On 8 October, we hosted a webinar, Stay Ahead of POPIA – Lessons Learnt from Recent Enforcement Notices, led by keynote speaker Adv. Pansy Tlakula, and Elizabeth de Stadler and Ilze Luttig-Hattingh of Novation Consulting. The session offered valuable insights into recent enforcement notices, exploring critical compliance pitfalls and the regulator’s expectations for organisations operating under the Protection of Personal Information Act (POPIA). 

As businesses navigate the complexities of data protection and cybersecurity, understanding the role of the regulator has never been more important. In this first part of our blog, we’ll unpack some of the key takeaways from the webinar, focusing on the regulator’s mandate, enforcement actions, and lessons learned from real-world cases.  

Understanding the Regulator's Role in Cybersecurity and Direct Marketing 

In 2023, South Africa saw over 1,700 data breach notifications—a stark reminder of the growing cyber threats faced by businesses and government entities. The regulator plays a crucial role in ensuring compliance with data protection laws and safeguarding personal information across both public and private sectors. 

We take a closer look at the regulator’s mandate under POPIA and the Promotion of Access to Information Act (PAIA), focusing on how they address security breaches and regulate direct marketing practices.  

The Regulator: Safeguarding Privacy and Transparency. 

The regulator's mandate focusses on two key areas: 

Through investigations, enforcement notices, and proactive measures, the regulator ensures adherence to best practices in data protection and privacy management. 

Addressing Security Breaches 

South Africa faces an alarming rise in data breaches across sectors. The regulator's efforts to address security compromises include: 

A Growing Concern: Breach Statistics 

These figures reveal that no sector is immune to cyber threats, emphasising the importance of robust cybersecurity measures. 

Lessons from Key Cases 

Case Study: Independent Electoral Commission (IEC) 

A temporary staff member at the IEC gained access to sensitive systems, resulting in the unauthorised disclosure of candidates' personal information on social media. 

Key Findings: The IEC lacked sufficient organisational measures and failed to notify affected data subjects promptly. 

Regulator’s Response: The IEC was mandated to improve access controls and restrict sensitive systems to authorised personnel only. 

Case Study: WhatsApp Privacy Policy 

WhatsApp’s 2021 privacy policy update sparked concerns about its compliance with POPIA. 

Key Issues: 

Outcome: The regulator issued an enforcement notice, giving WhatsApp a timeframe to align with local privacy laws. 

Direct Marketing: Ensuring Compliance 

Direct marketing, particularly through unsolicited communication, remains a compliance challenge. POPIA requires strict compliance with Section 69, which governs electronic direct marketing via SMS, email, or automated calls. 

Types of Direct Marketing: 

Despite these guidelines, many organisations fail to comply. For instance, the first communication with consumers is often direct marketing rather than a consent request, violating POPIA’s requirements. 

The Role of Telecommunication in Direct Marketing 

A common debate is whether telephones qualify as electronic communication under POPIA. The regulator maintains that modern telecommunication technologies classify telephones as electronic devices. 

What’s Next? 

The regulator plans to: 

Enhancing Engagement: Practical Suggestions 

The regulator encourages proactive collaboration to improve compliance. Suggestions include: