Practise what you policy: the R1 million POPIA lesson for South African businesses
October 30, 2026
If your organisation handles personal information in South Africa, the Protection of Personal Information Act 4 of 2013 (POPIA) applies to you. It sets eight conditions for lawful processing, covering accountability, purpose specification, retention, further processing and security, among others. The Information Regulator enforces these conditions and has been clear: compliance is not a box you tick once and forget. It is an ongoing job.
The consequences of getting it wrong are significant. The Information Regulator may issue enforcement notices requiring specific remedial steps or halting certain processing, or infringement notices imposing administrative fines of up to R10 million. Failure to comply with an enforcement notice is itself an offence, carrying a fine, up to 10 years' imprisonment, or both.
The enforcement and infringement notices
On 21 October 2026, the Information Regulator issued both an enforcement notice and an infringement notice to a major South African bank, requiring the Bank to take certain steps and imposing an administrative fine of R1 million. The Information Regulator conducted an own-initiative assessment, and not only considered the Bank’s policies, including its privacy policy, retention schedule and access management policy, but also the Bank’s compliance with its own policies.
Some of the Information Regulator’s findings against the Bank include that:
- its privacy policy did not adequately reflect all the rights data subjects have under POPIA;
- it collected personal information from newspapers without a lawful justification, as a ‘public source’ does not fall under a ‘public record’ nor was such information deliberately made public by the data subjects;
- its retention schedule allowed certain records to be kept indefinitely, with no stated legal basis;
- it relied on incorrect grounds to justify further processing and sharing of customer information; and
- it failed to secure personal information on its banking app. Some account holders were misclassified as employees, exposing the information of 88 home loan applicants (including the account numbers of nine) to 696 unauthorised individuals. Crucially, two customers had flagged the problem to the Bank in March and May 2022, and the Bank dealt with each report as an isolated incident, without identifying the underlying vulnerability or reporting the compromise to the Information Regulator. The Information Regulator also found that the Bank had not followed its own incident response and access management policies.
In addition to the fine for failing to secure personal information on its banking app relating to account numbers of data subjects, which is an offence under section 105 of POPIA, the Bank was ordered to take certain remedial steps, with a full implementation report due within 90 days. These steps include amending its privacy notice, reviewing its retention framework and destroying records held without legal basis, documenting the lawful basis for further processing, strengthening role-based access controls, and training staff to identify and report security incidents. If the Bank fails to implement these remedial actions, it will amount to a further offence, and could expose the Bank to further fines and/or imprisonment.
3 Key takeaways for businesses
- Regularly review and update your policies, including retention schedules. It is important to ensure that your policies and procedures remain fully compliant. Your policies should cover all data subject rights, document your lawful basis for the collection and further processing of personal information, and if you keep records indefinitely, you need to set out a clear legal basis for doing so.
- Ensure that your policies match practice. Your policies must be correctly implemented. For example, having an access management policy is not enough; it must be correctly configured, tested and implemented.
- Treat every report as a potential breach. Customer complaints are early warning signs. Investigate root causes and assess whether notification to the Information Regulator is required.
How we can help
This matter sends a clear message: the Information Regulator will look beyond paper compliance to see how you actually respond when things go wrong. Our Technology and Digital team at Eversheds Sutherland in South Africa can assess your POPIA compliance health, review your policies and retention schedules, and help you build incident response processes to assist with your regulatory compliance. Please get in touch to discuss how we can support your organisation.
This article is for general information only and does not constitute legal advice.