Ninety days and counting.

The Information Regulator has given a national public entity 90 days to prove it complies with POPIA. Boards of public entities and non-profit organisations should treat that notice as if it were addressed to them, because the next one may be.

On 31 August 2026, at a media briefing on its enforcement work under the Protection of Personal Information Act 4 of 2013 and the Promotion of Access to Information Act 2 of 2000, the Information Regulator disclosed an enforcement notice it had issued against the South African Bureau of Standards. The notice followed an own-initiated assessment after the 2024 ransomware attack that encrypted SABS information systems and disrupted its operations.

The Regulator did not find that SABS was at fault for being attacked. Having assessed the circumstances of the security compromise, it looked wider, and found that SABS had processed excessive or irrelevant information, relied on inadequate consent mechanisms, kept insufficient security safeguards, failed to address known vulnerabilities, lacked incident-response plans, and had not informed data subjects how their information was collected. SABS was directed to revise its policies, conduct personal information impact assessments and implement adequate protective measures within 90 days of receiving the notice.

The Regulator was explicit on the point that matters most: it acted not because SABS had been the victim of a cyberattack, but because of the compliance failures the assessment uncovered beneath it.

At the same briefing the Regulator confirmed that it is investigating or assessing matters involving the National Credit Regulator, Truecaller, Pick n Pay, the Gauteng Department of e-Government, Land Bank and Standard Bank. No findings have been made in any of those matters. They are, for present purposes, simply evidence that the Regulator is looking, and that it does not confine its attention to one sector.

Every board of a public entity or non-profit organisation should read the SABS notice as if it were addressed to them.

What an enforcement notice is

Section 95 of POPIA allows the Regulator, after an investigation or assessment, to serve an enforcement notice on a responsible party. The notice sets out the steps the organisation must take, or the processing it must stop, and the period within which it must do so. It may be taken on appeal to the High Court under section 97.

Failing to comply with an enforcement notice is an offence in terms of section 103(1). On conviction, section 107 provides for a fine or imprisonment for a period not exceeding ten years, or both. The Regulator may instead serve an infringement notice imposing an administrative fine, which section 109 caps at R10 million. An enforcement notice is not an invitation to comment. It is a direction with a clock attached.

What the 90-day clock means

Ninety days sounds generous. In practice it is thirteen working weeks, and it runs from receipt of the notice, not from the board meeting at which the notice is first discussed. Organisations that receive one commonly lose the first month deciding who owns the problem. By the time a project lead is named, perhaps sixty days remain in which to assess, remediate and, the part most often missed, produce evidence the Regulator will accept.

The clock does not pause for board cycles, for procurement, or for leave. A board that hears of a notice at its next quarterly meeting has already spent a third of the period.

Why a policy document is not compliance

The most common response to a regulator is to commission a policy. A policy is necessary; it is not compliance. What the Regulator asks for is proof that processing actually conforms to the Act, and in our experience that proof takes three forms.

First, an evidence register: for each processing activity, the lawful basis, the retention rule, the security control, and the document that shows it operating. Second, a corrective-action log: each gap, its owner, the deadline, the fix, and the date on which the fix was verified. Third, board oversight: minutes showing that the board approved the framework, received reports against it, and asked questions.

The eight conditions, in plain language

POPIA rests on eight conditions for the lawful processing of personal information, set out in sections 8 to 25. Board members do not need the section numbers, but they should recognise the questions.

• Accountability. Someone identifiable is answerable for compliance, and the organisation can show it.
• Processing limitation. You collect only what you need, lawfully, and where consent is relied upon it is real and recorded.
• Purpose specification. You collect for a stated purpose, and do not keep information longer than that purpose requires.
• Further processing limitation. You do not quietly use information for something new that the person would not expect.
• Information quality. What you hold is accurate, complete and kept up to date.
• Openness. People know what you collect and why, and the Regulator knows who your Information Officer is.
• Security safeguards. You have reasonable technical and organisational measures, you hold your operators to the same standard, and you notify the Regulator and the affected people when something goes wrong.
• Data subject participation. People can establish what you hold about them, and have it corrected or deleted.

The SABS findings fall under the second, sixth and seventh conditions. None of them is exotic. They are the conditions most organisations assume they meet, and few can evidence.

Five things a board should ask this month

1. Who is our registered Information Officer, and when did this board last receive a written report from them?
2. Do we have a register of what personal information we process, why, and on what lawful basis, and when was it last updated?
3. Which operators process personal information on our behalf, and do our contracts with them contain the terms section 21 requires?
4. If we were breached tomorrow, who would notify the Regulator in terms of section 22, within what period, and from what record of what was compromised?
5. If the Regulator served a notice on us today, what evidence could we hand over on day one, not on day sixty?

If the honest answer to any of these is “we would have to find out”, the gap is already visible. The only question is whether the board finds it first, or the Regulator does.

Readiness is cheaper than remediation

The pattern in the Regulator’s enforcement record is consistent, and it is worth stating plainly. The administrative fines imposed to date (R5 million each against the Department of Justice and Constitutional Development and the Department of Basic Education) followed failures to comply with an enforcement notice, rather than the underlying incidents. Both were taken on litigation, and the Department of Justice matter remains before the courts. The expensive step is rarely the incident. It is the notice that follows it, and what the organisation cannot produce in answer.

Enforcement-readiness costs a fraction of remediation under a deadline, and a fraction again of the reputational cost of a published notice.

About the author. Mthokozisi Brian Mhlongo is director of MBM Valkyrie Advisory (Pty) Ltd, an independent legal, governance and compliance consultancy in Pretoria. He is an admitted attorney (non-practising) with regulator-side experience, advising councils, public entities, non-profit organisations and funded companies on fixed fees.

This article is general commentary and does not constitute legal advice. MBM Valkyrie Advisory (Pty) Ltd is a consultancy and not a law firm. No professional relationship arises from reading it.