Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Information Regulator (South Africa) €5,062 100 % · 2 cases
What for?
by area of lawAll areas of law
Who?
by company- Lancet Laboratories €5,062 100 % · 1 case
- Anonymised companies – 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | – |
| 2024 | 0 | – |
| 2025 | 1 | €5,062 |
| 2026 | 0 | – |
2 cases
13 Nov 2025 Lancet LaboratoriesInformation Regulator: ZAR 100,000 against Lancet Laboratories over unreported data breaches €5,062
An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.
Data breaches must be reported both to the regulator and to the data subjects; failing to report several incidents triggers an assessment and sanctions.
Notifying data breaches to the regulator and data subjects
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Protection of Personal Information Act 4 of 2013 (POPIA), s. 22
- Action
- Fine
- Status of proceedings
- final
- Sector
- Healthcare
- Published
- 13 Nov 2025
Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.
- Information Regulator: Media briefing – high-level cases on POPIA and PAIA (13.11.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
31 Aug 2023 a South African pharmacy chainPharmacy chain: order after breach at service provider exposing some 3.6 million records Order
In April and May 2022, unauthorised parties used a brute-force attack at a service provider to access some 3.6 million records (names, email addresses, mobile numbers) from the pharmacy chain's e-statement service; the regulator found weak passwords, inadequate monitoring, no written contract with the operator and a failure to notify the data subjects. By enforcement notice of 31 August 2023 it ordered, among other things, a personal information impact assessment, an incident response plan, PCI DSS measures and written contracts with all operators; in March 2024 it confirmed compliance and closed the file.
Anyone passing customer data to service providers needs a contract with security and notification obligations – and must notify data subjects themselves after an incident.
Password security and management of service providers
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Sections 19(1)(b), 19(2), 19(3), 21(1) und 22(1)(b) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA
- Action
- Order
- Status of proceedings
- final
- Sector
- Healthcare
- Published
- 1 Sep 2023
- Information Regulator (South Africa), Veröffentlichung der Behörde (Entscheidung 2023) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 31 Aug 2025 · Direct link