Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,033 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

South Africa Data protection Healthcare Clear all filters

1case from 1 jurisdiction

€5,062Total of monetary amounts

€5,062Largest single case: Lancet Laboratories

€5,062Median per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by authority

Information Regulator (South Africa) €5,062 100 % · 1 case

What for?

by topic

Data breaches and data security €5,062 100 % · 1 case

Who?

by company

Lancet Laboratories €5,062 100 % · 1 case

When?

per quarter, by date of decision

Trend
Period	Cases	Total
Q4 2023	0	–
Q1 2024	0	–
Q2 2024	0	–
Q3 2024	0	–
Q4 2024	0	–
Q1 2025	0	–
Q2 2025	0	–
Q3 2025	0	–
Q4 2025	1	€5,062
Q1 2026	0	–
Q2 2026	0	–
Q3 2026	0	–
Q4 2026	0	–

1 case

Newest first Highest amounts

13 Nov 2025 Lancet LaboratoriesInformation Regulator: ZAR 100,000 against Lancet Laboratories over unreported data breaches South AfricaData breaches and data security €5,062

An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.

What organisations can take from it

Data breaches must be reported both to the regulator and to the data subjects; failing to report several incidents triggers an assessment and sanctions.

Relevance to training and awareness

Notifying data breaches to the regulator and data subjects

Authority / court: Information Regulator (South Africa)
Area of law: Data protection · Data breaches and data security
Legal basis: Protection of Personal Information Act 4 of 2013 (POPIA), s. 22
Action: Fine
Status of proceedings: final
Sector: Healthcare
Published: 13 Nov 2025

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Sources

Information Regulator: Media briefing – high-level cases on POPIA and PAIA (13.11.2025) Press release of an authority

Checked against the official source on 4 Oct 2026 · Direct link

Report an error

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source (company names until they are anonymised).

Company names are anonymised two years after the decision in a case, in line with the practice of many supervisory authorities. The official sources remain linked.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Ready for training that actually lands?