R10 million fine and 10 years in jail

Those found guilty of contravening the Protection of Personal Information Act (Popia) can face a fine of up to R10 million, serve prison time for up to 10 years, or both.

This is for more serious offences, while those who have committed less serious offences could face up to 12 months in prison, a fine, or both.

South Africa’s Information Regulator (IR), formed to ensure Popia compliance, lays out eight conditions for processing personal information that companies must adhere to.

These include accountability, processing limitation, purpose-specific, further processing limitation, information quality, openness, security safeguards, and data subject participation.

However, John Giles, a data and tech attorney at Michalsons Attorneys, says that the name of the piece of legislation creates the wrong impression about its intended purpose.

He said although the law aims to protect personal information, it regulates the processing of this data, not necessarily how it is gathered.

Therefore, the illegal processing of gathered personal information could result in these punishments.

Entities processing personal information would need to contravene sections 100, 103(1), 104(2), 105(1), 106(1), (3), or (4) for an offence to be deemed severe, according to the Act.

Section 100 refers to any individual who unlawfully influences the Information Regulator in any way by hindering or obstructing its duties.

Section 103(1) notes that any party not complying with an enforcement notice the IR serves is guilty of an offence.

At the end of 2024, the regulator fined the Department of Basic Education R5 million for failing to comply with an enforcement notice ordering it not to publish matric results in newspapers.

Upon issuing the notice, the Information Regulator warned the department that if it failed to comply, it would face a fine of up to R10 million or the “imprisonment of the responsible officials.”

Any offences made by witnesses 104(2), such as lying under oath, unlawful acts committed by a responsible party involving account numbers concerning personal information 105(1), or the disclosure of a subject’s personal data to a third party 106(1), are all serious offences.

If anyone is found to sell data or offer to sell the account number of a data subject obtained in contravention of 106(1), these will also be treated as serious offences.

Less serious offences, such as those contravening section 59, 101, 102, 103(2), or 104(1), will be liable to a fine, up to 12 months in prison, or both.

These offences include not notifying the IR about processing personal information for purposes other than those intended upon acquisition and disclosing personal information after having worked on behalf of or under the IR.

Failing to provide evidence without sufficient cause when summoned also falls into this category of offences.

One of the most common instances of companies failing to abide by Popia involves using personal information for direct marketing.

However, this wasn’t always clear. The Information Regulator only issued a guidance note regarding direct marketing in 2024. Shortly after that, it began cracking down on the industry.

According to IR advocate Lebogang Stroom, the Act states that telemarketers are only allowed to contact an individual once, during which the marketer should ask for consent to contact them again.

If consent is not provided, marketers may not contact the individual again, which Stroom says companies fail to do.

“The problem is that company A will call you on a particular number, and they will stop when they are told to stop communications,” Stroom continued.

“However, the next time the same marketers make contact, they will use a different number to bombard you with marketing.”

Stroom said this is wrong and against the objectives of POPIA.

To mitigate this, the Information Regulator encourages people to report businesses contravening the Act.

This can be done by completing and submitting a form on its website.