South AfricaProtection of Personal Information Act, the Information Regulator, enforcement and penalties
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 July 2020.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Information Regulator to investigate a complaint that you have interfered with the protection of personal information, including by entering and searching your premises under a warrant where a judge or magistrate is satisfied there are reasonable grounds.
- Comply with an enforcement notice the Regulator serves requiring you to take, or stop taking, specified steps, or appeal it to the High Court within 30 days.
- Expect a data subject, or the Regulator at the data subject's request, to be able to bring a civil damages claim against you for breach of any provision of the Act, regardless of intent or negligence.
- Expect prosecution and a fine or imprisonment of up to ten years for the most serious offences, such as unlawfully selling a data subject's account number, and up to twelve months for lesser offences such as breaching confidentiality.
- Expect an administrative fine of up to R10 million by infringement notice, which the Regulator sets after considering the nature of the information involved, the number of data subjects affected, and whether you could have prevented the contravention.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A conviction under sections 100, 103(1), 104(2), 105(1) or 106(1), (3) or (4) carries a fine or imprisonment of up to ten years, or both; a conviction under sections 59, 101, 102, 103(2) or 104(1) carries a fine or imprisonment of up to twelve months, or both (s. 107).
Penalty structure
Administrative fine cap the Information Regulator may impose by infringement notice under section 109(2)(c). A separate criminal conviction under section 107 carries a fine at the convicting court's discretion, or imprisonment of up to ten years, rather than a further fixed monetary cap.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- ZAR
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Information Regulator of South Africa
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 39 establishes the Information Regulator as an independent juristic person with jurisdiction throughout the Republic. The Regulator's establishment under Chapter 5 Part A commenced ahead of most of the Act, since the Presidency's 1 July 2020 commencement proclamation covered sections 2 to 38 and sections 55 to 109 but not sections 39 to 54.
Section 73 defines interference with the protection of personal information as any breach of the Chapter 3 conditions, non-compliance with sections 22, 54, 69, 70, 71 or 72, or a breach of a code of conduct, and sections 74 to 94 let any person complain to the Regulator, which may conciliate, investigate, refer a matter to its Enforcement Committee, and, under sections 81 to 88, obtain a warrant to enter, search and seize evidence from a responsible party's premises.
Section 95 lets the Regulator serve an enforcement notice requiring a responsible party to take, or stop taking, specified steps, appealable to the High Court within 30 days under section 97, and section 99 lets a data subject, or the Regulator at the data subject's request, bring a civil action for damages against a responsible party for breach of any provision of the Act, regardless of intent or negligence.
Sections 100 to 106 create offences for obstructing the Regulator, breaching confidentiality, failing to comply with an enforcement or information notice, and unlawfully dealing in a data subject's account number; section 107 sets the penalties at up to ten years' imprisonment or a fine, or both, for the most serious of these, and up to twelve months for the rest, and section 109 lets the Regulator impose an administrative fine of up to R10 million by infringement notice, considering factors including the number of data subjects affected and whether the responsible party could have prevented the contravention.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisions
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.