The scope of application of PAIA is triggered when the conduct of a body (public or private) affects the rights of South Africans. Specifically, a body must comply with PAIA when a person may require access to the records it [...]
What should the regulatory approach for AI in South Africa be? Artificial Intelligence (AI) has exploded globally - just look at ChatGPT. While AI offers enormous potential to drive innovation and inclusive growth, it also raises serious concerns, from AI-generated [...]
The Information Regulator has issued a PAIA enforcement notice against the Johannesburg Stock Exchange (JSE) after it refused to grant access to share trading records. This JSE enforcement action requires the JSE to notify affected third parties and reconsider whether […]
There will be no standalone South African AI Act. Instead, South Africa will have a sector-specific, risk-based approach to AI regulation. This approach aligns with international best practices followed by the UK and Australia, which seek to use existing laws [...]
Welcome to the law in 2026! At the beginning of each year, we look ahead to help you prioritise your next steps. This is the law regarding digital, data and tech in 2026. We try to predict what will happen [...]
In Minister of Basic Education v Information Regulator, the High Court set aside the regulator’s enforcement notice issued to the DBE. The notice tried to stop the Department from publishing the matric results using examination numbers. The judgment provides guidance [...]
Let's talk cybersecurity compliance for officers. Many organisations treat cybersecurity compliance like a library. They collect policies, file them away, and assume that because the shelf is complete, the building is safe. But in 2026, regulators aren't looking for a [...]
The Protection of Personal Information Act (POPI Act or POPIA) is South Africa's data protection law. The first question you need to ask is do you have to comply with it? Who must comply with POPIA? Who does the [...]
The Information Regulator argues that it is unlawful for the Department of Basic Education (DBE) to publish matric results in newspapers using a learner's exam number without consent. The regulator issued an enforcement notice to the DBE and then fined […]
Understanding the Information Regulator's priorities is no longer just good practice; it's essential to avoid enforcement action. Having attended the Regulator's recent stakeholder breakfast, we can distil the key lessons and confirmed changes that will shape the compliance landscape in […]
The Information Regulator stakeholder engagement revealed the regulator's thinking on how to comply with the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). More importantly, the regulator confirmed expected amendments to the POPIA [...]
Many people are wondering whether they need an App EULA (or Application End User Licence Agreement) for the App (or application) they have developed (such as an iPhone App, Mac App, or iPad App). It might be an App for [...]
