Information Regulator ZA: POPIA Enforcement Grace Period Loophole Delays Fines

• The Information Regulator has issued R5 million fines to government departments, signaling a tougher stance on POPIA compliance.
• A key challenge for the Regulator is a grace period allowing entities to comply or challenge enforcement notices before fines are imposed.
• Advocate Pansy Tlakula, chair of the Regulator, indicates plans to amend POPIA to eliminate this grace period.
• Over 8,000 data breaches have been reported since POPIA's enforcement powers began in 2021, with projections for 3,000 in the current financial year alone.
• The Regulator attributes the rise in reported breaches to both easier electronic reporting and an actual increase in incidents, alongside concerns about inadequate security investments.

The Information Regulator is actively pursuing amendments to POPIA to eliminate this problematic grace period.

The Information Regulator of South Africa has intensified its enforcement efforts under the Protection of Personal Information Act (POPIA), signaling a more robust approach to data privacy compliance. This shift is evident in the recent imposition of R5 million fines against both the Department of Justice and the Department of Basic Education. Concurrently, the Regulator has voiced significant concern over what it describes as an alarming increase in data breaches across the country, even as some major penalties continue to be contested in court, such as the R5 million fine against the Department of Justice, while the R5 million fine against the Department of Basic Education was set aside by the High Court in December 2025.

Advocate Pansy Tlakula, who chairs the Information Regulator, asserts that POPIA has always possessed the necessary legal authority for enforcement. However, she identifies a critical challenge: the legislation's provision of a grace period. This period allows both private and public bodies that have violated the Act an opportunity to comply with an enforcement notice before any financial penalties are finalized. Fines are only imposed if these entities fail to comply or choose to challenge the Regulator's enforcement notice through legal channels.

This built-in delay mechanism is viewed as a significant impediment by the Regulator. Advocate Tlakula highlights that, unlike international counterparts who typically levy immediate fines upon discovering an infringement, South Africa's system permits a protracted process. This grace period, therefore, represents a key POPIA enforcement challenge, potentially undermining the immediate punitive impact intended by the legislation and allowing non-compliant organizations to prolong their adherence to data protection standards.

The existence of this grace period is a primary concern for the Information Regulator, as it can lead to delays in achieving compliance and allows entities to challenge directives in court, effectively postponing the imposition of fines. While acknowledging that challenging an enforcement notice is a legal right, Advocate Tlakula confirms that the Regulator is actively pursuing amendments to POPIA to eliminate this problematic grace period. The aim is to enable the immediate imposition of fines once a violation is confirmed, aligning South Africa's enforcement posture more closely with global standards.

Illustrating the practical implications of this loophole, the South African Police Service (SAPS) serves as a notable example. Following an investigation, the SAPS was found to have violated POPIA, received an enforcement notice, and subsequently complied fully. However, within a year, the same entity committed another POPIA violation, replicating the previous infringement. This pattern of compliance followed by a repeat offense underscores the Regulator's strong conviction that the grace period needs to be removed to ensure more consistent and effective adherence to the Act.

POPIA's enforcement powers officially came into effect in 2021, yet the ongoing challenges posed by the grace period continue to impact the Regulator's ability to enforce penalties swiftly and decisively. The proposed POPIA amendments grace period removal is seen as crucial for strengthening the Act's deterrent effect and ensuring that organizations prioritize data protection proactively, rather than reacting only after an enforcement notice has been issued.

Beyond the enforcement challenges, South Africa is grappling with a significant increase in data breaches. Since the enforcement powers of the Protection of Personal Information Act became active in 2021, the Information Regulator has received reports of over 8,000 data breaches. The current financial year, which began just five months ago, has already seen almost 1,700 reports, with projections indicating that this number could reach 3,000 by the year's end.

Advocate Tlakula attributes this surge in data breach reporting ZA to a combination of factors. Firstly, the Regulator has streamlined the notification process by making it electronic, thereby simplifying how public and private bodies report incidents. Secondly, there is an undeniable actual increase in the number of data breaches occurring within the country. This dual trend highlights both improved reporting mechanisms and a deteriorating data security landscape.

A key concern for the Regulator is the perceived lack of sufficient resource investment, particularly by government bodies, in robust security measures to protect personal information. While acknowledging the increasing sophistication of hackers, as evidenced by incidents even affecting entities with advanced security like Standard Bank in the private sector, the Regulator emphasizes the need for all organizations to prioritize and adequately fund their data protection infrastructure. This proactive approach is deemed essential to mitigate the growing threat of cyberattacks and safeguard sensitive personal data.

Lawyers and compliance officers should advise clients to anticipate potential POPIA amendments that could eliminate the grace period for compliance, leading to immediate fines for violations. The Information Regulator's increased enforcement and focus on data breaches necessitate a proactive review of data security measures and incident response protocols.

Source: Original reporting via Moneyweb