On 31 August 2026 the Information Regulator gave an overview of how it has used its POPIA and PAIA powers. BusinessTech’s report the next day lists the largest fines so far: R5 million each against the Department of Justice and the Department of Basic Education, alongside smaller penalties for other bodies.
The detail worth reading is not the size of the fines. In the Justice case, as BusinessTech reports it, the department was fined after a 2021 cyberattack because it did not respond to an enforcement notice within the 31-day window. The Regulator is also reported to be proposing that fines apply immediately, instead of after a compliance window, because it believes the window weakens deterrence.
Our view
For anyone who owns or operates software that holds personal information, three practical points follow.
- Response time is now a control. A 31-day window is short when nobody knows which systems hold what. Knowing your data flows before a notice arrives is what makes a fast response possible.
- Monitoring has to be evidenced. “We have antivirus” is not the same as being able to show what was monitored, when, and what was done about alerts. Logs that cannot be altered after the fact are the engineering answer to that question.
- Breach readiness is part of the design. Notification duties under section 22 are far easier to meet when the system can tell you who was affected and what was exposed, rather than leaving that to be reconstructed afterwards.
None of this requires exotic technology. It requires deciding, at design time, that audit trails, access control and recovery are features and not afterthoughts.