managing POPIA compliance.

Companies should review who can access personal information and whether appropriate security controls protect it. They should also maintain clear procedures for responding to data breaches and test those procedures regularly.

The SABS case also shows why organisations should connect privacy and information security with business continuity. A ransomware attack can disrupt both data protection and normal business operations.

How ISO Standards Strengthen POPIA Readiness?

Organisations can use management system standards to create a more structured approach to these requirements.

ISO/IEC 27001 helps organisations establish an Information Security Management System and manage information security risks.

ISO/IEC 27701 provides a framework for managing privacy information and strengthening privacy management processes.

ISO 22301 focuses on business continuity and helps organisations prepare for disruptions that can affect critical operations.

Using these standards together can help organisations connect information security, privacy and business continuity instead of managing each area as a separate task.

Conclusion

South Africa’s stronger POPIA enforcement shows that data privacy needs to be part of everyday business practices. Organisations should not wait for a cyberattack or an enforcement notice before reviewing how they collect, use and protect personal information.

A structured approach can help organisations identify privacy and security gaps before they become bigger problems. ISO/IEC 27001, ISO/IEC 27701, and ISO 22301 can help organisations build stronger information security, privacy, and business continuity processes.

With the right systems and expert guidance, organisations can improve their readiness for POPIA requirements while building greater trust in how they handle personal information.