South AfricaProtection of Personal Information Act, the Information Regulator, enforcement and penalties
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Expect the Information Regulator to investigate a complaint that you have interfered with the protection of personal information, including by entering and searching your premises under a warrant where a judge or magistrate is satisfied there are reasonable grounds.
- Comply with an enforcement notice the Regulator serves requiring you to take, or stop taking, specified steps, or appeal it to the High Court within 30 days.
- Expect a data subject, or the Regulator at the data subject's request, to be able to bring a civil damages claim against you for breach of any provision of the Act, regardless of intent or negligence.
- Expect prosecution and a fine or imprisonment of up to ten years for the most serious offences, such as unlawfully selling a data subject's account number, and up to twelve months for lesser offences such as breaching confidentiality.
- Expect an administrative fine of up to R10 million by infringement notice, which the Regulator sets after considering the nature of the information involved, the number of data subjects affected, and whether you could have prevented the contravention.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A conviction under sections 100, 103(1), 104(2), 105(1) or 106(1), (3) or (4) carries a fine or imprisonment of up to ten years, or both; a conviction under sections 59, 101, 102, 103(2) or 104(1) carries a fine or imprisonment of up to twelve months, or both (s. 107).
Penalty structure
Administrative fine cap the Information Regulator may impose by infringement notice under section 109(2)(c). A separate criminal conviction under section 107 carries a fine at the convicting court's discretion, or imprisonment of up to ten years, rather than a further fixed monetary cap.
- Rule
- Fixed only
- As of
- Currency
- ZAR
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Information Regulator of South Africa
Settledness
- As of
- Open questions
- Does a damages action under section 99(1) reach a breach of a provision of the Act that section 73 does not list as interference with the protection of personal information?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Regulator's enforcement chapter lets it assess whether processing complies (section 89) and serve an information notice requiring a report on compliance or other specified information (section 90). That is a general power to demand information. No provision in the row asks a responsible party to keep a log or record, so the answer is that no record duty is imposed, with the Regulator's demand power as the audit expectation. The report a responsible party furnishes under a notice goes to the Regulator when served.
- Kind
- None
- As of
What this law does
Section 39 establishes the Information Regulator as an independent juristic person with jurisdiction throughout the Republic. The Regulator's establishment under Chapter 5 Part A commenced ahead of most of the Act, since Proclamation R21 of 2020 appointed for sections 2 to 38 and sections 55 to 109, a list that leaves out sections 39 to 54.
Section 73 defines interference with the protection of personal information as any breach of the Chapter 3 conditions, non-compliance with sections 22, 54, 69, 70, 71 or 72, or a breach of a code of conduct, and sections 74 to 94 let any person complain to the Regulator, which may conciliate, investigate, refer a matter to its Enforcement Committee, and, under sections 81 to 88, obtain a warrant to enter, search and seize evidence from a responsible party's premises.
Section 95 lets the Regulator serve an enforcement notice requiring a responsible party to take, or stop taking, specified steps, appealable to the High Court within 30 days under section 97, and section 99 lets a data subject, or the Regulator at the data subject's request, bring a civil action for damages against a responsible party for breach of any provision of the Act, regardless of intent or negligence.
Sections 100 to 106 create offences for obstructing the Regulator, breaching confidentiality, failing to comply with an enforcement or information notice, and unlawfully dealing in a data subject's account number; section 107 sets the penalties at up to ten years' imprisonment or a fine, or both, for the most serious of these, and up to twelve months for the rest, and section 109 lets the Regulator impose an administrative fine of up to R10 million by infringement notice, considering factors including the number of data subjects affected and whether the responsible party could have prevented the contravention.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .