POPI and Data Protection

The protection of personal information, and privacy and data protection laws (including the GDPR and the POPI Act or POPIA) are key laws in today’s information society. Information compliance or information rights are central to so many disputes. Read our insights, regulatory updates, judgment summaries, enforcement action (including fines and notes), data breaches or authority guidance.

SCHUFA case | OQ v Land Hessen | Automated decision-making

The Court of Justice of the European Union (CJEU) issued a landmark SCHUFA case or judgement (OQ v Land Hessen) on automated decision-making (ADM) and EU data protection about credit scoring. On 7 December 2023, it ruled that companies may [...]

By |2026-01-15T14:42:55+02:00October 23rd, 2024|Categories: AI Governance, POPI and Data Protection|Tags: , , , , , |
Read More

Data processing agreement compliance

In today's digital world, data processing agreements (DPAs) are the solid framework holding up relationships between businesses and third-party providers handling personal data on their behalf. As data protection laws like the EU’s General Data Protection Regulation (GDPR) and South [...]

By |2024-10-16T12:06:25+02:00October 16th, 2024|Categories: IT Law, POPI and Data Protection|Tags: , |
Read More

Radical Candor in data protection policies

Think of your organisation's data protection policy as a secure vault. Its strength comes from solid walls and the trust and responsibility shared among those who hold the keys. In today's data-driven world, safeguarding personal information isn't just about following [...]

By |2024-10-14T13:23:15+02:00October 14th, 2024|Categories: POPI and Data Protection|Tags: , |
Read More

Navigating AI Governance in South African Law: An Overview

Building AI without legal guidance is like constructing a bridge without blueprints—it might stand for a while, but it's destined to collapse. As AI continues to rapidly integrate into the South African business environment, aligning it and its use [...]

By |2026-02-10T14:52:49+02:00September 30th, 2024|Categories: Access to Information, AI Governance, Cybercrime, Data governance, POPI and Data Protection|Tags: , , , |
Read More

Lancet Laboratories enforcement action | Security

The Information Regulator issued a POPIA enforcement notice against Lancet Laboratories in September 2024 for failing to comply with the breach notifications required by POPIA. The Information Regulator conducted a POPIA compliance assessment following the numerous security compromises experienced by [...]

By |2025-12-05T12:27:25+02:00September 25th, 2024|Categories: POPI and Data Protection|Tags: , , , , , , , , , , |
Read More

Information Regulator aims to step up enforcement

The information regulator briefed the public and the media on 11 September 2024 on some enforcement activities over the last quarter (since 1 April 2024). The central theme was that the regulator has taken various enforcement actions but hasn't succeeded [...]

By |2025-08-10T20:59:34+02:00September 12th, 2024|Categories: Access to Information, POPI and Data Protection|Tags: , , |
Read More

DoJ enforcement action | Personal information compromise

The Information Regulator’s DoJ enforcement action, followed by the DoJ infringement notice, highlights the risks of failing to address a personal information compromise under the Protection of Personal Information Act (POPIA). The Department of Justice (DoJ) failed to secure the [...]

By |2026-04-07T15:29:41+02:00September 11th, 2024|Categories: Cybersecurity Law, POPI and Data Protection|Tags: , , , , , , |
Read More

Lingo Telecom enforcement action | Robocalling fine

The Federal Communications Commission (FCC) proposed a landmark enforcement action against Lingo Telecom, a voice service provider, for violations of caller ID authentication rules under the STIR/SHAKEN framework. This proposal followed the transmission of thousands of spoofed robocalls, including deepfake [...]

By |2025-04-01T16:58:38+02:00September 1st, 2024|Categories: POPI and Data Protection|Tags: , , |
Read More

The Ethiopian Data Protection Law – the PDPP

Attention! Ethiopia has just upped its game in the digital privacy arena. The country has officially rolled out the Personal Data Protection Proclamation No. 1321/2024(let's call it "the PDPP" for short), and it's a game-changer for anyone handling personal info. [...]

By |2024-11-12T10:56:16+02:00August 30th, 2024|Categories: POPI and Data Protection|Tags: , , , |
Read More

Munetsi v Madhuyu | Disclosure of personal information

Munetsi v Madhuyu and Another involves the disclosure of personal information on social media without consent. The applicant sued the respondents to stop sharing his personal information online. He also requested a public apology and punitive costs. The court ordered [...]

By |2025-11-20T10:08:49+02:00August 28th, 2024|Categories: POPI and Data Protection|Tags: , , , , , |
Read More