South Africa

The South African Information Regulator is an independent, statutory regulatory body that was created by the Protection of Personal Information Act (POPIA) [2013], which operates as the main authority in the country on issues related to data privacy and freedom of information. Having absolute institutional independence and reporting directly to the National Assembly, the Information Regulator has the distinctive mandate to aggressively protect the right to privacy under the Constitution by regulating how government institutions and private organizations collect, store, and process personal information, as well as to promote the right of access to information under the Promotion of Access to Information Act (PAIA). As the primary enforcement agency in the data protection environment of South Africa, it is responsible for the management of mandatory registration of Information Officers, conduct of proactive sectoral audits, investigation of system vulnerabilities, and issuance of enforcement orders by legislation to stop unauthorized flows of information and impose administrative or even criminal sanctions.

South African Information Regulator carries out its dual legislative mandate by engaging in proactive regulation, monitoring, and enforcement of compliance with the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). In this regard, the regulator is actively handling mandatory statutory filings, including registration of corporate Information Officers and receiving mandatory notification of security compromise through the use of its eServices platform for breach detection. Armed with legislative power, the regulator shifts its focus from mere complaint handling to proactive compliance audits in high-risk data sectors such as banks, insurance, and telecommunication companies. Upon any violation, the case will be referred to the formal Enforcement Committee, which will take charge of issuing legally binding enforcement notices, cessation of illegal cross-border data processing activities, imposition of maximum R10 million fines, or criminal prosecution. Moreover, the regulator continues to make public notifications of direct marketing violations and mediate disputes arising from infringements of individuals' privacy or information access rights.