{"id":3892,"date":"2026-06-08T08:02:39","date_gmt":"2026-06-08T08:02:39","guid":{"rendered":"https:\/\/itlawco.com\/?p=3892"},"modified":"2026-06-08T08:02:39","modified_gmt":"2026-06-08T08:02:39","slug":"central-johannesburg-tvet-college-enforcement-notice","status":"publish","type":"post","link":"https:\/\/itlawco.com\/fr\/central-johannesburg-tvet-college-enforcement-notice\/","title":{"rendered":"Central Johannesburg TVET College enforcement notice"},"content":{"rendered":"\n\t\t<div id=\"fws_6a5f87d436f49\"  data-column-margin=\"default\" data-midnight=\"dark\"  class=\"wpb_row vc_row-fluid vc_row\"  style=\"padding-top: 0px; padding-bottom: 0px; \"><div class=\"row-bg-wrap\" data-bg-animation=\"none\" data-bg-animation-delay=\"\" data-bg-overlay=\"false\"><div class=\"inner-wrap row-bg-layer\" ><div class=\"row-bg viewport-desktop\"  style=\"\"><\/div><\/div><\/div><div class=\"row_col_wrap_12 col span_12 dark left\">\n\t<div  class=\"vc_col-sm-12 wpb_column column_container vc_column_container col no-extra-padding inherit_tablet inherit_phone \"  data-padding-pos=\"all\" data-has-bg-color=\"false\" data-bg-color=\"\" data-bg-opacity=\"1\" data-animation=\"\" data-delay=\"0\" >\n\t\t<div class=\"vc_column-inner\" >\n\t\t\t<div class=\"wpb_wrapper\">\n\t\t\t\t\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">In May 2026, the <a href=\"https:\/\/inforegulator.org.za\/\">Information Regulator<\/a> issued a POPIA enforcement notice against the <a href=\"https:\/\/cjc.edu.za\/\">Central Johannesburg TVET College<\/a> after a staff member accidentally emailed colleagues a folder that contained three employees\u2019 credential-verification reports. The striking feature of this particular enforcement notice is not the mistake itself; it is what the mistake exposed. The Regulator\u2019s findings turned on the compliance foundations that were missing long before anyone hit \u201csend\u201d.<\/p>\n<blockquote>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">For any organisation that processes employee or customer data, the notice is a compact lesson in why POPIA compliance is structural, not incidental.<\/p>\n<\/blockquote>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 class=\"text-text-100 mt-3 -mb-1 text-&#091;1.125rem&#093; font-bold\">Key takeaways<\/h2>\n<ul class=\"&#091;li_&amp;&#093;:mb-0 &#091;li_&amp;&#093;:mt-1 &#091;li_&amp;&#093;:gap-1 &#091;&amp;:not(:last-child)_ul&#093;:pb-1 &#091;&amp;:not(:last-child)_ol&#093;:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">A single human error escalated into a multi-front enforcement action because the underlying compliance architecture was absent: no registered Information Officer, no compliance framework, no staff training, and poor separation of sensitive files.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Registering the Information Officer and deputies with the Regulator is a legal duty under section 55. Its absence was treated both as an accountability breach (section 8) and as evidence of inadequate security measures (section 19).<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">\u201cLegitimate purpose\u201d and \u201cpublic interest\u201d are not bases for further processing under section 15. To share personal information for a new purpose, you must fit a lawful basis in section 15(3), such as consent.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">The breach-notification duty in section 22 is independent and unforgiving. Recalling the email, investigating, and apologising internally did not discharge the duty to notify the Regulator and the affected data subjects.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">POPIA\u2019s enforcement teeth are sharper than PAIA\u2019s: non-compliance with the notice is an offence carrying a fine or up to ten years&#8217; imprisonment, and the remedy against the notice is an appeal to the Regulator under section 97, within 30 days.<\/li>\n<\/ul>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 class=\"text-text-100 mt-3 -mb-1 text-&#091;1.125rem&#093; font-bold\">What happened<\/h2>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The college had been placed under administration to restore governance, including verifying employees\u2019 qualifications and requiring declarations of criminal records and conflicts of interest. To do this it collected personal credential-verification reports on staff.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">In the course of rolling out new finance policies, the Acting Chief Financial Officer mistakenly included three employees\u2019 verification reports in a folder of policy documents and emailed it to various staff. The affected employees learned of it on 6 September 2022. The Administrator recalled the email on 8 September, explained that the distribution was an error, and took corrective action against those who had forwarded it.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The three employees complained to the Regulator. After an investigation and an Enforcement Committee report, the Regulator found that the college had interfered with the protection of their personal information, and issued a section 95 enforcement notice.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 class=\"text-text-100 mt-3 -mb-1 text-&#091;1.125rem&#093; font-bold\">What the Regulator found<\/h2>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The notice is useful because it works through several POPIA conditions in turn and records where the Regulator parted ways with its own Enforcement Committee.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">Accountability (Condition 1, section 8)<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The college had neither registered its Information Officer with the Regulator nor designated and registered deputy information officers. Because the Information Officer is responsible for POPIA compliance, the Regulator treated this as a foundational accountability failure.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">Further processing (Condition 4, section 15)<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The verification reports had been collected to strengthen governance. Sharing them with staff who had no role in that exercise was \u201cfurther processing\u201d that was incompatible with the original purpose, and no lawful basis under section 15(3)\u2014including consent\u2014applied.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Notably, the Regulator overruled its Enforcement Committee here. The Committee had concluded there was no section 15(1) breach because the processing served a \u201clegitimate purpose\u201d and was \u201cin the public interest\u201d. The Regulator rejected that reasoning, pointing out that those concepts do not appear in section 15(3) and cannot be read into the compatibility test.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">Security safeguards and breach notification (Condition 7, sections 19 and 22)<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Storing the verification reports in the same folder as finance policies, combined with the unregistered Information Officer, pointed to an absence of the organisational measures section 19 requires. That was a section 19 breach.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Separately, the misdirected email was a security compromise that triggered the section 22 duty to notify both the Regulator and the affected data subjects. None of them was notified. The internal staff email recalling the document did not satisfy that statutory obligation, so the Regulator found a section 22 breach as well.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">What the Regulator did not find<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Two allegations failed, which is equally instructive:<\/p>\n<ol>\n<li class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The Regulator agreed with the Committee that the <em>initial<\/em> collection and verification did not breach the processing-limitation condition (section 11), because the college had a legitimate-interest basis for it.<\/li>\n<li class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">It also found no breach of the prohibition on processing special personal information (section 26<em>(b)<\/em>). The one verification report in evidence contained only a name, identity number, date of birth and contact number, no criminal-record or other special data.<\/li>\n<\/ol>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 class=\"text-text-100 mt-3 -mb-1 text-&#091;1.125rem&#093; font-bold\">The orders<\/h2>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The remedies are far more demanding than a simple \u201cfix it\u201d, and several are public-facing:<\/p>\n<ul>\n<li>Register the Information Officer (section 55(2)) and designate and register deputies, with proof to the Regulator within 31 days.<\/li>\n<li>Notify the Regulator and the affected data subjects of the security compromise under section 22, with proof within 31 days.<\/li>\n<li>Issue a written apology to the complainants, emailed to all employees and published across all the college\u2019s communication channels, with proof within 31 days.<\/li>\n<li>Take disciplinary action against the employee who shared the information, with proof within 60 days.<\/li>\n<li>Submit a POPIA compliance framework\u2014privacy notice, retention policy and schedule, incident-response policy, and information-privacy-and-security policy\u2014within 31 days (or develop one within 120 days if it does not exist).<\/li>\n<li>Conduct POPIA awareness and training for all staff, with proof within 90 days.<\/li>\n<\/ul>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 class=\"text-text-100 mt-3 -mb-1 text-&#091;1.125rem&#093; font-bold\">What this means for your organisation<\/h2>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">For information officers and executives<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Register your Information Officer and deputies with the Regulator now if you have not already. This decision shows the Regulator treating non-registration not as a technicality but as evidence that an organisation lacks the governance to process personal information safely.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">For HR and people functions<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Employee data is a frequent source of POPIA exposure. Verification reports, qualifications, and conduct records are collected for a defined purpose, and circulating them more widely\u2014even internally, even by mistake\u2014can amount to incompatible further processing. Separate sensitive files from general working documents.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">For IT, security and incident response<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">A misdirected internal email is a notifiable security compromise. Build a section 22 response that runs in parallel with any internal remediation: recalling the message and disciplining staff is good practice, but it does not replace notifying the Regulator and the data subjects.<\/p>\n<h3 class=\"text-text-100 mt-2 -mb-1 text-base font-bold\">For compliance and risk leads<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">The orders here\u2014framework, training, public apology\u2014are the components of a programme the college should have had in place beforehand. The cheapest version of this notice is the one you never receive, by standing the framework up in advance.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 class=\"text-text-100 mt-3 -mb-1 text-&#091;1.125rem&#093; font-bold\">Appeal and consequences<\/h2>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">Because this is a POPIA matter, the college&#8217;s remedy is an appeal to the Regulator under section 97(1), within 31 days of receiving the notice \u2014 not the court route that applies to access-to-information decisions under PAIA. Failure to comply with the notice is an offence carrying a fine or imprisonment of up to ten years, or both.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\">It is worth noting the contrast with the access-to-information enforcement notices issued by the same Regulator on the same day. Those run under PAIA, are challenged in court under section 82, and carry a three-year maximum. This POPIA notice underlines the Regulator&#8217;s dual mandate \u2014 and the heavier penalties on the data-protection side.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2>FAQs<\/h2>\n<\/div>\n\n\n\n<div class=\"toggles \" data-br=\"none\" data-starting=\"default\" data-style=\"default\"><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a5f87d43a266\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a5f87d43a266\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Do you have to register your Information Officer with the Information Regulator?<\/a><\/h3><div id=\"toggle-panel-6a5f87d43a266\" role=\"region\" aria-labelledby=\"toggle-button-6a5f87d43a266\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>Yes, registering the Information Officer (and any deputies) is required under section 55 of POPIA. In this matter, the failure to register was treated as both an accountability breach and a sign of inadequate security measures.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a5f87d43a87f\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a5f87d43a87f\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Is an accidental email containing personal information a POPIA breach?<\/a><\/h3><div id=\"toggle-panel-6a5f87d43a87f\" role=\"region\" aria-labelledby=\"toggle-button-6a5f87d43a87f\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>It can be. Sharing personal information beyond its original purpose is \u201cfurther processing\u201d that must have a lawful basis under section 15(3); if it does not, the disclosure breaches POPIA even when it was a mistake. A misdirected email may also be a security compromise that must be reported under section 22.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a5f87d43ae56\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a5f87d43ae56\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>What must an organisation do after a personal information breach in South Africa?<\/a><\/h3><div id=\"toggle-panel-6a5f87d43ae56\" role=\"region\" aria-labelledby=\"toggle-button-6a5f87d43ae56\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, section 22 requires the responsible party to notify both the Regulator and the affected data subjects. Internal corrective steps do not discharge this duty.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a5f87d43b4a4\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a5f87d43b4a4\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Can \u201clegitimate interest\u201d or \u201cpublic interest\u201d justify further processing under POPIA?<\/a><\/h3><div id=\"toggle-panel-6a5f87d43b4a4\" role=\"region\" aria-labelledby=\"toggle-button-6a5f87d43b4a4\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>Not as free-standing grounds for further processing. Section 15(3) sets out the bases on which further processing is compatible with the original purpose; \u201clegitimate purpose\u201d and \u201cpublic interest\u201d are not among them. The Regulator made this point expressly in overruling its Enforcement Committee.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a5f87d43ba7d\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a5f87d43ba7d\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>What are the penalties for ignoring a POPIA enforcement notice?<\/a><\/h3><div id=\"toggle-panel-6a5f87d43ba7d\" role=\"region\" aria-labelledby=\"toggle-button-6a5f87d43ba7d\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>Failure to comply with an enforcement notice is an offence. On conviction it carries a fine or imprisonment of up to ten years, or both.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a5f87d43c04b\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a5f87d43c04b\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>How do you challenge a POPIA enforcement notice?<\/a><\/h3><div id=\"toggle-panel-6a5f87d43c04b\" role=\"region\" aria-labelledby=\"toggle-button-6a5f87d43c04b\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>A responsible party may appeal to the Information Regulator under section 97(1) of POPIA within 30 days of receiving the notice.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><\/div>\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p class=\"font-claude-response-body break-words whitespace-normal leading-&#091;1.7&#093;\"><em>This article is provided for general information and does not constitute legal advice. It discusses a public regulatory decision; no confidential personal information of the data subjects is disclosed. If your organisation needs to register an Information Officer, respond to a personal-information breach, or build a POPIA compliance framework, ITLawCo would be glad to assist. <a href=\"https:\/\/itlawco.com\/contact-us\/\">Contact us<\/a>.<\/em><\/p>\n<\/div>\n\n\n\n\n\t\t\t<\/div> \n\t\t<\/div>\n\t<\/div> \n<\/div><\/div>\n\t\t<div id=\"fws_6a5f87d43ca83\"  data-column-margin=\"default\" data-midnight=\"dark\"  class=\"wpb_row vc_row-fluid vc_row\"  style=\"padding-top: 0px; padding-bottom: 0px; \"><div class=\"row-bg-wrap\" data-bg-animation=\"none\" data-bg-animation-delay=\"\" data-bg-overlay=\"false\"><div class=\"inner-wrap row-bg-layer\" ><div class=\"row-bg viewport-desktop\"  style=\"\"><\/div><\/div><\/div><div class=\"row_col_wrap_12 col span_12 dark left\">\n\t<div  class=\"vc_col-sm-12 wpb_column column_container vc_column_container col no-extra-padding inherit_tablet inherit_phone \"  data-padding-pos=\"all\" data-has-bg-color=\"false\" data-bg-color=\"\" data-bg-opacity=\"1\" data-animation=\"\" data-delay=\"0\" >\n\t\t<div class=\"vc_column-inner\" >\n\t\t\t<div class=\"wpb_wrapper\">\n\t\t\t\t\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<!-- ============================================================\n     GEO STRUCTURED DATA \u2014 Central Johannesburg TVET College\n     POPIA enforcement notice (CI 462-22, CI 491-22, CI 519-22)\n     Paste this entire block into the page <head> (or your CMS's\n     custom-schema \/ header-scripts field).\n     Before publishing, replace the placeholder values:\n       - datePublished \/ dateModified  (ISO 8601, e.g. 2026-06-05)\n       - mainEntityOfPage @id          (the live, canonical URL)\n       - author\/publisher URLs         (confirm)\n     ============================================================ -->\n<script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@graph\": [\n    {\n      \"@type\": \"Article\",\n      \"headline\": \"Central Johannesburg TVET College enforcement notice: how one misdirected email became a POPIA enforcement action\",\n      \"description\": \"A misdirected email led South Africa's Information Regulator to find multiple POPIA breaches by the Central Johannesburg TVET College. What organisations should learn.\",\n      \"datePublished\": \"2026-06-05\",\n      \"dateModified\": \"2026-06-05\",\n      \"inLanguage\": \"en-ZA\",\n      \"author\": {\n        \"@type\": \"Organization\",\n        \"name\": \"ITLawCo\",\n        \"url\": \"https:\/\/itlawco.com\/\"\n      },\n      \"publisher\": {\n        \"@type\": \"Organization\",\n        \"name\": \"ITLawCo\",\n        \"url\": \"https:\/\/itlawco.com\/\"\n      },\n      \"mainEntityOfPage\": {\n        \"@type\": \"WebPage\",\n        \"@id\": \"https:\/\/itlawco.com\/insights\/central-johannesburg-tvet-college-popia-enforcement-notice\"\n      },\n      \"about\": [\"Protection of Personal Information Act\", \"Information Regulator\", \"data protection\", \"personal information breach\", \"regulatory enforcement\"],\n      \"spatialCoverage\": \"South Africa\"\n    },\n    {\n      \"@type\": \"FAQPage\",\n      \"mainEntity\": [\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Do you have to register your Information Officer with the Information Regulator?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Yes. Registering the Information Officer and any deputies is required under section 55 of POPIA. In this matter the failure to register was treated as both an accountability breach and a sign of inadequate security measures.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is an accidental email containing personal information a POPIA breach?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"It can be. Sharing personal information beyond its original purpose is further processing that must have a lawful basis under section 15(3); if it does not, the disclosure breaches POPIA even when it was a mistake. A misdirected email may also be a security compromise that must be notified under section 22.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"What must an organisation do after a personal information breach in South Africa?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, section 22 requires the responsible party to notify both the Regulator and the affected data subjects. Internal corrective steps do not discharge this duty.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Can legitimate interest or public interest justify further processing under POPIA?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Not as free-standing grounds for further processing. Section 15(3) sets out the bases on which further processing is compatible with the original purpose; legitimate purpose and public interest are not among them. The Regulator made this point expressly in overruling its Enforcement Committee.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"What are the penalties for ignoring a POPIA enforcement notice?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Failure to comply with an enforcement notice is an offence. On conviction it carries a fine or imprisonment of up to ten years, or both.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"How do you challenge a POPIA enforcement notice?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"A responsible party may appeal to the Information Regulator under section 97(1) of POPIA within 30 days of receiving the notice.\"\n          }\n        }\n      ]\n    }\n  ]\n}\n<\/script>\n\t\t<\/div>\n\t<\/div>\n\n\t\t\t<\/div> \n\t\t<\/div>\n\t<\/div> \n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"In May 2026, the Information Regulator issued a POPIA enforcement notice against the Central Johannesburg TVET College after a staff member accidentally emailed colleagues a folder that contained three employees\u2019...","protected":false},"author":1,"featured_media":3895,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[15],"tags":[],"class_list":["post-3892","post","type-post","status-publish","format-standard","has-post-thumbnail","category-data-protection-and-privacy"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Central Johannesburg TVET College enforcement notice - ITLawCo<\/title>\n<meta name=\"description\" content=\"Central Johannesburg TVET College enforcement notice: a misdirected email led the Information Regulator to find multiple POPIA breaches. What organisations should learn.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/itlawco.com\/fr\/central-johannesburg-tvet-college-enforcement-notice\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Central Johannesburg TVET College enforcement notice - ITLawCo\" \/>\n<meta property=\"og:description\" content=\"Central Johannesburg TVET College enforcement notice: a misdirected email led the Information Regulator to find multiple POPIA breaches. What organisations should learn.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/itlawco.com\/fr\/central-johannesburg-tvet-college-enforcement-notice\/\" \/>\n<meta property=\"og:site_name\" content=\"ITLawCo\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-08T08:02:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/06\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1672\" \/>\n\t<meta property=\"og:image:height\" content=\"941\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Nathan-Ross Adams\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nathan-Ross Adams\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/\"},\"author\":{\"name\":\"Nathan-Ross Adams\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/person\\\/180a104e03a6d73faeb2de9137a2a995\"},\"headline\":\"Central Johannesburg TVET College enforcement notice\",\"datePublished\":\"2026-06-08T08:02:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/\"},\"wordCount\":2609,\"publisher\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg\",\"articleSection\":[\"Data protection and privacy\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/\",\"url\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/\",\"name\":\"Central Johannesburg TVET College enforcement notice - ITLawCo\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg\",\"datePublished\":\"2026-06-08T08:02:39+00:00\",\"description\":\"Central Johannesburg TVET College enforcement notice: a misdirected email led the Information Regulator to find multiple POPIA breaches. What organisations should learn.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#primaryimage\",\"url\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg\",\"contentUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg\",\"width\":1672,\"height\":941,\"caption\":\"A single misdirected staff email can expose deeper POPIA governance failures, from file separation to breach notification and Information Officer registration.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/central-johannesburg-tvet-college-enforcement-notice\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/itlawco.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Central Johannesburg TVET College enforcement notice\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#website\",\"url\":\"https:\\\/\\\/itlawco.com\\\/\",\"name\":\"ITLawCo\",\"description\":\"Fast, fearless legal\",\"publisher\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/itlawco.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#organization\",\"name\":\"ITLawCo\",\"url\":\"https:\\\/\\\/itlawco.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/Logo-prsm@4x.png\",\"contentUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/Logo-prsm@4x.png\",\"width\":2854,\"height\":2883,\"caption\":\"ITLawCo\"},\"image\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/itlawco\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/person\\\/180a104e03a6d73faeb2de9137a2a995\",\"name\":\"Nathan-Ross Adams\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g\",\"caption\":\"Nathan-Ross Adams\"},\"sameAs\":[\"https:\\\/\\\/itlawco.com\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/nathan-ross-adams-a5760b9a\\\/\"],\"url\":\"https:\\\/\\\/itlawco.com\\\/fr\\\/author\\\/itadmin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Central Johannesburg TVET College enforcement notice - ITLawCo","description":"Central Johannesburg TVET College enforcement notice: a misdirected email led the Information Regulator to find multiple POPIA breaches. What organisations should learn.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/itlawco.com\/fr\/central-johannesburg-tvet-college-enforcement-notice\/","og_locale":"fr_FR","og_type":"article","og_title":"Central Johannesburg TVET College enforcement notice - ITLawCo","og_description":"Central Johannesburg TVET College enforcement notice: a misdirected email led the Information Regulator to find multiple POPIA breaches. What organisations should learn.","og_url":"https:\/\/itlawco.com\/fr\/central-johannesburg-tvet-college-enforcement-notice\/","og_site_name":"ITLawCo","article_published_time":"2026-06-08T08:02:39+00:00","og_image":[{"width":1672,"height":941,"url":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/06\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg","type":"image\/jpeg"}],"author":"Nathan-Ross Adams","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Nathan-Ross Adams","Dur\u00e9e de lecture estim\u00e9e":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#article","isPartOf":{"@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/"},"author":{"name":"Nathan-Ross Adams","@id":"https:\/\/itlawco.com\/#\/schema\/person\/180a104e03a6d73faeb2de9137a2a995"},"headline":"Central Johannesburg TVET College enforcement notice","datePublished":"2026-06-08T08:02:39+00:00","mainEntityOfPage":{"@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/"},"wordCount":2609,"publisher":{"@id":"https:\/\/itlawco.com\/#organization"},"image":{"@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#primaryimage"},"thumbnailUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/06\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg","articleSection":["Data protection and privacy"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/","url":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/","name":"Central Johannesburg TVET College enforcement notice - ITLawCo","isPartOf":{"@id":"https:\/\/itlawco.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#primaryimage"},"image":{"@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#primaryimage"},"thumbnailUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/06\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg","datePublished":"2026-06-08T08:02:39+00:00","description":"Central Johannesburg TVET College enforcement notice: a misdirected email led the Information Regulator to find multiple POPIA breaches. What organisations should learn.","breadcrumb":{"@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#primaryimage","url":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/06\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg","contentUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/06\/central-johannesburg-tvet-college-popia-enforcement-notice-misdirected-email.jpg","width":1672,"height":941,"caption":"A single misdirected staff email can expose deeper POPIA governance failures, from file separation to breach notification and Information Officer registration."},{"@type":"BreadcrumbList","@id":"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/itlawco.com\/"},{"@type":"ListItem","position":2,"name":"Central Johannesburg TVET College enforcement notice"}]},{"@type":"WebSite","@id":"https:\/\/itlawco.com\/#website","url":"https:\/\/itlawco.com\/","name":"ITLawCo","description":"Rapide, sans peur, juridique","publisher":{"@id":"https:\/\/itlawco.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/itlawco.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/itlawco.com\/#organization","name":"ITLawCo","url":"https:\/\/itlawco.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/itlawco.com\/#\/schema\/logo\/image\/","url":"https:\/\/itlawco.com\/wp-content\/uploads\/2024\/06\/Logo-prsm@4x.png","contentUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2024\/06\/Logo-prsm@4x.png","width":2854,"height":2883,"caption":"ITLawCo"},"image":{"@id":"https:\/\/itlawco.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/itlawco\/"]},{"@type":"Person","@id":"https:\/\/itlawco.com\/#\/schema\/person\/180a104e03a6d73faeb2de9137a2a995","name":"Nathan-Ross Adams","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g","caption":"Nathan-Ross Adams"},"sameAs":["https:\/\/itlawco.com","https:\/\/www.linkedin.com\/in\/nathan-ross-adams-a5760b9a\/"],"url":"https:\/\/itlawco.com\/fr\/author\/itadmin\/"}]}},"_links":{"self":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts\/3892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/comments?post=3892"}],"version-history":[{"count":4,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts\/3892\/revisions"}],"predecessor-version":[{"id":3898,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts\/3892\/revisions\/3898"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/media\/3895"}],"wp:attachment":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/media?parent=3892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/categories?post=3892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/tags?post=3892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}