The two most recent POPIA enforcement actions announced by the Information Regulator involved no ransomware, no nation-state attacker and no zero-day exploit. One concerned a staff member’s personal information published on a municipal website. The other concerned criminal-record information shared inside a college without legal justification, and the college’s failure to report it. For South African organisations that equate POPIA risk with cyber attacks, both cases are a correction: the Regulator is enforcing the ordinary, internal controls that sit underneath every security programme.
What happened in the Blouberg case?
On 29 April 2026 the Information Regulator announced that the Polokwane High Court had, in early April, confirmed an administrative fine against Blouberg Local Municipality. The facts, as set out in the Regulator’s statement, are straightforward:
- Personal information relating to a member of staff was made available on the municipality’s website.
- After investigating a complaint, the Regulator issued an enforcement notice and later an infringement notice. The municipality did not comply with either within the stipulated timeframes.
- The Regulator sought court confirmation under section 109(5) of POPIA, which allows an administrative fine to be made an order of court.
- The fine imposed by the Regulator was R500,000. The judge considered it excessive and set it at R250,000, citing three factors: one data subject was affected, the municipality had removed the information, and it was a first contravention.
The Regulator noted that removing the information did not end the matter, and that enforcement was needed “to underscore the importance of compliance and to deter future contraventions”. It encouraged institutions to improve “internal controls, publication procedures, and continuous compliance monitoring”.
What did the Regulator find against Central Johannesburg TVET College?
On 2 June 2026 the Regulator announced an enforcement notice, dated 22 May 2026, against Central Johannesburg TVET College. It followed complaints from three individuals whose special personal information, information that POPIA protects more strictly such as health data or criminal records, was shared with third parties within the institution without legal justification. The information, originally disclosed for governance and employee vetting, included qualifications and criminal charges and convictions.
The Regulator found that the college had failed to:
- implement adequate accountability measures;
- avoid unlawful further processing and sharing of personal information;
- maintain appropriate security safeguards; and
- notify both the Regulator and the affected individuals of the security compromise, as section 22 requires.
The college was directed to take corrective actions within specified timeframes. The Regulator reminded all bodies that failing to comply with an enforcement notice is an offence that may lead to a fine, imprisonment, or both.
Why does an internal disclosure count as a security compromise?
Section 22 of POPIA applies where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Nothing in that wording requires the person to be outside the organisation. An employee with no business reason to see vetting records is unauthorised in respect of those records.
This is where many incident response plans fall short. They are written around external attacks: malware, phishing, a stolen laptop. They rarely define a misdirected email, an over-shared folder or an internal disclosure of HR records as an incident that triggers assessment and, potentially, notification. When nobody classifies the event as a compromise, nobody notifies, and the failure to notify becomes a finding in its own right.
What do these cases say about security safeguards?
Section 19 requires a responsible party to secure personal information through “appropriate, reasonable technical and organisational measures”. Both cases show what that means in practice.
Access control is a safeguard. Need-to-know access means each person can reach only the information their role requires. Vetting and disciplinary records should sit in a restricted repository, with access logged and periodically reviewed. In many mid-market firms they sit in a general HR share that half the management team can open.
Publication control is a safeguard. Documents published to a website, a client portal or a tender platform need a review step that checks for personal information, including in attachments, embedded tables and file metadata. A website is an external system, and what is uploaded to it is disclosed.
Responsiveness is a safeguard. Blouberg’s position worsened because it did not comply with the Regulator’s notices in time. An organisation that answers promptly and evidences corrective action is in a far stronger position than one that does neither.
What to do this quarter
- Widen your incident definition. Make sure internal unauthorised access, misdirected communications and accidental publication are classified as potential section 22 events.
- Review who can see special personal information. Run an access review of HR, vetting, medical and disciplinary records, and remove access that has no current business reason.
- Add a pre-publication check for websites, portals and public filings, covering attachments and metadata.
- Name a decision-maker for notification who can assess an event and decide within days, not weeks.
- Confirm eServices access. The Regulator has accepted security compromise notifications only through its eServices portal since 1 April 2025.
- Prepare to respond to the Regulator. Agree who answers correspondence from the Regulator and how quickly, and keep evidence of corrective action.
- Test the process with a tabletop exercise built around an internal disclosure rather than an external attack.
Frequently asked questions
Is an internal disclosure of personal information a security compromise under POPIA?
It can be. Section 22 applies when personal information is accessed or acquired by an unauthorised person, and that person can be an employee. The Central Johannesburg TVET College notice included a finding that the college failed to notify after an internal disclosure.
Can Information Regulator fines be enforced in court?
Yes. Section 109(5) of POPIA allows an unpaid administrative fine to be made an order of court. The Polokwane High Court did so for Blouberg Local Municipality in early April 2026, reducing the fine from R500,000 to R250,000.
What counts as special personal information?
Section 26 of POPIA includes religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information and criminal behaviour relating to alleged offences or proceedings. Processing it is prohibited unless a specific authorisation applies.
What is the maximum POPIA administrative fine?
Up to R10 million under section 109. Separately, failing to comply with an enforcement notice is a criminal offence.
How Rhentech can help
A cybersecurity audit from Rhentech tests the controls these cases turned on: access to sensitive records, publication procedures and the evidence trail a Regulator will ask for. Our incident response planning builds section 22 assessment into the first hours of any event, including internal ones. For the wider POPIA baseline, see our POPIA compliance guide.
To discuss where your organisation stands, book a free initial consultation. The consultation costs nothing; audits and response planning are paid engagements scoped to your organisation.
Sources
- Information Regulator, media statement on the Blouberg Local Municipality fine, 29 April 2026.
- Information Regulator, media statement on enforcement notices against Central Johannesburg TVET College and Sibanye Stillwater Limited, 2 June 2026.
- Protection of Personal Information Act 4 of 2013, sections 19, 22, 26 and 109.
This article is for informational purposes. It does not constitute legal advice. Consult qualified legal counsel for compliance matters specific to your organisation.
Reviewed 20 October 2026.