POPIA Penalties and Liability: What South African Business Leaders Face

Who carries the risk: the business, and by default the CEO

POPIA places its duties on the responsible party: the organisation or person that decides why and how personal information is processed. Enforcement notices, administrative fines and damages claims are all aimed at the responsible party. For a company, that is the company itself; for a sole proprietor, it is the owner.

Every responsible party also has an Information Officer. For a company, that is by default the head of the organisation: the chief executive officer or equivalent officer, or a person that officer has duly authorised. In a small business this is usually the owner or managing director.

Many businesses hand the role to an IT or compliance manager. The Regulator’s guidance allows this if the authorisation is in writing, and says it should go to an employee at management level or above, so not to an outside IT provider. But the person who authorises someone else “retains the accountability and responsibility” for the functions handed over. The title can move; the accountability stays with the head of the business.

Three more points catch businesses out:

• Registration is compulsory. The Regulator treats registering the Information Officer as a compulsory duty of the business, and in a group each subsidiary must register its own.
• Size does not exempt you. The Act has no size or turnover threshold. Its definition of a private body includes a sole proprietor carrying on a trade, business or profession.
• Companies are protected too. Unlike the GDPR, POPIA protects information about identifiable, existing juristic persons such as companies, not only individuals. Your business client and supplier records count.

Four ways POPIA reaches a business

POPIA creates four separate channels of exposure. They are often blurred into one headline number, but they work very differently.

1. Enforcement notices: the Regulator decides what you fix, and by when

The Regulator can assess an organisation after a complaint or on its own initiative. If it is satisfied that the business has interfered with the protection of personal information, it can serve an enforcement notice requiring specific steps, a stop to certain processing, or both.

Published notices have ordered work such as a personal information impact assessment, an incident response plan, written contracts with every operator, payment-card security controls, renewed security-tool licences, staff training and a compliance framework, with deadlines of 31 to 120 days in the notices we reviewed. A notice can be appealed to the High Court within 30 days, and an appeal generally suspends the duty to comply unless the notice is marked urgent. Failing to comply with a notice is a criminal offence in the Act’s most serious penalty tier.

2. Administrative fines: up to R10 million

The Regulator can issue an infringement notice, an administrative fine of up to R10 million, where a responsible party is alleged to have committed an offence under the Act. The cap is a rand amount (which the Minister may adjust for inflation), not a percentage of turnover.

The detail matters: the Act’s offences are a specific list, and on our reading weak security or another breach of the processing conditions is not one of them on its own. The exceptions are serious or persistent breaches involving account numbers (identifiers that give access to funds or credit) that are likely to cause substantial damage or distress, among other conditions, and failing to notify the Regulator of processing that needs its prior authorisation, or going ahead before it has finished considering it. Failing to comply with an enforcement notice is an offence, as are obstructing the Regulator and knowingly or recklessly making a false statement in response to its information notice, so an ignored enforcement notice is not the only legal route to a fine. It is, however, the route that all six POPIA fines we found in the Regulator’s media statements and briefings, up to 5 October 2026, have followed: an enforcement notice that, according to the Regulator, was not complied with in time, then a fine.

When it sets the amount, the Regulator must weigh factors including the number of people affected or potentially affected, how long the contravention lasted, whether it could have been prevented, and any failure to carry out a risk assessment or to operate good policies, procedures and practices. Your documentation can affect the size of the fine.

Within 30 days the business can pay, arrange to pay in instalments, or elect to be tried in court. An unpaid fine can be enforced like a civil judgment. In the only such case with a reported outcome that we found, the Polokwane High Court in April 2026 reduced the Regulator’s R500,000 fine against Blouberg Local Municipality to R250,000, because only one person was affected, the information had been removed and it was a first contravention. Fines are paid into the National Revenue Fund, not to the people affected.

3. Criminal offences: where imprisonment comes in

Imprisonment is possible only after a criminal conviction for one of the Act’s specific offences. The most serious tier, a fine or imprisonment of up to 10 years or both, covers failing to comply with an enforcement notice, obstructing the Regulator, giving false evidence and certain offences involving account numbers. A lower tier of up to 12 months covers offences such as failing to notify the Regulator of processing that needs its prior authorisation.

So the R10 million figure and the 10-year figure belong to different processes. An administrative fine is not a criminal conviction, and once it is paid the business cannot be prosecuted on the same facts.

4. Civil damages: no need to prove negligence

A person whose personal information has been processed in breach of POPIA, or the Regulator at their request, can sue the responsible party for damages “whether or not there is intent or negligence” on its part. The claimant still has to prove the breach and the harm it caused. The Act lists five defences: vis major (broadly, an unforeseeable event beyond the business’s control), the claimant’s consent, the claimant’s own fault, that compliance was not reasonably practicable in the circumstances, or an exemption granted by the Regulator.

The Act puts no rand figure on damages. A court can award an amount it considers just and equitable, covering financial and non-financial loss, aggravated damages, interest and costs. Unlike the administrative fine, this exposure has no statutory ceiling. As at 5 October 2026 we found no reported judgment awarding damages under section 99 in the judgments, news and legal commentary we could search online.

What the enforcement record actually shows

We reviewed the media statements, media briefings and enforcement notices the Information Regulator has published on its website, up to 5 October 2026. These cases show how the risk plays out in practice.

Department of Justice and Constitutional Development: R5 million

After a 2021 ransomware attack, the Regulator found that the department had failed to put adequate technical measures in place to monitor and detect data being taken out of its network. Licences for its SIEM, intrusion-detection and antivirus tools had expired. The Regulator determined that the department had not complied with the enforcement notice (it had not reported on implementation within the 31 days allowed), and in July 2023 it issued an R5 million fine, the earliest POPIA fine we found in its statements. The department has challenged the fine in court; the Regulator’s latest published update on the case, in November 2025, said it was pending a hearing.

Dis-Chem Pharmacies: your supplier’s breach can be your breach

In 2022 attackers used a brute-force attack on Grapevine, an operator that managed a Dis-Chem e-statement service, and accessed about 3.6 million people’s records, limited to names, email addresses and cellphone numbers. The Regulator found Dis-Chem itself in breach: its security safeguards fell short, it had no written contract with the operator, and it had not notified affected customers as soon as reasonably possible. Dis-Chem disputed parts of the findings, including the notification finding: it said it had published a notice on its website and a national media statement. It was ordered to do an impact assessment, build an incident response plan, apply payment card industry (PCI DSS) controls and put written contracts in place with all its operators. Dis-Chem complied, and the Regulator closed the file without a fine.

TransUnion: when the Regulator decides how you notify

After a 2022 security compromise at the credit bureau, the Regulator found TransUnion’s notification inadequate. On top of the notices TransUnion had already given, it directed the company to publicise the breach on all radio stations, in each official language, and in all newspapers.

Lancet Laboratories: a notification failure, then a fine for not complying

According to the Regulator, the private pathology laboratory suffered repeated security compromises and did not notify the Regulator and the people affected as required. It did not comply with the resulting enforcement notice, was fined R100,000, and paid.

FT Rams Consulting: the unsubscribe link that was not enough

According to the Regulator, the training company kept emailing a person who had repeatedly tried to opt out. The Regulator found that the opt-out option in its emails did not make up for the lack of prior consent. The company did not comply with the enforcement notice and was fined R100,000. It did not pay, and the Regulator went to court to recover the fine.

Central Johannesburg TVET College: no hacker required

In 2026 the Regulator found that the college had, in 2022, emailed three staff members’ background-verification reports to other employees by mistake, a use incompatible with the purpose the reports were collected for. The email was recalled two days later, but the Regulator found that the sharing was still a security compromise that the college should have reported. A breach does not need an attacker: an email to the wrong people can trigger the same duties.

Department of Basic Education: fine set aside, Regulator seeking to appeal

The Regulator fined the department R5 million for not complying with an enforcement notice about publishing matric results in newspapers. The High Court set aside both the notice and the fine in December 2025 and refused leave to appeal in June 2026, and the Regulator has approached the Supreme Court of Appeal. Fines can be challenged, and so can the Regulator’s reading of the law.

What the pattern tells you

• Fines have followed non-compliance. We found six POPIA fines in the Regulator’s media statements and briefings, up to 5 October 2026: the Department of Justice (R5 million, under challenge in court), the Department of Basic Education (R5 million, set aside; the Regulator is seeking to appeal), the Electoral Commission (R100,000, for not showing compliance within the 31 days allowed), Blouberg Local Municipality (R500,000, reduced to R250,000 by the High Court), Lancet Laboratories (R100,000) and FT Rams Consulting (R100,000). Each followed an enforcement notice that, according to the Regulator, was not complied with in time. Dis-Chem and the South African Police Service complied with their notices, and their files were closed without a fine. That is a pattern, not a rule to plan around: a damages claim, for one, needs no enforcement notice.
• Private businesses have been fined, at lower amounts so far. Two of the six fines were against private-sector businesses, at R100,000 each. The R5 million fines were against national government departments.
• A known breach can start a case. The Department of Justice and Dis-Chem cases began with the Regulator’s own assessment after the breaches became known, not with a complaint.
• Breach reports run into the thousands. The Regulator received 2,374 breach reports in the 2024/25 financial year, and by the end of August 2026 it had received more than 8,000 in total.

Breach notification: the clock starts at “reasonable grounds”

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the business must notify the Regulator. It must also notify the people affected, unless their identity cannot be established (and subject to the rules on delaying that notice, set out below). The trigger is reasonable grounds to believe, not confirmed harm. The Regulator’s fact sheet adds that every security compromise must be reported “irrespective of the deemed level of risk”, and that it does not have to be confirmed before it is reported.

The deadline is “as soon as reasonably possible after the discovery”, taking into account the legitimate needs of law enforcement and the steps reasonably needed to establish the scope of the compromise and restore the system. POPIA sets no fixed number of hours, and the Regulator expects any delay to be explained. The often-quoted 72 hours comes from the GDPR, and from section 54 of the Cybercrimes Act, which would require electronic communications service providers and financial institutions to report certain cybercrimes to the police, but which was left out when the rest of the Act came into force on 1 December 2021 and, as far as we can find, has not been brought into force since. Some sectors have their own rules: financial institutions covered by Joint Standard 2 of 2024, such as banks and insurers, must notify the Prudential Authority or the FSCA of cyber incidents and information security compromises they classify as material.

Notice to the people affected must be in writing, for example by email, post, a prominent notice on your website or the news media, and must give them enough information to protect themselves. You may delay telling them only if a law-enforcement agency or the Regulator decides that notification would impede a criminal investigation.

Two practical traps:

• The portal needs a registered Information Officer, and a login that works. Since 1 April 2025 the Regulator has required reports to it to be submitted through its eServices portal rather than by email, and a report can only be submitted if the organisation and its Information Officer are registered. Register now, and check that your Information Officer or deputy can log in and see the organisation listed. If the portal fails during an incident, contact the Regulator’s helpdesk straight away (through the iSupport ticket system on the eServices site, or on 010 023 5200), keep a record of every attempt, and file through the portal as soon as it works. The helpdesk helps you report; it does not replace the report. Telling the people affected is a separate duty, done in writing, and the portal requires samples of the notice you sent them.
• Your operators must tell you immediately. IT, cloud, payroll and marketing providers that process personal information for you must notify you immediately when they have reasonable grounds to believe it was accessed by an unauthorised person, and you need a written contract that obliges them to maintain proper security measures.

Are directors personally liable under POPIA?

Some South African websites claim that directors or Information Officers face personal R10 million fines and 10 years in jail under POPIA. The position is more nuanced.

Being a director does not, by itself, make you personally liable for your company’s POPIA breaches. POPIA has no clause that extends a company’s liability to its directors: its administrative fines, damages claims and the offence of failing to comply with an enforcement notice are all aimed at the responsible party, which for a company is the company. Whether you are personally exposed depends on your own conduct and role, and on duties under other laws, as set out below. If you trade as a sole proprietor, the responsible party is you, so this exposure is personal; partners should take advice on how it applies to a partnership.

The Regulator’s own statements warn that failing to comply with an enforcement notice can lead to imprisonment “of the responsible officials”. The Act makes the responsible party guilty of that offence (section 103(1)) and does not mention officials, and we found no case that has tested the Regulator’s reading, so treat it as an open question rather than a settled one. As at 5 October 2026, we found no confirmed prosecution of an individual under POPIA in the Regulator’s media statements and briefings or in the news and law-firm coverage we searched.

That does not leave company leaders unexposed. Personal exposure comes from four directions:

• Personal offences under POPIA. Anyone, including a director or employee, can be prosecuted personally for offences such as obstructing the Regulator, giving false evidence to it, or knowingly or recklessly obtaining or disclosing account numbers without the responsible party’s consent.
• PAIA. Every private body must have a PAIA manual. A head of a private body (by default the CEO) who wilfully or through gross negligence fails to comply with that requirement commits an offence carrying a fine or up to two years’ imprisonment, and one who refuses to comply with a PAIA enforcement notice from the Regulator commits an offence carrying a fine or up to three years. In November 2025 the Regulator reported that it had taken two public bodies’ failures to comply with its PAIA enforcement notices to the police, against the officials concerned. Its guidance lists these PAIA offences, not POPIA offences, as the Information Officer’s personal criminal exposure.
• The Companies Act. Directors must act with the care, skill and diligence reasonably expected of someone in their position with their knowledge and experience, and a director who falls short can be liable to the company for the resulting losses. For a decision, a director is treated as having met that duty if they took reasonably diligent steps to become informed, had no material personal financial interest in the matter (or dealt with one as the Act requires), and had a rational basis for believing, and did believe, that the decision was in the company’s best interests. Directors may rely on employees, advisers and board committees they reasonably believe to be competent. The protection is built around informed, rational decisions.
• King V. King V is the voluntary governance code that replaced King IV, with disclosure against it applying to financial years starting on or after 1 January 2026. Its Principle 10 says the governing body governs “data, information and technology”, and its recommended practices include information security, data protection and privacy. The code is voluntary, but the IoDSA’s King V Foundational Concepts document notes that failing to meet an established governance standard “may invoke liability”.

Our practical reading: for most directors, the realistic personal risk is not a POPIA fine in their own name. It is a claim that they fell short of their duty of care, skill and diligence, for example by never asking whether the business complies, ignoring the reports they received or not checking that agreed fixes were made, which can make a director liable to the company for the resulting losses. Minutes and board reports are evidence of how the board governed, not a defence in themselves: the Companies Act’s protection depends on the substance, meaning an informed decision with a rational basis. Ask the questions, act on the answers, and minute both.

This section summarises the legislation. It is not legal advice; take advice from an attorney on your own position.

If you deal with Europe: where the GDPR comes in

The EU’s General Data Protection Regulation can apply to a South African business with no office in Europe. It applies if you offer goods or services to people who are in the EU, whether paid or free, or monitor their behaviour there. The test is where the people are, not their citizenship.

A business caught this way must generally appoint a representative in the EU in writing, unless its processing is occasional, unlikely to create risk and does not include large-scale processing of sensitive or criminal-offence data.

The differences that matter for leaders:

• Fines are linked to turnover. GDPR fines can reach €10 million or 2% of worldwide annual turnover for failures such as weak security or late breach notification, and €20 million or 4% for breaches of the core principles, consent rules, individuals’ rights or international transfer rules, whichever amount is higher.
• There is a 72-hour rule, with conditions. A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. A report made after 72 hours must give the reasons for the delay.
• POPIA protects more types of data subject. The GDPR protects individuals; POPIA also protects companies.

If your business is subject to both, design one breach process that meets the stricter rule on each point: the GDPR’s timing (tell the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, giving reasons if it takes longer), and POPIA’s duties to report every compromise to the Regulator and to tell every affected person you can identify, whatever the level of risk.

Where ISO 27001 fits

POPIA does not name ISO 27001 or any other standard. Section 19 requires “appropriate, reasonable technical and organisational measures” to protect personal information, and “due regard to generally accepted information security practices and procedures”.

The Regulator has used recognised standards as benchmarks for that duty. Its enforcement notice to the Department of Justice cited an ISO 27001 control on incident response plans, and its notice to Dis-Chem cited the payment card industry standard, PCI DSS.

ISO/IEC 27001:2022, amended in 2024, sets the requirements for an information security management system (ISMS), including assessing and treating information security risks. Section 19 asks for a similar cycle: identify foreseeable risks, put safeguards in place, check that they work and keep them up to date. In our view, a working ISMS is one of the strongest ways to show that you have met that duty.

Certification is evidence of good practice, not a legal requirement and not a safe harbour. If you pursue it, use a certification body accredited for ISO/IEC 27001 (SANAS is South Africa’s national accreditation body). Our guides on ISO 27001 vs POPIA and ISO 27001 certification costs cover the detail.

Ten questions for your next board or management meeting

1. Who is our Information Officer, and is their registration with the Regulator current for every company in the group?
2. Could we submit a breach report on the Regulator’s eServices portal today? Who holds the login?
3. When did we last complete a personal information impact assessment?
4. Do we have a written incident response plan, and who decides that there are “reasonable grounds” to notify?
5. Do we have written contracts with every operator that handles our data, requiring security measures and immediate breach notice?
6. Are our security tools, such as antivirus, intrusion detection and SIEM, licensed, monitored and alerting someone who acts on the alerts?
7. Is our email and SMS marketing to non-customers based on prior consent?
8. Is our PAIA manual current and published on our website?
9. Could we show the Regulator our risk assessments, policies and training records tomorrow?
10. Do we offer goods or services to people in the EU, and if so, have we addressed the GDPR?

For the practical controls behind these questions, see our POPIA compliance checklist.

Frequently asked questions

What is the maximum POPIA fine?

The maximum administrative fine under POPIA is R10 million, a rand cap that is not linked to turnover. The largest POPIA fines we found, up to 5 October 2026, were R5 million each, against two national government departments: one was set aside by the High Court, a ruling the Regulator is seeking to appeal at the Supreme Court of Appeal, and the other is being challenged in court.

Are small businesses exempt from POPIA?

No. POPIA has no size or turnover threshold, and its definition of a private body includes a sole proprietor carrying on a trade, business or profession. If you trade as a sole proprietor, the business’s POPIA liability is your own.

Who is responsible for POPIA compliance in a company?

The company, as the responsible party, carries the legal obligations. Its Information Officer is by default the CEO or equivalent officer. The CEO can authorise someone else in writing, but the Regulator’s guidance says the person who authorises keeps the accountability.

Do we have to report a data breach within 72 hours?

Not under POPIA. It requires notice as soon as reasonably possible after the discovery, both to the Regulator and, in writing, to the people affected. Since 1 April 2025 the Regulator has required reports to it to come through its eServices portal. The 72-hour figure comes from the GDPR, which requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours, and which may also apply if you serve people in the EU.

Can directors go to jail under POPIA?

Only after a criminal conviction, and POPIA does not make a director guilty of the company’s offences just because they are a director. The POPIA offences a director could commit personally include obstructing the Regulator, giving it false evidence, or unlawfully obtaining or disclosing account numbers. The Act makes failing to comply with an enforcement notice an offence by the responsible party, which for a company is the company itself, although the Regulator’s statements warn that “responsible officials” could be imprisoned; we found no case that has tested this. Separately, under PAIA, a head of a private body (by default the CEO) faces a fine or up to two years’ imprisonment for wilfully or grossly negligently failing to comply with the PAIA manual requirement, and up to three years for refusing to comply with a PAIA enforcement notice. As at 5 October 2026, we found no confirmed prosecution of an individual under POPIA in the Regulator’s media statements and briefings or in the news and law-firm coverage we searched. Sole proprietors are in a different position, because the business’s liability is their own.

Does ISO 27001 certification make us POPIA compliant?

Not on its own. POPIA does not require any specific standard, and certification is not a safe harbour. The Regulator has cited ISO 27001 as a benchmark for security safeguards, and in our view a working ISMS is strong evidence that you take the duty seriously.

Sources

• Protection of Personal Information Act 4 of 2013 (Government Gazette 37067) and the POPIA Regulations as amended in 2025
• Information Regulator: Guidance Note on Information Officers; eServices breach-reporting statement (April 2025), portal step-by-step guide, fact sheet on security compromises (August 2025) and contact page (iSupport helpdesk), checked 5 October 2026
• Enforcement records: Department of Justice enforcement notice, media statement (10 May 2023) and infringement notice statement (4 July 2023); Dis-Chem enforcement notice, statement and Dis-Chem’s response (Moonstone, 2023); TransUnion statement (2022); FT Rams Consulting enforcement notice and statement (2024); Blouberg court statement (2026); TVET college enforcement notice and statement (2026); Department of Basic Education infringement notice statement (23 December 2024) and judgment statement (December 2025)
• Information Regulator updates of 26 March 2024, 13 November 2024, 13 November 2025 and 31 August 2026
• Promotion of Access to Information Act 2 of 2000; Companies Act 71 of 2008; Cybercrimes Act 19 of 2020
• IoDSA: King V Code and King V Foundational Concepts
• EU General Data Protection Regulation (2016/679); ISO/IEC 27001:2022 (IEC webstore listing); Prudential Authority communication on Joint Standard 2 of 2024
• How we checked the “we found” and “none found” statements: the Regulator’s media statements, speeches and briefing addresses, enforcement notices and litigation pages as at 5 October 2026, plus web searches of South African news, law-firm commentary and published judgments

This article is general information based on POPIA, related legislation and the Information Regulator’s published statements and enforcement notices up to 5 October 2026. It is not legal advice. For decisions about your organisation’s legal position, consult an attorney.