Whether the Information Regulator would act against a public body is no longer in question. A national department has been fined, a municipality's fine has been confirmed by a High Court, and a public college has been served with an enforcement notice that names security safeguards and breach notification among its failings.
None of these cases turned on an exotic attack. They turned on routine matters: a licence not renewed, a notice not answered, a compromise not reported. This article sets out what the cases record, what the Protection of Personal Information Act (POPIA) requires of a department's IT function, and the controls that produce the evidence the Regulator asks for. It complements our overview of POPIA compliance in 2026 and our view of government IT modernisation.
Three cases every department should know
Department of Justice and Constitutional Development. The department's systems were encrypted by ransomware on 6 September 2021. In May 2023 the Regulator issued an enforcement notice requiring proof, within 31 days, that the department had renewed its anti-virus, security information and event management (SIEM) and intrusion detection system licences, and had started disciplinary proceedings against the officials responsible. Reporting on the matter records that the licences had expired in 2020 and that no IT risk assessment had been done. The department did not respond in time, and in July 2023 the Regulator issued an infringement notice with a R5 million administrative fine, its first. The department later went to court to challenge both notices.
Blouberg Local Municipality. A staff member's personal information was published on the municipality's website. The municipality did not act on the Regulator's enforcement notice in time, and the Regulator imposed a R500 000 fine. When that too went unanswered, the Regulator applied to the Polokwane High Court under section 109(5) of POPIA to make the fine a court order. In early April 2026 the court granted the order but reduced the fine to R250 000, noting that one data subject was affected, that the information had been removed and that it was a first contravention.
Central Johannesburg TVET College. On 22 May 2026 the Regulator issued an enforcement notice after special personal information about three complainants, including criminal charges and convictions, was shared internally without a lawful basis. The findings included inadequate security safeguards and a failure to notify the Regulator and the affected individuals of the compromise, as section 22 requires.
The pattern is clear. The Regulator escalates when a public body ignores it, and the courts have turned its fines into orders.
What POPIA requires of a department's IT function
Two sections carry most of the weight for IT teams.
Section 19 requires a responsible party to secure the integrity and confidentiality of personal information. The Regulator's enforcement notices break this into four duties: identify all reasonably foreseeable internal and external risks; establish and maintain appropriate safeguards against them; regularly verify that the safeguards are effectively implemented; and update them in response to new risks or deficiencies.
Section 22 requires notification of the Regulator and, unless their identity cannot be established, the affected data subjects where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. The notice must go out as soon as reasonably possible after discovery, allowing only for law-enforcement needs and the steps needed to determine the scope and restore the system.
Neither section names a product. Both ask a department to demonstrate that risks were assessed, that controls were in place and working, and that a compromise was detected and reported in good time. In the Justice case, expired licences and a missing risk assessment were enough to fail that test.
Turn the duties into controls that leave evidence
The Minimum Information Security Standards (MISS) already oblige departments to run IT security controls. POPIA adds the duty to show they were working.
- Keep a licence and renewal register. Record every security product, its renewal date, the budget line and the accountable official, and review it monthly. An unmonitored lapse is how a department loses its SIEM, intrusion detection and endpoint protection at once.
- Verify the safeguards, do not assume them. Monitoring through N-able N-central reports which devices have a current endpoint agent, which are patched and which have fallen out of policy. That report is the "regularly verify" duty in practice.
- Retain logs centrally. A Splunk SIEM aggregates events from endpoints, identity systems and servers, so "when was the information accessed, and from where" can be answered in hours rather than weeks. Those timelines are what section 22 notifications need.
- Keep an immutable, in-country backup. Cove Data Protection encrypts backup data with AES 256-bit encryption in transit and at rest, and lets the storage location be chosen by country. OAS deploys it with South African storage, so the backups stay inside the jurisdiction MISS and the Cabinet directives on data localisation require.
- Write the notification procedure before the incident. Decide now who confirms a compromise, who drafts the notice to the Regulator, who informs data subjects and through which channel. Rehearse it during the annual disaster-recovery test.
Protect, Detect, Recover as a compliance framework
Our Three Pillar service maps onto the two sections above. SentinelOne protects endpoints autonomously, including on sites with intermittent connectivity. N-able N-central detects drift, missing patches and unmanaged devices, and documents that the safeguards are verified. Cove Data Protection recovers systems from immutable backups, so an encrypted estate can be restored from a clean copy rather than rebuilt.
The service is co-managed: your team retains operational control and the records, OAS runs the stack, and skills transfer is part of every engagement. The government page describes how that model fits classified, air-gapped and SITA-contracted environments.
Start with the licence register and the risk assessment, because those are the two gaps the Regulator has already fined. The Regulator describes compliance as a continual requirement, and its enforcement record now shows what that means for public bodies.
Sources
- SAnews: Information Regulator fines Justice Department, dated 4 July 2023 and accessed 5 November 2026.
- TechCentral: Justice department takes Information Regulator to court over R5-million fine, dated 9 October 2023 and accessed 5 November 2026.
- Information Regulator: Information Regulator turns to the courts to fine Blouberg Local Municipality for contravention of POPIA, dated 29 April 2026 and accessed 5 November 2026.
- Information Regulator: Enforcement notices for the contraventions of POPIA and PAIA by public and private bodies, dated 2 June 2026 and accessed 5 November 2026.
- Information Regulator: Enforcement notice to Dis-Chem Pharmacies Limited, dated 31 August 2023 and accessed 5 November 2026, for the Regulator's reading of sections 19 and 22.
- N-able: Cove Data Protection worldwide data centres, accessed 5 November 2026.
Need to show that your department's safeguards are in place and verified? Talk to OAS about Three Pillar Managed Security for government.