Reviewed regulatory announcements, guidance and enforcement developments for South African businesses. Check the original publication date and source before acting.
Sources last checked · Some sources unavailable; previous updates retained.
In a media invitation dated 26 August 2026, the Information Regulator announced a briefing scheduled for 31 August on enforcement matters, investigations and direct marketing. This is the announcement of that briefing, not a report of its outcomes.
What this means for your business
Read the original source for its scope and context. Discuss any implications for your organisation with your adviser.
The Information Regulator reported issuing enforcement notices under POPIA and PAIA in its 2 June 2026 statement. The document covers accountability, information sharing and security safeguards, alongside access-to-information matters.
What this means for your business
Review who can access and share personal information, how safeguards are evidenced and how formal information requests are handled. The statement describes notices, rather than a final court outcome or a paid fine.
Notice issued · Check the linked source for the scope and current position.
From the source: The session aims to equip public and private bodies with the knowledge to implement and comply with the two legislations in their respective organisations or departments.
What this means for your business
Read the original source for its full context and scope. Consider whether it affects your organisation before changing your practices.
From the source: The session aims to equip public and private bodies with the knowledge to implement and comply with the two legislations in their respective organisations or departments.
What this means for your business
Read the original source for its full context and scope. Consider whether it affects your organisation before changing your practices.
The Information Regulator issued an enforcement notice concerning Central Johannesburg TVET College. The notice addresses accountability, further processing and security safeguards, and sets out remedial steps and a right of appeal.
What this means for your business
Read the original source for its scope and context. Discuss any implications for your organisation with your adviser.
Notice issued · Check the linked source for the scope and current position.
Regulations published on 6 March 2026 address the processing of health information by certain responsible parties. The text includes security safeguards and conditions for transferring health information outside South Africa.
What this means for your business
If your organisation processes health information, check with your adviser whether these regulations apply and review the safeguards and transfer arrangements.
The Information Regulator has issued an enforcement notice against WhatsApp for failing to comply with several conditions for the lawful processing of personal information under POPIA. The Regulator identified issues regarding consent, transparency, purpose specification, and the documentation of security measures, ordering WhatsApp to implement corrective actions within 60 days.
What this means for your business
Businesses operating in South Africa should ensure their privacy policies and data processing practices are fully compliant with POPIA, as the Regulator is actively enforcing accountability, transparent consent, and documented security risk assessments.
Outcome not confirmed · Check the linked source for the scope and current position.
The Information Regulator published guidance on direct marketing under POPIA, covering unsolicited non-electronic and electronic communications. The guidance explains the relevant provisions and how they apply to processing personal information for marketing.
What this means for your business
Review how marketing permissions, objections and opt-out requests are recorded. Check the original guidance with your adviser before changing a campaign.
The Information Regulator’s guidance explains authorisation for processing children’s personal information, including public-interest considerations and safeguards. The document includes an application form.
What this means for your business
Use this as reference guidance. Check the original document and whether its provisions apply to your intended processing.
