First National Bank enforcement action was taken by the Information Regulator on 21 October 2026. The Regulator issued an enforcement notice and an infringement notice against First National Bank ('FNB') on the same day. The notices cover FNB’s failures to […]
Businesses have moved many of the systems they once ran on their own hardware into the cloud. They use services such as AWS, Microsoft Azure and Google Cloud to host applications, manage accounts and store information. Cloud evidence preservation has [...]
The Information Regulator’s preliminary investigation report reveals that Gauteng Premier Panyaza Lesufi did not provide adequate reasons for refusing the Democratic Alliance (DA) access to 177 forensic reports from 2016 to date. The investigation is ongoing. If a body wants […]
South Africa needs an agile, enabling, and proactive National AI policy grounded in our realistic context so its statements are actionable. Our policy should clearly outline, at a high level, how South Africa aims to capture AI's benefits while effectively [...]
On 9 October 2026, Minister Parks Tau held a media briefing on the National Opt-Out Registry system. The briefing contained no new announcements. Instead, it gave a short overview of how the Registry will work, set out the key dates, [...]
CRA vulnerability reporting can turn on a few hours of evidence. Monday morning, 8 am. A security researcher emails your vulnerability reporting address. They have found a remote-code-execution vulnerability in one of your products. They attach working proof-of-concept code and [...]
The NCC published their draft guidelines for compliance with Opt-Out Registry regulations in Government Gazette No. 55465 on 2 October 2026. The guidelines explain how the Commission reads section 11 of the CPA and the 2026 Amendment Regulations. They [...]
No single source of law covers the regulation of social media in South Africa. Instead, several existing laws govern what people and businesses do on social media platforms. These laws protect freedom of expression while also addressing privacy, defamation, hate [...]
Your company is building a mobile app. Developers add a third-party software development kit (SDK), such as an analytics or attribution tool. That is where ePrivacy device access can become relevant. The privacy review starts with the usual GDPR questions. [...]
In Financial Mail (Pty) Ltd v Sage Holdings Ltd, the Court extended personality rights to a corporation in 1993. This judgment was a significant development in our law and underpins POPIA's requirement that responsible parties protect the personal information of [...]
Kenya has introduced important new guidance for organisations transferring personal data across borders. On 8 September 2026, Kenya’s Office of the Data Protection Commissioner (ODPC) published its Guidance Notes for Cross-border Data Transfers, giving organisations more detailed direction on how […]
A group can achieve a goal faster and more effectively than one person working alone. Information security law compliance is difficult and requires an information security team of people to do it properly. Your team should include people from [...]
