Information Regulator escalates POPIA enforcement as security breach reports jump 40%

The Information Regulator reported 2,374 security compromise incidents in 2024/25 - about 198 notifications a month - rising to 1,947 breaches from April 2025 at roughly 284 a month, a 40% increase, ITWeb reported from the regulator's media briefing in mid-November 2025.

Blouberg Municipality was fined R500,000 for grossly violating a former employee's privacy by exposing personal information online and failing to comply with an enforcement notice. It has not paid, and the Regulator has begun court proceedings to recover the fine.

Lancet Laboratories paid a R100,000 fine for failing to notify the Regulator and affected data subjects of security breaches as required by section 22 of POPIA. FT Rams Consulting was fined R100,000 for ignoring an enforcement notice arising from a direct marketing complaint; it has not paid and court recovery proceedings have been launched.

The Department of Basic Education faces a R5 million fine over publishing matric results in newspapers, argued in the High Court on 27-28 October 2025 with judgment pending, while the Department of Justice is appealing its R5 million fine over a 2021 security compromise.

"The regulator continues to be deeply concerned about the increased number of compromise incidents occurring in the country," said chairperson Advocate Pansy Tlakula.

For security companies - which process CCTV footage, biometric records and client personal information daily - the enforcement drive signals materially higher POPIA compliance risk.

Source: ITWeb, 14 November 2025 - itweb.co.za (regulator statement: inforegulator.org.za)