OASOpen
Architecture
Systems
Back to insights
Industry News

Student Data Under POPIA: Lessons From a R500 000 College Fine

The Information Regulator has fined a public college R500 000 for failing to act on an enforcement notice. What that means for student data at South African schools, colleges and universities.

OAS Editorial Team

· 5 min read

On 26 October 2026 the Information Regulator announced an administrative fine of R500 000 against Central Johannesburg TVET College. The fine, under the Protection of Personal Information Act (POPIA), did not follow a sophisticated attack. It followed a misdirected email, an unregistered Information Officer and an enforcement notice that was not acted on in time.

Schools, colleges and universities hold personal information about learners, applicants, parents, staff and research participants, much of it in the categories POPIA protects most closely. This article sets out what the case records, what the Act asks of an institution's IT function, and the controls that produce the evidence the Regulator asks for. It builds on our article on POPIA enforcement against public bodies and our overview of POPIA compliance in 2026.

What happened at the college

The Regulator issued an enforcement notice on 22 May 2026 after three data subjects complained that their personal information had been shared with third parties without legal justification. Reporting on the notice records that the information was in verification reports on employees' qualifications and criminal records, which were emailed to staff by mistake in September 2022 as part of a folder of finance policies.

The Regulator found that the college had not registered an Information Officer or deputy, had no system for separating sensitive records from ordinary ones, and had neither reported the compromise nor notified the people affected, as section 22 requires. The notice gave the college 31 days to register its Information Officer, apologise to the complainants and submit a POPIA compliance framework, 60 days to take disciplinary action and 90 days to train its staff.

The Regulator's statement says the college did not report the security compromise in the prescribed manner, did not develop the compliance framework, delayed the apology and missed the stipulated timeframes. The fine followed.

What POPIA asks of an institution's IT function

Section 19 requires a responsible party to secure the integrity and confidentiality of personal information. The Regulator's own guidance breaks this into four duties: identify reasonably foreseeable internal and external risks, establish and maintain appropriate safeguards, regularly verify that they are effectively implemented, and update them as new risks appear.

Section 22 requires notification of the Regulator and the affected data subjects as soon as reasonably possible after there are reasonable grounds to believe personal information has been accessed by an unauthorised person.

Two further sections matter more in education than in most sectors.

  • Special personal information (section 26). Race, health, biometric data and criminal behaviour are among the categories whose processing is prohibited unless an exception applies. Institutions hold all four: race for reporting, health for medical and disability support, biometrics for access control, and criminal record checks for staff. The Regulator's guidance note expects the section 19 safeguards to be applied to this information specifically.
  • Children's personal information (sections 34 and 35). A child is a person under 18 who is not legally competent to act for themselves. Processing is prohibited except in listed cases, the most common being the prior consent of a competent person, usually a parent or guardian, or an obligation in law. The Regulator may attach conditions, such as letting a competent person refuse further processing. For a school, this covers almost every learner record.

The threat on campus

Microsoft's Cyber Signals report on education places the sector third among the industries its threat intelligence sees targeted. It reports more than 15 000 messages a day carrying malicious QR codes aimed at education, and an average of 2 507 attack attempts a week against a university. It notes that personal and multi-user devices on campus are often unmanaged, giving attackers a route into institutional accounts.

Those conditions are familiar at South African institutions: open networks, transient users, shared lab machines and devices that move between campus and home. Our education page describes how we approach that environment.

Controls that leave evidence

The college case turned on process as much as technology. The controls below answer both.

  • Register the Information Officer and deputy. It is the first item on the Regulator's list and the cheapest to fix.
  • Separate sensitive records. Keep verification reports, medical and disability records, biometric templates and financial aid data in access-controlled locations, with permissions granted by role.
  • Keep devices managed and patched. N-able N-central reports which devices carry a current endpoint agent and which have missed patches, by campus, faculty or administrative unit. That report is the "regularly verify" duty in practice.
  • Keep sensitive data off endpoints. Delivering administrative and student systems through Citrix virtual apps and desktops means a stolen laptop or a shared lab PC holds a session, not the records.
  • Require multi-factor authentication for staff and students. Microsoft's report puts an account's chance of compromise at more than 99.9 percent lower with MFA in place.
  • Keep an immutable, in-country backup. Cove Data Protection backs up servers, workstations and Microsoft 365 to encrypted storage that ransomware cannot alter, and OAS deploys it with South African storage.
  • Write the notification procedure before the incident. Decide who confirms a compromise, who drafts the notice to the Regulator and who informs learners, parents or students, and rehearse it.

Protect, Detect, Recover for education

Our Three Pillar service maps onto these duties. SentinelOne protects staff workstations, lab machines and library terminals autonomously, including off the campus network. N-able N-central detects unmanaged devices, missing patches and policy drift, and documents that the safeguards are verified. Cove Data Protection recovers systems from immutable backups, so an encrypted estate is restored from a clean copy rather than rebuilt.

The college was fined for not completing steps it had been given months to complete. Start with the Information Officer registration and the separation of sensitive records, because those are the gaps the Regulator has already named, and build the evidence of verification from there.

Sources

Need to show that your institution's safeguards are in place and verified? Talk to OAS about Three Pillar Managed Security for education.

Keep exploring

All insights