{"id":3928,"date":"2026-09-04T09:49:46","date_gmt":"2026-09-04T09:49:46","guid":{"rendered":"https:\/\/itlawco.com\/?p=3928"},"modified":"2026-09-04T11:29:07","modified_gmt":"2026-09-04T11:29:07","slug":"information-regulator-briefing-2026","status":"publish","type":"post","link":"https:\/\/itlawco.com\/fr\/information-regulator-briefing-2026\/","title":{"rendered":"Information Regulator briefing 2026: POPIA and PAIA update"},"content":{"rendered":"\n\t\t<div id=\"fws_6a9fd5d7b66c3\"  data-column-margin=\"default\" data-midnight=\"dark\"  class=\"wpb_row vc_row-fluid vc_row\"  style=\"padding-top: 0px; padding-bottom: 0px; \"><div class=\"row-bg-wrap\" data-bg-animation=\"none\" data-bg-animation-delay=\"\" data-bg-overlay=\"false\"><div class=\"inner-wrap row-bg-layer\" ><div class=\"row-bg viewport-desktop\"  style=\"\"><\/div><\/div><\/div><div class=\"row_col_wrap_12 col span_12 dark left\">\n\t<div  class=\"vc_col-sm-12 wpb_column column_container vc_column_container col no-extra-padding inherit_tablet inherit_phone flex_gap_desktop_10px \"  data-padding-pos=\"all\" data-has-bg-color=\"false\" data-bg-color=\"\" data-bg-opacity=\"1\" data-animation=\"\" data-delay=\"0\" >\n\t\t<div class=\"vc_column-inner\" >\n\t\t\t<div class=\"wpb_wrapper\">\n\t\t\t\t\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p dir=\"ltr\">The Information Regulator media briefing on 31 August 2026 set out where POPIA and PAIA enforcement now stands: more than 8,000 security compromise notifications since commencement, an enforcement notice against the South African Bureau of Standards, six administrative fines, two direct marketing matters heading for court, and a plan to give PAIA the enforcement powers it has never had.<\/p>\n<p dir=\"ltr\">The Regulator marked ten years since its establishment and five years since POPIA\u2019s enforcement provisions commenced. It used the occasion to say plainly what practitioners have argued for years: the <a href=\"https:\/\/www.gov.za\/documents\/promotion-access-information-act\">Promotion of Access to Information Act 2 of 2000 (PAIA)<\/a> gives the Regulator the power to order disclosure, but almost nothing to do when disclosure does not follow. That is the most consequential point made at the briefing, and it is where this article begins.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Key takeaways<\/h2>\n<ul dir=\"ltr\">\n<li><strong>PAIA\u2019s enforcement gap is now official policy.<\/strong> Acting PAIA Executive Mukelani Dimba confirmed that non-compliance with a PAIA enforcement notice can only be pursued by laying a criminal charge against the information officer, and that the Regulator is drafting amendments to give PAIA enforcement mechanisms equivalent to POPIA\u2019s.<\/li>\n<li><strong>A 180-day self-help power is on the table.<\/strong> Through the <a href=\"https:\/\/www.parliament.gov.za\/bill\/2321757\">Judicial Matters Amendment Bill<\/a>, the Regulator has asked Parliament for the power to release information itself where a body has not complied with a disclosure order within 180 days.<\/li>\n<li><strong>Bodies are litigating rather than disclosing.<\/strong> Chairperson Advocate Pansy Tlakula named <a href=\"https:\/\/www.sibanyestillwater.com\/\">Sibanye-Stillwater<\/a> and the <a href=\"https:\/\/www.jse.co.za\/\">Johannesburg Stock Exchange<\/a> as bodies that have taken the Regulator on review rather than release records.<\/li>\n<li><strong>POPIA\u2019s grace period blunts its own fines.<\/strong> Tlakula identified the structural weakness candidly: a responsible party that complies within the period set in an enforcement notice can no longer be fined.<\/li>\n<li><strong>A sixth administrative fine surfaced.<\/strong> Alongside the Department of Justice and Constitutional Development, the Department of Basic Education, the IEC, Lancet, and Blouberg, the Regulator disclosed that a R100,000 direct-marketing fine against FT Rams Consulting is\u00a0being processed under section 109 of POPIA.<\/li>\n<li><strong>Security compromise notifications have passed 8,000<\/strong>, with more than 1,220 received since 1 April 2026 and roughly 3,000 projected for the financial year.<\/li>\n<li><strong>Public-body PAIA reporting remains poor.<\/strong> 417 of 853 public bodies filed annual reports for 2025\/26; only 91 of 257 municipalities did.<\/li>\n<\/ul>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">What to do about it<\/h2>\n<ul>\n<li dir=\"ltr\"><strong>Information officers and deputies.<\/strong> Registration is not optional, and it is the first thing an assessment looks for. If you have not registered, do it now. If your PAIA manual is not accessible, fix that, too. Tlakula\u2019s illustration was pointed: she asked the person capturing visitor details at the door why he was collecting them and what happened to them afterwards, and he could not answer.<\/li>\n<li dir=\"ltr\"><strong>Private bodies holding contested records.<\/strong> Reassess any live PAIA refusal that rests on assertion rather than evidence, particularly under section 68. And reassess any strategy that treats a review application as a low-cost delay. The Regulator has named that strategy publicly and is legislating against it.<\/li>\n<li dir=\"ltr\"><strong>Public bodies and municipalities.<\/strong> Filing the annual report is the cheapest compliance step available, and the Regulator has said it will intensify monitoring and escalate to oversight structures. Non-filing is what draws the compliance assessment that finds everything else.<\/li>\n<li dir=\"ltr\"><strong>Direct marketers.<\/strong> Do not rely on the argument that telephone calls fall outside section 69. Two matters testing that proposition are before the Enforcement Committee and the Regulator expects the question to be litigated. Registration on the Consumer Protection Act block register does not discharge the POPIA consent obligation.<\/li>\n<li dir=\"ltr\"><strong>Boards and executives.<\/strong> The recurring finding across the SABS notice, the Central Johannesburg TVET College notice and the assessment programme is structural rather than incidental: no registered information officer, no compliance framework, no training, no incident response plan. Our analysis of the <a href=\"https:\/\/itlawco.com\/central-johannesburg-tvet-college-enforcement-notice\/\">Central Johannesburg TVET College enforcement notice<\/a> shows how a single misdirected email escalates when the foundations are missing.<\/li>\n<\/ul>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Why the PAIA enforcement gap matters<\/h2>\n<p dir=\"ltr\">Under section 77J(1) of PAIA, the Regulator may issue an enforcement notice ordering a body to grant access to a record. Section 77J(3) imports subsections (3) to (5) of section 95 of the POPIA, which govern the content and timing of enforcement notices. What it does not import is POPIA\u2019s section 109 infringement-notice machinery, which is the source of the administrative fine.<\/p>\n<p dir=\"ltr\">The consequence is that a PAIA enforcement notice and a POPIA enforcement notice look alike on paper and behave very differently in practice. Ignore a POPIA notice and the Regulator can issue an infringement notice and impose an administrative fine of up to R10 million. Ignore a PAIA notice and the Regulator\u2019s only route is section 77K, which makes refusal to comply an offence carrying a fine or imprisonment of up to three years, or both. That means opening a criminal case against a named information officer.<\/p>\n<p dir=\"ltr\">Dimba described what that looks like in practice. In the State Security Agency matter, where the Regulator had ordered the release of records and the order was not complied with, the Regulator had to open a criminal case against the acting Director-General. His account of the reception at the police station was blunt: the police officials they deal with, in his words, half the time do not know what the Regulator is talking about. These are people handling life-and-death community policing matters, and non-compliance with an enforcement notice does not land.<\/p>\n<p dir=\"ltr\">This is the practical answer to a question that has hung over the Regulator\u2019s PAIA work since it took the function over from the South African Human Rights Commission in 2021. The Regulator\u2019s findings are theoretically enforceable. However, in practice, the enforcement route runs through a charge office.<\/p>\n<p dir=\"ltr\">Tlakula put the same point in a different way on the assessment side. Public and private bodies ignore the recommendations that follow PAIA compliance assessments, she said, because they understand that no punitive consequence flows from them. The review of PAIA to strengthen the Regulator\u2019s power to enforce and to impose sanctions is, in her words, an apex priority.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Review applications as a compliance strategy<\/h2>\n<p dir=\"ltr\">The second PAIA theme was newer and, for private bodies, more immediately relevant. The Regulator says it is seeing a pattern in which bodies found to have contravened PAIA challenge the enforcement notice on review rather than release the records.<\/p>\n<p dir=\"ltr\">Tlakula named two: Sibanye-Stillwater and the Johannesburg Stock Exchange.<\/p>\n<p dir=\"ltr\">The Sibanye-Stillwater matter will be familiar. On 22 May 2026 the Regulator set aside the company\u2019s refusal of a request from the <a href=\"https:\/\/www.wits.ac.za\/cals\/\">Centre for Applied Legal Studies<\/a> for annual Social and Labour Plan compliance reports covering the Eastern and Western Platinum operations from 2019 to 2023, finding that the reliance on the commercial and financial grounds of refusal in section 68 of PAIA was not supported by evidence of likely harm. We covered that decision in detail in our analysis of the <a href=\"https:\/\/itlawco.com\/sibanye-stillwater-enforcement-notice\/\">Sibanye-Stillwater enforcement notice<\/a>.<\/p>\n<p dir=\"ltr\">A review application is, of course, a lawful response to an adverse administrative decision, and nothing in the Regulator\u2019s framing changes that. But the strategic calculus is worth naming. Where the alternative to review is a criminal complaint that may go nowhere, review is close to costless in enforcement terms, and it buys years. That is precisely the incentive structure the proposed amendments are designed to break.<\/p>\n<p dir=\"ltr\">Organisations weighing a review should assume that the arithmetic will not hold for long. If PAIA acquires an administrative-fine mechanism, the cost of an unsuccessful review changes materially.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">POPIA\u2019s grace-period problem<\/h2>\n<p dir=\"ltr\">Asked about fines, Tlakula went straight to the design flaw. When the Regulator finds a contravention, it issues an enforcement notice setting a period within which the responsible party must comply or challenge the notice. Bodies that comply within that period cannot then be fined. The fine, in other words, only ever reaches those who refuse outright or litigate and lose.<\/p>\n<p dir=\"ltr\">That is an accurate description of the interaction between sections 95 and 109 of POPIA, and it explains a fines ledger that is thinner than five years of enforcement activity might suggest.<\/p>\n<div dir=\"ltr\">\n<table>\n<thead>\n<tr>\n<th scope=\"col\">Responsible party<\/th>\n<th scope=\"col\">Fine<\/th>\n<th scope=\"col\">Status<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Department of Justice and Constitutional Development<\/td>\n<td>R5 million<\/td>\n<td>Disputed, before the courts<\/td>\n<\/tr>\n<tr>\n<td>Department of Basic Education<\/td>\n<td>R5 million<\/td>\n<td>Before the courts<\/td>\n<\/tr>\n<tr>\n<td>Independent Electoral Commission<\/td>\n<td>R100,000<\/td>\n<td>Paid<\/td>\n<\/tr>\n<tr>\n<td>Lancet Laboratories<\/td>\n<td>R100,000<\/td>\n<td>Paid<\/td>\n<\/tr>\n<tr>\n<td>Blouberg Local Municipality<\/td>\n<td>R500,000, reduced by the court to R250,000<\/td>\n<td>Recovery proceedings<\/td>\n<\/tr>\n<tr>\n<td>FT Rams Consulting<\/td>\n<td>R100,000 (direct marketing)<\/td>\n<td>Being processed under section 109<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p dir=\"ltr\">Two points of detail are worth recording because both have been reported incorrectly elsewhere. The municipality is <strong>Blouberg Local Municipality<\/strong> in Limpopo, not a Cape Town entity. And the court reduced the Blouberg fine on the basis that the municipality was a first offender and the amount was too high, which is a poor foundation for the argument that POPIA\u2019s fines are too low to deter.<\/p>\n<p dir=\"ltr\">The Regulator did not, at this briefing, propose replacing the grace period with immediate fines upon a finding of contravention, nor did it invoke the GDPR model. Tlakula identified the weakness and said the Regulator could do better. Those are different things, and practitioners should not attribute the stronger proposal to her.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Security compromises: 8,000 and counting<\/h2>\n<p dir=\"ltr\">The Regulator has received more than 8,000 security compromise notifications since POPIA\u2019s enforcement provisions commenced. More than 1,220 have come in since 1 April 2026, which is under five months, and the projection for the financial year is over 3,000.<\/p>\n<p dir=\"ltr\">Advocate Tshepo Boikanyo (Executive: POPIA) identified the recurring causes picked up during assessments: inadequate security controls, employee negligence and human error, weak passwords, malware and ransomware, and phishing. He also acknowledged that the true figure is higher than the reported one, because some responsible parties do not notify at all.<\/p>\n<p dir=\"ltr\">The enforcement notice issued to the <a href=\"https:\/\/www.sabs.co.za\/\">South African Bureau of Standards<\/a> (SABS)\u00a0in the week before the briefing is the case study. Following the 2024 ransomware attack that encrypted SABS systems and disrupted operations, the Regulator conducted an own-initiative assessment and found contraventions spanning excessive and irrelevant processing, inadequate consent mechanisms, weak security safeguards, failure to address known vulnerabilities, absence of incident response plans, and failure to inform data subjects of collection methods. SABS has 90 days from receipt to revise policies, conduct personal information impact assessments and implement adequate security measures.<\/p>\n<p dir=\"ltr\">Tlakula was careful about the ratio. The enforcement action does not follow from SABS having been attacked. No organisation can guarantee it will never be attacked. It follows from the compliance failures that the assessment exposed. She placed this against the Auditor-General\u2019s findings of ageing infrastructure, compromised security environments, a cybersecurity skills deficit, weak third-party risk management, and under-investment across government.<\/p>\n<blockquote>\n<p dir=\"ltr\">Her warning was aimed squarely at boards: organisations that treat the protection of personal information as a tick-box exercise, rather than an operational requirement that is planned for and resourced, are the ones that end up in enforcement.<\/p>\n<\/blockquote>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Direct marketing: the telephone question is heading to court<\/h2>\n<p dir=\"ltr\">Roughly 10% of the more than 3,800 complaints the Regulator received last year concerned direct marketing.<\/p>\n<p dir=\"ltr\">Two matters have been referred to the Enforcement Committee: <a href=\"https:\/\/www.outsurance.co.za\/\">OUTsurance<\/a> and <a href=\"https:\/\/www.mtn.co.za\/home\">MTN<\/a>. Both concern telephone marketing, and both put the central interpretive question directly at issue. Section 69 of POPIA regulates direct marketing by means of unsolicited electronic communication. The sector\u2019s position is that a telephone call is not an electronic communication and therefore falls outside section 69. The Regulator disagrees. Tlakula said she expects the question to reach the court through these matters.<\/p>\n<p dir=\"ltr\">She also confirmed the Regulator\u2019s position on the interaction with consumer protection law. The pre-emptive block register created by the recent Consumer Protection Act amendment regulations is welcome, and the Regulator has engaged the <a href=\"https:\/\/thencc.org.za\/\">National Consumer Commission<\/a> on joint awareness and complaint handling. But registration on that register does not displace POPIA. The obligation to obtain consent before sending unsolicited direct marketing communication remains.<\/p>\n<p dir=\"ltr\">Advocate Lebogang Stroom noted that despite the Regulator\u2019s <a href=\"https:\/\/inforegulator.org.za\/wp-content\/uploads\/2020\/07\/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf\">guidance note on direct marketing<\/a>, non-compliance persists, often in the form of repeat conduct by single marketers across large populations, which the Regulator is now consolidating in its handling.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Madlanga Commission referrals<\/h2>\n<p dir=\"ltr\">Privacy is intersecting with the criminal justice system. In February 2026, the Judicial Commission of Inquiry into Criminality, Political Interference and Corruption in the Criminal Justice System, chaired by Justice Mbuyiseli Madlanga, referred to the Regulator concerns about the alleged unlawful processing of personal information by Dr Imogen Mashazi, former City Manager of the Ekurhuleni Metropolitan Municipality. The Regulator accepted the referral, initiated an own-initiative investigation under section 76(3) of POPIA, completed it, and has referred the matter to the Enforcement Committee.<\/p>\n<p dir=\"ltr\">Further referrals arrived on 4 August 2026. Investigations have been initiated in relation to Major General Lesetja Senona, Mr Vusimuzi \u201cVusi\u201d Matlala, Mrs Lindani Mchunu, and Sergeant Fanie Nkosiyabantu. The Regulator will not comment on the merits while those investigations are running.<\/p>\n<blockquote>\n<p dir=\"ltr\">Section 76(3) is worth noting for its own sake. It allows the Regulator to conduct an investigation on its own initiative, without a complaint. Referrals from a commission of inquiry are a route into that power that we should expect to see used again.<\/p>\n<\/blockquote>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Matric results: the SCA application<\/h2>\n<p dir=\"ltr\">The Regulator confirmed it has approached the Supreme Court of Appeal in the matric results litigation, after the High Court set aside its enforcement and infringement notices in December 2025 and refused leave to appeal in June 2026.<\/p>\n<p dir=\"ltr\">Tlakula\u2019s framing is the interesting part. Whatever the outcome, she said, it must be sound in law and provide the Regulator with adequate clarity on the interpretation of POPIA while protecting the rights of every person in South Africa. That is not the language of a litigant confident of victory. It is the language of a regulator that believes the reasoning below was wrong and that the development of POPIA jurisprudence depends on correcting it.<\/p>\n<p dir=\"ltr\">We have argued the same point about the full bench\u2019s approach: resolving the matter by holding that examination numbers are not personal information is a definitional shortcut that avoids the harder and more useful question, which is whether publication with a linking key retained by the department amounts to pseudonymisation rather than anonymisation, and therefore remains within POPIA\u2019s scope.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Other investigations and assessments<\/h2>\n<p dir=\"ltr\">The Regulator confirmed live investigations and assessments involving the National Credit Regulator, Truecaller, Pick n Pay, the Gauteng Department of e-Government, the Land Bank, and Standard Bank. It has also run PAIA compliance assessments across Schedule 3A entities, non-profit organisations and real estate agencies, with low compliance observed across the board.<\/p>\n<p dir=\"ltr\">Boikanyo described a shift in method that deserves attention. POPIA ordinarily brings the Regulator to a responsible party\u2019s door because of a complaint or an instance of processing that suggests a contravention. The Regulator has now begun writing to responsible parties across selected industries, requiring them to demonstrate how they comply, without waiting for a complaint. The letters are framed as assistance, and the Regulator writes back, identifying the provisions the body must address. They are nonetheless an assessment by another name, and the first many organisations will hear of the exercise is the letter.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">PAIA annual reports: read the raw numbers, not the percentages<\/h2>\n<p dir=\"ltr\">For the 2025\/26 cycle, reports were received between 1 April and 30 June 2026. Of 853 public bodies, 417 submitted. Of 257 municipalities, 91 submitted. In 2024\/25, 358 public bodies submitted.<\/p>\n<p dir=\"ltr\">A caution on the percentages. The Regulator described 417 of 853 as approximately 52% and 358 as 43%. On a denominator of 853, those figures are 48.9% and 42.0%. Back-solving from the stated percentages produces denominators of roughly 802 and 833, so the denominator is not stable across the two figures or against the 853 given in the same passage. The municipal figure is internally consistent: 91 of 257 is 35.4%.<\/p>\n<p dir=\"ltr\">Our advice is to cite the numerators and denominators and leave the percentages alone. The underlying point survives either way: close to half of all public bodies are not meeting a statutory reporting obligation, and the municipal sphere, which is closest to the communities that need access most, is the worst performer.<\/p>\n<p dir=\"ltr\">Other categories flagged as poor performers were political parties, TVET colleges and Schedule 3A and major public entities. The Regulator also said the Public Protector has been failing to submit what it called the section 84(b) report, describing this as a statutory requirement. Strictly, section 84(b)(x) obliges the Regulator to include in its own annual report the number, nature and outcome of access-to-information complaints lodged with the Public Protector, and section 83(3)(h) is the provision under which the Regulator requests that information. The duty to report sits with the Regulator; the Public Protector&#8217;s role is to supply the data on request.<\/p>\n<p dir=\"ltr\">If your organisation has not filed, our guide to the <a href=\"https:\/\/itlawco.com\/paia-annual-report-the-what-why-how-to-submit\/\">PAIA annual report<\/a> sets out what is required and how to submit.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">New digital services<\/h2>\n<p dir=\"ltr\">The Regulator has launched a POPIA and PAIA complaints management system, an online POPIA exemption application process, an online prior authorisation application process, and iSupport, a centralised query management platform that routes general enquiries to the relevant division. It has also moved to new premises at 54 Maxwell Drive, Woodmead North Office Park, Johannesburg.<\/p>\n<\/div>\n\n\n\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2>Frequently asked questions<\/h2>\n<\/div>\n\n\n\n<div class=\"toggles \" data-br=\"none\" data-starting=\"default\" data-style=\"default\"><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a9fd5d7bb492\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a9fd5d7bb492\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>What is the difference between a PAIA and a POPIA enforcement notice?<\/a><\/h3><div id=\"toggle-panel-6a9fd5d7bb492\" role=\"region\" aria-labelledby=\"toggle-button-6a9fd5d7bb492\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>Both are formal orders requiring a body to act. A POPIA enforcement notice under section 95 is backed by the infringement notice and administrative fine regime in section 109, with fines up to R10 million. A PAIA enforcement notice under section 77J imports only subsections (3) to (5) of section 95, not the fine machinery, so non-compliance is pursued as an offence under section 77K of PAIA rather than by fine. The Regulator has confirmed it is seeking amendments to close that gap.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a9fd5d7bbab3\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a9fd5d7bbab3\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>How long do I have to appeal a POPIA enforcement notice?<\/a><\/h3><div id=\"toggle-panel-6a9fd5d7bbab3\" role=\"region\" aria-labelledby=\"toggle-button-6a9fd5d7bbab3\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>Thirty days. Section 97(1) of POPIA provides for an appeal to the High Court within 30 days of receiving the notice, for the notice to be set aside or varied. Several published reports have given the period as 31 days. It is 30.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a9fd5d7bc01e\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a9fd5d7bc01e\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Can the Regulator fine my organisation if we comply with the enforcement notice?<\/a><\/h3><div id=\"toggle-panel-6a9fd5d7bc01e\" role=\"region\" aria-labelledby=\"toggle-button-6a9fd5d7bc01e\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>On the current framework, not for the processing that is the subject matter of the enforcement notice. The Regulator confirmed that where a responsible party complies within the period set in the notice, no administrative fine follows. That is the grace period the Regulator has identified as a structural weakness, so the position may not hold indefinitely.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a9fd5d7bc54b\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a9fd5d7bc54b\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Does the Consumer Protection Act block register replace POPIA consent?<\/a><\/h3><div id=\"toggle-panel-6a9fd5d7bc54b\" role=\"region\" aria-labelledby=\"toggle-button-6a9fd5d7bc54b\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>No. The Regulator was explicit that registration on the pre-emptive block register does not displace the POPIA obligation to obtain consent before sending unsolicited direct marketing communication.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a9fd5d7bcba7\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a9fd5d7bcba7\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Are telephone calls covered by section 69 of POPIA?<\/a><\/h3><div id=\"toggle-panel-6a9fd5d7bcba7\" role=\"region\" aria-labelledby=\"toggle-button-6a9fd5d7bcba7\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>The Regulator\u2019s position is that they are. Parts of the direct marketing sector argue that a telephone call is not an electronic communication and falls outside section 69. The OUTsurance and MTN matters before the Enforcement Committee put the question in issue, and the Regulator expects it to be decided by a court.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><div class=\"toggle default\" data-inner-wrap=\"true\"><h3 class=\"toggle-title\"><a href=\"#\" id=\"toggle-button-6a9fd5d7bd0e9\" role=\"button\" aria-expanded=\"false\" aria-controls=\"toggle-panel-6a9fd5d7bd0e9\" class=\"toggle-heading\"><i role=\"presentation\" class=\"fa fa-plus\"><\/i>Must private bodies submit PAIA annual reports?<\/a><\/h3><div id=\"toggle-panel-6a9fd5d7bd0e9\" role=\"region\" aria-labelledby=\"toggle-button-6a9fd5d7bd0e9\"><div class=\"inner-toggle-wrap\">\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<p>Section 83(4) says the head of a private body \u201cmay furnish\u201d information about access requests, and then only if the Regulator asks. The verb is permissive, which is why the question keeps arising. In practice, the Regulator treats submission as expected, uses non-submission as a trigger for compliance assessments, and has said it will escalate. Treat it as mandatory.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><\/div>\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Where this leaves things<\/h2>\n<p dir=\"ltr\">The Regulator has spent five years demonstrating that it will act. What this briefing added is an admission of where it cannot act, and a legislative plan to fix it.<\/p>\n<p dir=\"ltr\">For anyone advising on access to information, the practical horizon has shifted. The question is no longer whether a PAIA enforcement notice can be safely absorbed. It is how much longer that will be true.<\/p>\n<p dir=\"ltr\">If you need help assessing a PAIA refusal, responding to an enforcement notice, or getting your information officer registration and compliance framework in order, <a href=\"https:\/\/itlawco.com\/contact\/\">contact ITLawCo<\/a>.<\/p>\n<\/div>\n\n\n\n\n\t<div class=\"wpb_video_widget wpb_content_element vc_clearfix   vc_video-aspect-ratio-169 vc_video-el-width-100 vc_video-align-left\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t\n\t\t\t<div class=\"wpb_video_wrapper\"><iframe loading=\"lazy\" title=\"31 August 2026: The Information Regulator briefs members of the media on key POPIA and PAIA matters.\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/ixeU4lTC5XU?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n\t\t<\/div>\n\t<\/div>\n\n<div class=\"wpb_text_column wpb_content_element \" >\n\t<h2 dir=\"ltr\">Sources<\/h2>\n<ul dir=\"ltr\">\n<li>Information Regulator, media briefing on high-profile cases, enforcements and investigations into POPIA and PAIA contraventions, 31 August 2026 (transcript on file)<\/li>\n<li>Information Regulator, <a href=\"https:\/\/inforegulator.org.za\/media-statements\/\">media statements<\/a><\/li>\n<li>Information Regulator, <a href=\"https:\/\/inforegulator.org.za\/wp-content\/uploads\/2026\/06\/SIBANYE-STILLWATER-ENFORCEMENT-NOTICE-220526-003_Redacted.pdf\">Sibanye-Stillwater enforcement notice, 22 May 2026<\/a><\/li>\n<li>Information Regulator, <a href=\"https:\/\/inforegulator.org.za\/wp-content\/uploads\/2026\/06\/MEDIA-STATEMENT-INFORMATION-REGULATOR-ISSUES-ENFORCEMENT-NOTICES-FOR-THE-CONTRAVENTIONS-OF-POPIA-AND-PAIA-BY-PUBLIC-AND-PRIVATE-BODIES.pdf\">media statement on enforcement notices against public and private bodies, 2 June 2026<\/a><\/li>\n<li>Information Regulator, <a href=\"https:\/\/inforegulator.org.za\/wp-content\/uploads\/2026\/04\/INFORMATION-REGULATOR-TURNS-TO-THE-COURTS-TO-FINE-BLOUBERG-LOCAL-MUNICIPALITY-FOR-CONTRAVENTION-OF-POPIA_.pdf\">media statement on Blouberg Local Municipality, 30 April 2026<\/a><\/li>\n<li>Information Regulator, <a href=\"https:\/\/inforegulator.org.za\/enforcement-notices\/\">enforcement notices<\/a> and <a href=\"https:\/\/inforegulator.org.za\/litigations\/\">litigations<\/a><\/li>\n<\/ul>\n<\/div>\n\n\n\n\n\t\t\t<\/div> \n\t\t<\/div>\n\t<\/div> \n<\/div><\/div>\n\t\t<div id=\"fws_6a9fd5d7c0319\"  data-column-margin=\"default\" data-midnight=\"dark\"  class=\"wpb_row vc_row-fluid vc_row\"  style=\"padding-top: 0px; padding-bottom: 0px; \"><div class=\"row-bg-wrap\" data-bg-animation=\"none\" data-bg-animation-delay=\"\" data-bg-overlay=\"false\"><div class=\"inner-wrap row-bg-layer\" ><div class=\"row-bg viewport-desktop\"  style=\"\"><\/div><\/div><\/div><div class=\"row_col_wrap_12 col span_12 dark left\">\n\t<div  class=\"vc_col-sm-12 wpb_column column_container vc_column_container col no-extra-padding inherit_tablet inherit_phone flex_gap_desktop_10px \"  data-padding-pos=\"all\" data-has-bg-color=\"false\" data-bg-color=\"\" data-bg-opacity=\"1\" data-animation=\"\" data-delay=\"0\" >\n\t\t<div class=\"vc_column-inner\" >\n\t\t\t<div class=\"wpb_wrapper\">\n\t\t\t\t\n\t<div class=\"wpb_raw_code wpb_raw_html wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@graph\": [\n    {\n      \"@type\": \"Article\",\n      \"@id\": \"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#article\",\n      \"headline\": \"Information Regulator briefing 2026: POPIA and PAIA update\",\n      \"description\": \"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.\",\n      \"inLanguage\": \"en-GB\",\n      \"datePublished\": \"2026-09-04T09:49:46+00:00\",\n      \"dateModified\": \"2026-09-04T12:45:00+00:00\",\n      \"url\": \"https:\/\/itlawco.com\/information-regulator-briefing-2026\/\",\n      \"mainEntityOfPage\": {\n        \"@type\": \"WebPage\",\n        \"@id\": \"https:\/\/itlawco.com\/information-regulator-briefing-2026\/\"\n      },\n      \"image\": {\n        \"@type\": \"ImageObject\",\n        \"url\": \"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg\",\n        \"width\": 1672,\n        \"height\": 941,\n        \"caption\": \"The Information Regulator's 31 August 2026 media briefing set out where POPIA and PAIA enforcement now stands.\"\n      },\n      \"citation\": [\n        {\n          \"@type\": \"CreativeWork\",\n          \"name\": \"Information Regulator media briefing on POPIA and PAIA matters, 31 August 2026\"\n        },\n        {\n          \"@type\": \"CreativeWork\",\n          \"name\": \"Information Regulator enforcement notices\",\n          \"url\": \"https:\/\/inforegulator.org.za\/enforcement-notices\/\"\n        },\n        {\n          \"@type\": \"CreativeWork\",\n          \"name\": \"Sibanye Stillwater Limited enforcement notice, 22 May 2026\",\n          \"url\": \"https:\/\/inforegulator.org.za\/wp-content\/uploads\/2026\/06\/SIBANYE-STILLWATER-ENFORCEMENT-NOTICE-220526-003_Redacted.pdf\"\n        },\n        {\n          \"@type\": \"CreativeWork\",\n          \"name\": \"Media statement: Information Regulator turns to the courts to fine Blouberg Local Municipality, 30 April 2026\",\n          \"url\": \"https:\/\/inforegulator.org.za\/wp-content\/uploads\/2026\/04\/INFORMATION-REGULATOR-TURNS-TO-THE-COURTS-TO-FINE-BLOUBERG-LOCAL-MUNICIPALITY-FOR-CONTRAVENTION-OF-POPIA_.pdf\"\n        }\n      ],\n      \"author\": {\n        \"@type\": \"Person\",\n        \"name\": \"Nathan-Ross Adams\",\n        \"url\": \"https:\/\/itlawco.com\/author\/itadmin\/\",\n        \"sameAs\": \"https:\/\/www.linkedin.com\/in\/nathan-ross-adams-a5760b9a\/\",\n        \"worksFor\": {\n          \"@id\": \"https:\/\/itlawco.com\/#organization\"\n        }\n      },\n      \"publisher\": {\n        \"@id\": \"https:\/\/itlawco.com\/#organization\"\n      },\n      \"about\": [\n        {\n          \"@type\": \"Legislation\",\n          \"name\": \"Promotion of Access to Information Act 2 of 2000\",\n          \"alternateName\": \"PAIA\",\n          \"legislationJurisdiction\": \"South Africa\"\n        },\n        {\n          \"@type\": \"Legislation\",\n          \"name\": \"Protection of Personal Information Act 4 of 2013\",\n          \"alternateName\": \"POPIA\",\n          \"legislationJurisdiction\": \"South Africa\"\n        },\n        {\n          \"@type\": \"GovernmentOrganization\",\n          \"name\": \"Information Regulator (South Africa)\",\n          \"url\": \"https:\/\/inforegulator.org.za\/\"\n        }\n      ],\n      \"mentions\": [\n        { \"@type\": \"Organization\", \"name\": \"South African Bureau of Standards\" },\n        { \"@type\": \"Organization\", \"name\": \"Sibanye-Stillwater\" },\n        { \"@type\": \"Organization\", \"name\": \"Johannesburg Stock Exchange\" },\n        { \"@type\": \"Organization\", \"name\": \"OUTsurance\" },\n        { \"@type\": \"Organization\", \"name\": \"MTN\" },\n        { \"@type\": \"GovernmentOrganization\", \"name\": \"Department of Basic Education\" },\n        { \"@type\": \"GovernmentOrganization\", \"name\": \"Department of Justice and Constitutional Development\" }\n      ],\n      \"keywords\": \"Information Regulator media briefing, Information Regulator 2026, POPIA enforcement, PAIA enforcement notice, SABS enforcement notice, POPIA administrative fines, security compromise notifications South Africa, PAIA annual report, section 77J, section 109, section 69 direct marketing\",\n      \"articleSection\": \"Insights\",\n      \"isAccessibleForFree\": true\n    },\n    {\n      \"@type\": \"FAQPage\",\n      \"@id\": \"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#faq\",\n      \"mainEntity\": [\n        {\n          \"@type\": \"Question\",\n          \"name\": \"What is the difference between a PAIA and a POPIA enforcement notice?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Both are formal orders requiring a body to act. A POPIA enforcement notice under section 95 is backed by the infringement notice and administrative fine regime in section 109, with fines up to R10 million. A PAIA enforcement notice under section 77J imports only subsections (3) to (5) of section 95, not the fine machinery, so non-compliance is pursued as an offence under section 77K of PAIA rather than by fine. The Regulator has confirmed it is seeking amendments to close that gap.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"How long do I have to appeal a POPIA enforcement notice?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Thirty days. Section 97(1) of POPIA provides for an appeal to the High Court within 30 days of receiving the notice, for the notice to be set aside or varied. Several published reports have given the period as 31 days. It is 30.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Can the Regulator fine my organisation if we comply with the enforcement notice?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"On the current framework, not for the processing that is the subject matter of the enforcement notice. The Regulator confirmed that where a responsible party complies within the period set in the notice, no administrative fine follows. That is the grace period the Regulator has identified as a structural weakness, so the position may not hold indefinitely.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Does the Consumer Protection Act block register replace POPIA consent?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"No. The Regulator was explicit that registration on the pre-emptive block register does not displace the POPIA obligation to obtain consent before sending unsolicited direct marketing communication.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Are telephone calls covered by section 69 of POPIA?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"The Regulator's position is that they are. Parts of the direct marketing sector argue that a telephone call is not an electronic communication and falls outside section 69. The OUTsurance and MTN matters before the Enforcement Committee put the question in issue, and the Regulator expects it to be decided by a court.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Must private bodies submit PAIA annual reports?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Section 83(4) says the head of a private body may furnish information about access requests, and then only if the Regulator asks. The verb is permissive, which is why the question keeps arising. In practice the Regulator treats submission as expected, uses non-submission as a trigger for compliance assessments, and has said it will escalate. Treat it as mandatory.\"\n          }\n        }\n      ]\n    },\n    {\n      \"@type\": \"Organization\",\n      \"@id\": \"https:\/\/itlawco.com\/#organization\",\n      \"name\": \"ITLawCo\",\n      \"url\": \"https:\/\/itlawco.com\/\",\n      \"logo\": {\n        \"@type\": \"ImageObject\",\n        \"url\": \"https:\/\/itlawco.com\/wp-content\/uploads\/2024\/06\/Logo-prsm@4x.png\"\n      },\n      \"areaServed\": {\n        \"@type\": \"Country\",\n        \"name\": \"South Africa\"\n      }\n    }\n  ]\n}\n<\/script>\n\t\t<\/div>\n\t<\/div>\n\n\t\t\t<\/div> \n\t\t<\/div>\n\t<\/div> \n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"The Information Regulator media briefing on 31 August 2026 set out where POPIA and PAIA enforcement now stands: more than 8,000 security compromise notifications since commencement, an enforcement notice against...","protected":false},"author":1,"featured_media":3930,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[15],"tags":[],"class_list":["post-3928","post","type-post","status-publish","format-standard","has-post-thumbnail","category-data-protection-and-privacy"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Information Regulator briefing 2026: POPIA and PAIA update - ITLawCo<\/title>\n<meta name=\"description\" content=\"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/itlawco.com\/fr\/information-regulator-briefing-2026\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Information Regulator briefing 2026: POPIA and PAIA update - ITLawCo\" \/>\n<meta property=\"og:description\" content=\"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/itlawco.com\/fr\/information-regulator-briefing-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"ITLawCo\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-04T09:49:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-04T11:29:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1672\" \/>\n\t<meta property=\"og:image:height\" content=\"941\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Nathan-Ross Adams\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nathan-Ross Adams\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/\"},\"author\":{\"name\":\"Nathan-Ross Adams\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/person\\\/180a104e03a6d73faeb2de9137a2a995\"},\"headline\":\"Information Regulator briefing 2026: POPIA and PAIA update\",\"datePublished\":\"2026-09-04T09:49:46+00:00\",\"dateModified\":\"2026-09-04T11:29:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/\"},\"wordCount\":4933,\"publisher\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg\",\"articleSection\":[\"Data protection and privacy\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/\",\"url\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/\",\"name\":\"Information Regulator briefing 2026: POPIA and PAIA update - ITLawCo\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg\",\"datePublished\":\"2026-09-04T09:49:46+00:00\",\"dateModified\":\"2026-09-04T11:29:07+00:00\",\"description\":\"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#primaryimage\",\"url\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg\",\"contentUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg\",\"width\":1672,\"height\":941,\"caption\":\"The Information Regulator's 31 August 2026 media briefing set out where POPIA and PAIA enforcement now stands.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/information-regulator-briefing-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/itlawco.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Information Regulator briefing 2026: POPIA and PAIA update\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#website\",\"url\":\"https:\\\/\\\/itlawco.com\\\/\",\"name\":\"ITLawCo\",\"description\":\"Fast, fearless legal\",\"publisher\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/itlawco.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#organization\",\"name\":\"ITLawCo\",\"url\":\"https:\\\/\\\/itlawco.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/Logo-prsm@4x.png\",\"contentUrl\":\"https:\\\/\\\/itlawco.com\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/Logo-prsm@4x.png\",\"width\":2854,\"height\":2883,\"caption\":\"ITLawCo\"},\"image\":{\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/itlawco\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/itlawco.com\\\/#\\\/schema\\\/person\\\/180a104e03a6d73faeb2de9137a2a995\",\"name\":\"Nathan-Ross Adams\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g\",\"caption\":\"Nathan-Ross Adams\"},\"sameAs\":[\"https:\\\/\\\/itlawco.com\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/nathan-ross-adams-a5760b9a\\\/\"],\"url\":\"https:\\\/\\\/itlawco.com\\\/fr\\\/author\\\/itadmin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Information Regulator briefing 2026: POPIA and PAIA update - ITLawCo","description":"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/itlawco.com\/fr\/information-regulator-briefing-2026\/","og_locale":"fr_FR","og_type":"article","og_title":"Information Regulator briefing 2026: POPIA and PAIA update - ITLawCo","og_description":"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.","og_url":"https:\/\/itlawco.com\/fr\/information-regulator-briefing-2026\/","og_site_name":"ITLawCo","article_published_time":"2026-09-04T09:49:46+00:00","article_modified_time":"2026-09-04T11:29:07+00:00","og_image":[{"width":1672,"height":941,"url":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg","type":"image\/jpeg"}],"author":"Nathan-Ross Adams","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Nathan-Ross Adams","Dur\u00e9e de lecture estim\u00e9e":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#article","isPartOf":{"@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/"},"author":{"name":"Nathan-Ross Adams","@id":"https:\/\/itlawco.com\/#\/schema\/person\/180a104e03a6d73faeb2de9137a2a995"},"headline":"Information Regulator briefing 2026: POPIA and PAIA update","datePublished":"2026-09-04T09:49:46+00:00","dateModified":"2026-09-04T11:29:07+00:00","mainEntityOfPage":{"@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/"},"wordCount":4933,"publisher":{"@id":"https:\/\/itlawco.com\/#organization"},"image":{"@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg","articleSection":["Data protection and privacy"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/","url":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/","name":"Information Regulator briefing 2026: POPIA and PAIA update - ITLawCo","isPartOf":{"@id":"https:\/\/itlawco.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#primaryimage"},"image":{"@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg","datePublished":"2026-09-04T09:49:46+00:00","dateModified":"2026-09-04T11:29:07+00:00","description":"What the Information Regulator announced on 31 August 2026: the SABS enforcement notice, POPIA fines, PAIA reporting figures, and proposed amendments.","breadcrumb":{"@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/itlawco.com\/information-regulator-briefing-2026\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#primaryimage","url":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg","contentUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2026\/09\/information-regulator-media-briefing-2026-popia-paia-enforcement.jpg","width":1672,"height":941,"caption":"The Information Regulator's 31 August 2026 media briefing set out where POPIA and PAIA enforcement now stands."},{"@type":"BreadcrumbList","@id":"https:\/\/itlawco.com\/information-regulator-briefing-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/itlawco.com\/"},{"@type":"ListItem","position":2,"name":"Information Regulator briefing 2026: POPIA and PAIA update"}]},{"@type":"WebSite","@id":"https:\/\/itlawco.com\/#website","url":"https:\/\/itlawco.com\/","name":"ITLawCo","description":"Rapide, sans peur, juridique","publisher":{"@id":"https:\/\/itlawco.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/itlawco.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/itlawco.com\/#organization","name":"ITLawCo","url":"https:\/\/itlawco.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/itlawco.com\/#\/schema\/logo\/image\/","url":"https:\/\/itlawco.com\/wp-content\/uploads\/2024\/06\/Logo-prsm@4x.png","contentUrl":"https:\/\/itlawco.com\/wp-content\/uploads\/2024\/06\/Logo-prsm@4x.png","width":2854,"height":2883,"caption":"ITLawCo"},"image":{"@id":"https:\/\/itlawco.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/itlawco\/"]},{"@type":"Person","@id":"https:\/\/itlawco.com\/#\/schema\/person\/180a104e03a6d73faeb2de9137a2a995","name":"Nathan-Ross Adams","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/25dc8945a16b2092572617ca3935624f6c0c2b8e7f90f89e9dd3ce6611085fcb?s=96&d=mm&r=g","caption":"Nathan-Ross Adams"},"sameAs":["https:\/\/itlawco.com","https:\/\/www.linkedin.com\/in\/nathan-ross-adams-a5760b9a\/"],"url":"https:\/\/itlawco.com\/fr\/author\/itadmin\/"}]}},"_links":{"self":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts\/3928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/comments?post=3928"}],"version-history":[{"count":9,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts\/3928\/revisions"}],"predecessor-version":[{"id":3939,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/posts\/3928\/revisions\/3939"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/media\/3930"}],"wp:attachment":[{"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/media?parent=3928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/categories?post=3928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itlawco.com\/fr\/wp-json\/wp\/v2\/tags?post=3928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}