Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Information Regulator (South Africa) €35,595 100 % · 7 cases
What for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | – |
| 2024 | 3 | €5,224 |
| 2025 | 2 | €30,371 |
| 2026 | 1 | – |
7 cases
22 May 2026 Central Johannesburg TVET College (CJC)Central Johannesburg TVET College: order after staff vetting reports were mis-sent Order
In September 2022 the public TVET college mistakenly emailed reports verifying the qualifications and criminal records of three employees to other staff, informed neither the regulator nor those affected, and had not registered an information officer. Departing from the view of its Enforcement Committee, the regulator also treated this as impermissible further processing and found breaches of accountability, purpose limitation, security safeguards and the notification duty; on 22 May 2026 it ordered, among other things, registration, notification of the breach, a written apology, a compliance framework and POPIA training for all staff.
Sensitive personnel records should be filed separately – and even an internal misdirected email is a notifiable security compromise.
Misdirected emails and handling of personnel records
Missing or inadequate training played a role in the decision.
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Employee data
- Legal basis
- Sections 8, 15(1), 19(1) und 22(1) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- Mitigating circumstances
- The college recalled the email two days later, informed staff of the error and took action against those responsible; according to the regulator, this did not relieve it of the duty to notify.
- Published
- 2 Jun 2026
- Information Regulator: Enforcement Notice (Section 95 POPIA) – Central Johannesburg TVET College, dated 22 May 2026 (redacted) Decision of an authority
- Information Regulator Media Statement, 02 June 2026: Information Regulator issues enforcement notices for the contraventions of POPIA and PAIA by public and private bodies Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
13 Nov 2025 Blouberg Local MunicipalityInformation Regulator: ZAR 500,000 against Blouberg municipality over personnel data online €25,309
The municipality had processed personal information of a former employee which was exposed on the internet; the Information Regulator treated this as a gross violation of privacy and issued an enforcement notice. Because the municipality did not implement the corrective instructions, an administrative fine of ZAR 500,000 followed; as it did not pay, the Regulator has initiated court proceedings to recover the amount.
Personnel data remains protected after employees leave; ignoring regulatory orders risks a heavy fine and recovery proceedings.
Protecting personnel data of former employees
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Employee data
- Legal basis
- Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 13 Nov 2025
Original amount 500,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.
- Information Regulator: Media briefing – high-level cases on POPIA and PAIA (13.11.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
13 Nov 2025 Lancet LaboratoriesInformation Regulator: ZAR 100,000 against Lancet Laboratories over unreported data breaches €5,062
An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.
Data breaches must be reported both to the regulator and to the data subjects; failing to report several incidents triggers an assessment and sanctions.
Notifying data breaches to the regulator and data subjects
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Protection of Personal Information Act 4 of 2013 (POPIA), s. 22
- Action
- Fine
- Status of proceedings
- final
- Sector
- Healthcare
- Published
- 13 Nov 2025
Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.
- Information Regulator: Media briefing – high-level cases on POPIA and PAIA (13.11.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
13 Nov 2024 Electoral Commission of South Africa (IEC)Information Regulator: ZAR 100,000 against the Electoral Commission after candidate list leak €5,224
After candidate lists for the 2024 elections were released without authorisation, the Information Regulator found inadequate organisational safeguards and issued an enforcement notice on 10 September 2024. Because the Electoral Commission did not demonstrate compliance within the deadline (31 days), an infringement notice with an administrative fine of ZAR 100,000 followed.
After a data breach, remediation alone is not enough; compliance must also be demonstrated to the regulator on time, and missed deadlines lead straight to a fine.
Implementing regulatory remediation orders after a data leak
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 13 Nov 2024
Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2024.
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
10 Sep 2024 a major US messaging serviceUS messaging service: order to revise its privacy policy for South Africa Order
The regulator found that the messaging service's revised privacy policy applicable in South Africa – unlike the European version – did not set out adequate legal bases and purposes, that consent obtained by making acceptance a condition of use was not voluntary, that sharing data with companies of its own group and third parties amounted to impermissible further processing, and that the service had demonstrated neither compliance with its documentation duty nor appropriate security safeguards. The enforcement notice of 10 September 2024 required the provider, among other things, to bring the policy into line with POPIA, submit a personal information impact assessment and maintain a risk register; according to the regulator (as of 13 November 2025), a court review brought by the provider was resolved by a settlement on additional transparency information, which is to be made an order of court.
Global privacy policies must set out legal bases and purposes for each jurisdiction – agreement required as a condition of use is not voluntary consent.
Voluntary consent and transparent privacy notices
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Sections 8, 9, 11, 13, 15, 17 und 19 Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA; Section 51 PAIA (Dokumentation)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Information Regulator (South Africa), Veröffentlichung der Behörde (Entscheidung 2024) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 10 Sep 2026 · Direct link
Report an error
26 Mar 2024 a South African credit bureauInformation Regulator: order against a credit bureau over inadequate access control Order
Following a security compromise reported in March 2022, the Information Regulator found that the credit bureau had failed to secure the confidentiality of the data, had not implemented its own access policies and had allowed unauthorised actors in through compromised credentials and a weak password. By enforcement notice it was ordered to put security measures in place, have a qualified auditor check all user accounts against its SFTP user creation policy and carry out a personal information impact assessment; the deadline for proof was 26 May 2024.
User creation and access management policies only protect if compliance with them is monitored technically; compromised credentials and weak passwords are a way in.
Access management and password security
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Protection of Personal Information Act 4 of 2013 (POPIA), Bedingungen für die rechtmäßige Verarbeitung (Sicherheitsmaßnahmen); Enforcement Notice
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Published
- 26 Mar 2024
- Information Regulator (South Africa), Veröffentlichung der Behörde (Entscheidung 2024) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 26 Mar 2026 · Direct link
Report an error
31 Aug 2023 a South African pharmacy chainPharmacy chain: order after breach at service provider exposing some 3.6 million records Order
In April and May 2022, unauthorised parties used a brute-force attack at a service provider to access some 3.6 million records (names, email addresses, mobile numbers) from the pharmacy chain's e-statement service; the regulator found weak passwords, inadequate monitoring, no written contract with the operator and a failure to notify the data subjects. By enforcement notice of 31 August 2023 it ordered, among other things, a personal information impact assessment, an incident response plan, PCI DSS measures and written contracts with all operators; in March 2024 it confirmed compliance and closed the file.
Anyone passing customer data to service providers needs a contract with security and notification obligations – and must notify data subjects themselves after an incident.
Password security and management of service providers
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Sections 19(1)(b), 19(2), 19(3), 21(1) und 22(1)(b) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA
- Action
- Order
- Status of proceedings
- final
- Sector
- Healthcare
- Published
- 1 Sep 2023
- Information Regulator (South Africa), Veröffentlichung der Behörde (Entscheidung 2023) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 31 Aug 2025 · Direct link