From CompliNEWS | Financial Services Intelligence Watch

Compli-Serve reports that South Africa’s Information Regulator is moving from awareness and guidance towards more active enforcement under both POPIA and PAIA. The numbers help show the scale of the challenge: the Regulator has received more than 8 000 security-compromise notifications since POPIA’s enforcement provisions commenced, including over 1 220 in the current financial year, with the total projected to exceed 3 000 by year-end if the current pace continues. The Regulator has pointed to weak passwords, employee negligence, inadequate security controls and malware or ransomware as common causes. Recent enforcement against the South African Bureau of Standards also shows that being the victim of a cyberattack does not, by itself, excuse poor compliance; the Regulator’s concern was with underlying weaknesses in data handling, consent, security safeguards and transparency.

The Regulator is also looking to strengthen its enforcement toolkit. On the PAIA side, compliance remains weak: only 91 of 257 municipalities had submitted annual reports in the period referenced, while other public-sector categories also showed poor levels of compliance. At the same time, the Regulator has indicated that proposed legislative changes could introduce tougher PAIA enforcement mechanisms and allow for more immediate POPIA fines once non-compliance is established, rather than relying on the current grace-period model. It has also begun proactive monitoring by writing to responsible parties and asking them to demonstrate compliance rather than waiting for complaints. For financial institutions, the direction is clear: POPIA and PAIA should be managed as active governance obligations, supported by tested controls, proper records, incident-response readiness and clear accountability at Information Officer and board level.