Key takeaways
- The Information Regulator issued its first administrative fine of R5 million in July 2023, and enforcement has widened since.
- That fine was not for the breach itself. It was for expired security licences and then failing to comply with the enforcement notice.
- Breach notifications have passed two thousand in a year, up roughly forty percent.
- POPIA section 19 requires appropriate, reasonable technical and organisational measures, but does not define what those are.
- ISO 27001 is the recognised way to evidence that you determined, implemented and reviewed those measures.
- Certification is not a legal requirement under POPIA. It is the difference between asserting you were reasonable and demonstrating it.
For most of the time POPIA has been law, South African businesses have treated it as a paperwork exercise. A privacy policy on the website, a consent checkbox on the contact form, an information officer registered because somebody said it was required.
That period is over. The Information Regulator has moved into active enforcement, and the most instructive thing about its first fine is not the amount. It is what the fine was actually for.
The first R5 million fine, and why it matters
On 3 July 2023, the Information Regulator imposed a R5 million administrative fine on the Department of Justice and Constitutional Development. It was the first such fine issued under POPIA.
The background was a cyber attack in 2021 in which more than 1,200 files were lost and personal information was compromised. But the Regulator did not fine the department for being attacked. It issued an enforcement notice first, requiring proof within 31 days that three specific security licences had been renewed: antivirus, security information and event management, and intrusion detection. It also required disciplinary steps against the officials who had let them lapse.
The fine came when no proof was provided.
Read that sequence again, because it is the whole lesson. Expired software licences on core security controls. Then a failure to demonstrate they had been fixed. Neither of those is a sophisticated attack or an exotic vulnerability. Both are ordinary operational discipline, and both are exactly what a management system exists to catch.
Enforcement has widened since. In April 2025 the Regulator made public an enforcement notice against WhatsApp, finding that it applied weaker privacy terms to South African users than to users in Europe. Breach notifications have passed two thousand in a year, up roughly forty percent. Fines reach R10 million for a serious contravention.
The gap POPIA deliberately leaves
Section 19 of POPIA requires that a responsible party secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures.
It does not say what those are. That is deliberate, and sensible, because what is reasonable for a five-person practice is not what is reasonable for a bank. But it leaves every business with the same problem: you have a legal obligation whose content you must determine yourself, and which you may one day have to defend.
There are two ways to be in that position. You can assert that your measures were appropriate and reasonable. Or you can demonstrate the process by which you determined them, implemented them, monitored them and corrected them when they slipped.
ISO 27001 is that second thing. It is not a legal requirement, and no South African law names it. It is the internationally recognised way of evidencing exactly the judgement that section 19 asks you to have made.
How POPIA's conditions map onto ISO 27001
POPIA sets eight conditions for lawful processing. An information security management system does not satisfy all of them, because several are legal and procedural rather than technical. But the overlap is substantial, and it is worth seeing plainly.
| POPIA condition | What it requires | Where ISO 27001 carries it |
|---|---|---|
| 1. Accountability | The responsible party must ensure the conditions are given effect | Clause 5 leadership, defined roles and responsibilities, A.5.1 information security policies |
| 2. Processing limitation | Lawful, minimal, justified processing | Partial. A.5.9 asset inventory and A.5.12 classification tell you what you hold and why |
| 3. Purpose specification | Collected for a defined purpose, retained no longer than needed | Partial. Retention and disposal controls, A.5.34 privacy and protection of PII |
| 4. Further processing limitation | Compatible use only | Mostly legal, supported by classification and access control |
| 5. Information quality | Complete, accurate, current | Integrity controls, change management |
| 6. Openness | Documented processing, notice to data subjects | Documented information under clause 7.5 |
| 7. Security safeguards ⭐ | Appropriate, reasonable technical and organisational measures; breach notification | The core of the standard. Risk assessment under clause 6.1, A.8.7 malware protection, A.8.8 technical vulnerabilities, A.8.16 monitoring, A.5.19 to A.5.23 supplier and cloud services, A.5.24 to A.5.28 incident management |
| 8. Data subject participation | Access, correction, deletion on request | Access control and asset inventory make it answerable in practice |
Condition seven is where an information security management system does the heavy lifting, and it is the condition the Department of Justice fine turned on. Renewing a licence is a supplier and asset management control. Knowing it had expired is a monitoring control. Acting when it was flagged is corrective action. All three are ordinary parts of a working ISMS, and all three are trivial once the system exists and painful when it does not.
Breach notification is where most businesses find out
POPIA requires notification to the Regulator and, in most cases, to affected data subjects when there are reasonable grounds to believe personal information has been accessed by an unauthorised person.
The obligation is not the hard part. The hard part is the questions it forces you to answer under time pressure: what exactly was accessed, whose information was in it, when it happened, whether it is still happening, and who needs to be told. A business that has never built an asset inventory or classified its information cannot answer any of those quickly, and the delay itself becomes part of the record.
This is the practical case for doing the work in advance. Not because a certificate protects you from an incident, but because the incident is not the moment to discover you do not know what you hold.
Where this is heading for South African businesses
Two things are converging. Enforcement is real and expanding, and it now has a track record rather than a theoretical maximum. And private due diligence is tightening: large customers, particularly those with European or multinational parents, increasingly ask suppliers to demonstrate information security rather than assert it.
Most South African businesses will meet the second before the first. A tender or a supplier questionnaire will ask whether you are certified, and a plausible written answer will stop being enough.
The businesses that handle this comfortably are not necessarily the most technically sophisticated. They are the ones that know what information they hold, who is accountable for it, and what they would do in the first four hours of an incident.
A sensible starting point
If you have nothing formal in place, do not begin with controls. Begin with an inventory. What personal information do you hold, where does it physically and logically live, who can reach it, who do you share it with, and how long do you keep it?
That single exercise usually surfaces more risk than any technical assessment, because it finds the copies nobody remembered: the spreadsheet on a laptop, the shared mailbox, the third-party tool a department signed up for without telling anyone. It is also, not coincidentally, where ISO 27001 starts.
If you would like a considered view of where your business stands against POPIA's security condition, or whether ISO 27001 certification is warranted for your situation, contact us. We work on the accredited-certification route with businesses across South African industry, and the honest answer is sometimes that a documented internal position is enough for now.