Who must appoint a DPO? What does the General Data Protection Regulation (GDPR) require regarding a Data Protection Officer (or DPO)? This is one of the questions that the GDPR, adopted by the European Parliament in 2016, has prompted many organisations to ask. Another [...]
Sibanye-Stillwater enforcement action was taken by the Information Regulator, who issued a PAIA enforcement notice against the company on 22 May 2026 after Sibanye refused access to its Social and Labour Plan (SLP) compliance reports. The Information Regulator found that […]
Who is responsible for complying with data protection legislation (including the POPI Act in South Africa and the GDPR) where you process personal information together with someone else? It is crucial to know the answer to this question. It is [...]
You should map activities (rather than information, data flows, or processes) as a first step toward complying with data protection laws (such as the GDPR and the Protection of Personal Information Act (POPI Act)). The law requires larger organisations to […]
Digital sovereignty is an increasingly important business consideration. Many organisations and public sector functions are grappling with how to achieve it. Some think that digital sovereignty requires a trade-off between the benefits of using hyper-scalers' digital infrastructure, on the one [...]
The Gauteng Department of Health enforcement action issued by the Information Regulator on 8 June 2026, directs the Department to disclose records requested by the Complainant under PAIA. The records relate to the investigation of the assassination of Babita Deokaran. […]
You need to understand the difference between King IV and King V. What does the difference between King IV and King V mean? King V is effective for financial years that start on or after 1 January 2026 and officially [...]
What do the JSE listing requirements say about the King Code? Is the King Code part of the requirements? Do listed companies have to comply with the King Code principles? Have the JSE listing requirements changed since the last King [...]
The Central Johannesburg TVET College enforcement action confirms that the Information Regulator will act when POPIA conditions are not met. On 22 May 2026, the Regulator issued its first formal enforcement notice of the year, following complaints lodged by employees [...]
South Africa has built one of the most detailed regulatory frameworks for cryptocurrency on the African continent. With innovative fintech players leading the way, more people are turning to cryptocurrency for payments, investments, and cross-border transfers. But with growth [...]
Is there anything tricky about a Data Retention Policy? Does anyone get a headache thinking about what to include in the policy and what outcomes it will help achieve? Is drafting a Data Retention Policy a simple matter of slapping [...]
In Tourvest Holdings (Pty) Ltd v Murti, the Supreme Court of Appeal provides valuable guidance on ensuring disclaimers (including AI disclaimers) are enforceable. If you use disclaimers, you should review and update your existing ones, and update the procedures for […]
