POPIA Compliance: What South African Businesses Still Get Wrong

The Protection of Personal Information Act 4 of 2013 (POPIA) has been fully in force since 1 July 2021. Many businesses responded with a privacy policy on their website and little else. The Information Regulator has made it clear that this is not enough. It now sends proactive compliance letters, has issued enforcement notices against public and private bodies, and has imposed administrative fines of up to R5 million on responsible parties that failed to comply with those notices.

Below are the five failures we encounter most often in practice, each with the steps that correct it.

01No Registered Information Officer

Every responsible party has an Information Officer. For a company, the head of the private body (usually the chief executive or managing director) holds the role by default, whether or not anyone has been formally appointed. The Information Officer must be registered with the Information Regulator before taking up duties, and deputy information officers should be designated and registered where the size of the business requires it.

Unregistered Information Officers remain one of the most common findings. In its first enforcement notice of 2026, issued on 20 May 2026 against Central Johannesburg TVET College, one of the Regulator's findings was a failure to register the Information Officer and to designate and register deputies. Registration is free and is done on the Regulator's eServices portal.

What to do: confirm who your Information Officer is, register that person and any deputies, and keep the registration certificate on file.

02A Compliance Framework That Exists Only on Paper

Regulation 4 of the POPIA Regulations requires the Information Officer to ensure that a compliance framework is developed, implemented, monitored, maintained and continually improved. A template policy downloaded once and never applied does not meet that standard.

When the Regulator orders a responsible party to produce its framework, it expects at least a privacy policy, a retention policy and schedule, an incident response policy and an information security policy, together with evidence that staff have been trained on them.

What to do: map the personal information you actually hold, record why you hold it and for how long, complete a personal information impact assessment, and train your staff. Review the framework at least annually.

03Weak Security and No Breach Response Plan

Section 19 requires appropriate, reasonable technical and organisational measures to secure personal information. Section 22 requires a responsible party to notify the Regulator and affected data subjects as soon as reasonably possible after it has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. Security compromises are now reported through the Regulator's eServices portal.

The Regulator has received more than 8,000 security compromise notifications since its enforcement powers commenced. The most common causes it reports are inadequate security controls, employee negligence, weak passwords and ransomware. The Regulator's first administrative fine, R5 million against the Department of Justice and Constitutional Development in 2023, followed a ransomware attack and the department's failure to renew its antivirus licences as ordered.

What to do: enforce multi factor authentication, keep software and backups current, limit access to personal information to those who need it, and prepare a written incident response plan before you need one.

04Direct Marketing Without Valid Consent

Section 69 permits unsolicited electronic direct marketing only with the data subject's consent, or to an existing customer who was given the opportunity to object when their details were collected and on every subsequent communication. The amended POPIA Regulations, published on 17 April 2025, confirm that consent must be obtained on a form substantially similar to Form 4 or by other expedient means, and that an opt out does not amount to consent. The Regulator's guidance treats telephone calls as electronic communication, so cold calling falls within section 69.

The Regulator has identified direct marketing as a priority enforcement area. Separately, the Consumer Protection Act Amendment Regulations, 2026 provide for a national opt out registry that direct marketers must register with and check their databases against. The two regimes apply together, and complying with one does not excuse a breach of the other.

What to do: audit your marketing lists, keep a record of how and when each consent was obtained, and stop marketing to anyone for whom you cannot show consent or a genuine existing customer relationship.

05Unmanaged Operators and Transfers Abroad

Most businesses rely on payroll providers, cloud platforms, IT support and software services that process personal information on their behalf. Sections 20 and 21 require a written contract obliging every such operator to maintain appropriate security measures and to notify you of any security compromise. Where personal information is sent outside South Africa, section 72 permits the transfer only if one of its grounds applies, for example that the recipient is subject to a law or binding agreement providing an adequate level of protection, or that the data subject consents.

What to do: list every service provider that touches personal information, put compliant operator agreements in place, and record the section 72 ground relied on for each transfer abroad.

06Why This Matters Now

The Regulator can issue enforcement notices, impose administrative fines of up to R10 million and refer offences for prosecution. Data subjects may also bring civil claims under section 99. In August 2026 the Regulator proposed amendments that would allow it to impose fines immediately on a finding of non compliance, rather than only after an enforcement notice is ignored. The reputational cost of a published enforcement notice is often greater than the fine itself.

A focused compliance review usually takes weeks, not months, and the cost is small compared with responding to a complaint or a security compromise without one.