POPI and Data Protection

The protection of personal information, and privacy and data protection laws (including the GDPR and the POPI Act or POPIA) are key laws in today’s information society. Information compliance or information rights are central to so many disputes. Read our insights, regulatory updates, judgment summaries, enforcement action (including fines and notes), data breaches or authority guidance.

First National Bank enforcement action | POPIA compliance

First National Bank enforcement action was taken by the Information Regulator on 21 October 2026. The Regulator issued an enforcement notice and an infringement notice against First National Bank ('FNB') on the same day. The notices cover FNB’s failures to […]

By |2026-10-28T12:01:37+02:00October 28th, 2026|Categories: POPI and Data Protection|Tags: , , , , , , , , |
Read More

Financial Mail v Sage Holdings | Privacy of juristic persons

In Financial Mail (Pty) Ltd v Sage Holdings Ltd, the Court extended personality rights to a corporation in 1993. This judgment was a significant development in our law and underpins POPIA's requirement that responsible parties protect the personal information of [...]

By |2026-10-08T07:16:04+02:00September 18th, 2026|Categories: AI Governance, Media Law, POPI and Data Protection, Robot Law|Tags: , , , , , , |
Read More

Kenya’s cross-border data transfer guidance note

Kenya has introduced important new guidance for organisations transferring personal data across borders. On 8 September 2026, Kenya’s Office of the Data Protection Commissioner (ODPC) published its Guidance Notes for Cross-border Data Transfers, giving organisations more detailed direction on how […]

By |2026-09-17T18:18:56+02:00September 17th, 2026|Categories: POPI and Data Protection|Tags: , , , , |
Read More

Information Security Team: Your task force for securing information and responding to incidents

A group can achieve a goal faster and more effectively than one person working alone. Information security law compliance is difficult and requires an information security team of people to do it properly. Your team should include people from [...]

By |2026-10-06T09:39:04+02:00September 16th, 2026|Categories: Cybersecurity Law, POPI and Data Protection|Tags: , , , , , , |
Read More

The law regards automatic and electronic processes

Many organisations are reviewing processes and looking for ways to do them electronically and automatically. Putting digital first or moving from a paper-based environment to a digital environment. There are obviously huge benefits to going digital - saving time [...]

By |2026-10-05T14:13:46+02:00September 16th, 2026|Categories: Contracts, Electronic Signature Law, POPI and Data Protection|Tags: , , , , , , |
Read More

Information Regulator ramps up enforcement

Information Regulator ramps up enforcement: on 1 September 2026, the Information Regulator briefed the public and media on its latest enforcement and compliance activities under POPIA and PAIA. The briefing shows the Regulator is increasingly concerned about South Africa's cybersecurity [...]

By |2026-09-23T09:37:19+02:00September 2nd, 2026|Categories: Access to Information, POPI and Data Protection|Tags: , , , |
Read More

Cybersecurity flow-down clauses – Whose compliance obligations?

A security addendum arrives from a customer. They want incident notification within 24 hours, the right to audit you on site, approval before you change a subcontractor, and cooperation with their penetration testing. These are cybersecurity flow-down clauses: contractual terms [...]

By |2026-08-12T13:35:29+02:00August 12th, 2026|Categories: Cybersecurity Law, POPI and Data Protection|Tags: , , , , |
Read More

Nominate someone to be a member of the information regulator

Parliament has invited the organisations and interested individuals to nominate people (or apply themselves) for the President to appoint as members of the information regulator. Do you want to nominate someone? Do you know anyone who might want to nominate [...]

By |2026-08-20T11:03:08+02:00August 5th, 2026|Categories: POPI and Data Protection|Tags: , |
Read More

Pre-investigation notice from the Information Regulator: what now?

If a complainant lodges a complaint against you for infringing their privacy rights, the information regulator can issue any one of a few types of notices to you. For example, you could receive an information notice, an enforcement notice, or [...]

By |2026-07-31T13:36:30+02:00July 27th, 2026|Categories: POPI and Data Protection|Tags: , , |
Read More

Enforcement Notice from the Information Regulator: what now?

The Information Regulator may send you a POPIA enforcement notice after investigating you and finding that you have contravened POPIA by failing to lawfully process personal information. In comparison, the Information Regulator may send you an infringement notice if it [...]

By |2026-07-27T14:07:36+02:00July 26th, 2026|Categories: POPI and Data Protection|Tags: , , , , , |
Read More

Information Officer and PAIA manual for the group or each entity within the group?

The Promotion of Access to Information Act (PAIA) states that the head of a private body is the Information Officer, and they should compile a PAIA manual for the private body and update the manual regularly (unless exempt). According to […]

By |2026-07-22T15:49:17+02:00July 22nd, 2026|Categories: Access to Information, POPI and Data Protection|Tags: , , , |
Read More

Who needs a Data Protection Officer (DPO)?

Who must appoint a DPO? What does the General Data Protection Regulation (GDPR) require regarding a Data Protection Officer (or DPO)? This is one of the questions that the GDPR, adopted by the European Parliament in 2016, has prompted many organisations to ask. Another [...]

By |2026-08-25T09:04:28+02:00July 17th, 2026|Categories: POPI and Data Protection|Tags: , , , |
Read More