Even years after POPIA came into full effect, the same compliance gaps continue to surface across different industries. Many businesses believe they are POPIA compliant until a complaint, audit, or data breach proves otherwise.
Here are some of the most basic POPIA mistakes we still see:
1. Information Officers appointed “on paper only”.
The Information Officer is registered on the Information Regulators e-Services portal, but there is no real understanding of the role, no internal authority, and no ongoing oversight of compliance activities.
2. Outdated or generic privacy notices
Outdated or generic privacy notices often misrepresent actual processing activities in the company.
3. No POPIA training beyond management
POPIA compliance is treated as a legal or HR issue, while frontline employees, who handle personal information daily, receive little or no training.
4. Assuming IT equals POPIA compliance
Strong IT systems alone are not enough. POPIA also requires policies, procedures, access controls, and human behaviour management.
5. Weak access control and data minimisation
Employees often have access to personal information they do not need, increasing the risk of internal breaches and unauthorised disclosure.
6. No clear process for data subject requests
Businesses struggle to respond within reasonable timeframes because there is no documented procedure for handling requests.
7. Not reporting data breaches to the Information Regulator
Many organisations do not fully understand what constitutes a data breach under POPIA or how to report it. As a result, breaches are often ignored or being overlooked entirely.
8. Failure to review and update data processing agreements with Operators
While operators are identified, many businesses fail to put proper data processing agreements in place or to review them regularly.
9. Treating POPIA as a once-off exercise
Compliance is viewed as a project with an end date, rather than an ongoing process requiring regular review, updates, and monitoring.
POPIA compliance is about awareness, accountability, and continuous improvement. Identifying and fixing these common gaps is often the first step towards meaningful compliance.

The Information Regulator held a media briefing on 13 November 2025 to outline the latest developments in POPIA and PAIA enforcement, ongoing litigation, regulatory priorities. The briefing, led by Chairperson Adv Pansy Tlakula, came at a fitting moment as South Africa marks 25 years of PAIA - a reminder of the country’s long-standing commitment to transparency and accountability. 1. Major Litigation Matters DBE Matric Results Case The Regulator previously instructed the Department of Basic...