Misleading debt collection scams are exposing South African businesses to fake invoices and unlawful harassment. Here’s what employers need to know to stay protected.
The Information Regulator held a media briefing on 13 November 2025 to outline the latest developments in POPIA and PAIA enforcement, ongoing litigation, regulatory priorities. The briefing, led by Chairperson Adv Pansy Tlakula, came at a fitting moment as South Africa marks 25 years of PAIA - a reminder of the country’s long-standing commitment to transparency and accountability. 1. Major Litigation Matters DBE Matric Results Case The Regulator previously instructed the Department of Basic...
Protect Your Business from Data Breaches: Lessons from the MTN Cybersecurity Incident On 25 April 2025, South African telecoms giant MTN Group confirmed a cybersecurity breach that resulted in unauthorised access to customer data across several of its operating markets. While no financial platforms or core systems were compromised, the incident highlights the growing cybersecurity risks businesses face in an increasingly digital economy. MTN’s swift response involving law enforcement,...
The Information Regulator ("Regulator") announced the dates for the submission of the 2024/2025 Financial Year Annual PAIA Reports for public and private bodies. These reports, mandated by the Promotion of Access to Information Act 2 of 2000 (PAIA), are essential for ensuring transparency and accountability in the processing of access to information requests. What is the Report About? These annual reports detail the requests for access to records received and processed by your respective...
As we celebrate Data Privacy Day, it’s the perfect opportunity to reflect on your business's POPIA compliance. Staying compliant is an ongoing process; regular reviews are essential to ensure your business remains compliant. While this isn’t a comprehensive checklist, here are some key steps to help assess your POPIA compliance: Appoint an Information Officer and Deputy Information Officer Every business must appoint an Information Officer and if necessary, a Deputy Information...
The Consumer Protection Act (CPA) is designed to promote fair business practices, and one of its key provisions, Section 22, requires that all consumer agreements and documents be written in plain and understandable language. This section ensures that consumers can easily comprehend the terms and conditions of contracts, enabling them to make informed decisions and exercise their rights effectively. Plain language, as defined by the Act, means that the content should be easy to understand...
Running a business often requires managing clients, suppliers, and employees. Technology can streamline these processes. Many businesses use biometric technologies, such as facial recognition or fingerprint scanners, for time management and employee monitoring. However, under the Protection of Personal Information Act (POPIA), the use of biometrics comes with strict conditions. What Are Biometrics Under POPIA? POPIA defines biometrics as technique of personal identification based on physical,...
At the heart of the Protection of Personal Information Act (POPIA) lies the fundamental right of data subjects to have their personal information safeguarded whenever a responsible party processes it. POPIA mandates that responsible parties need to ensure the integrity and confidentiality of personal information, to prevent unauthorised access, loss, damage, or destruction of information. To achieve this, responsible parties must implement appropriate technical and organisational...
As the Managing Director of SEESA, I recently experienced firsthand the devastating impact of a coordinated cyber-attack on our organisation. It was a Friday evening when the head of IT delivered the chilling news: SEESA had become the target of a malicious ransomware attack. Our entire IT infrastructure was compromised, millions of confidential client records were at risk, and operations across the company were grinding to a halt. In moments like these, clear thinking and decisive action are...
At the core of POPIA's principles lies a fundamental distinction between two essential entities: The Responsible Party and an Operator. This distinction clearly outlines each party's roles, obligations, and responsibilities in upholding data protection standards and safeguarding individuals' privacy rights. The Responsible Party (usually a public or private business) will set out the purpose of the processing activity, and the Operator (sub-contractors, agents, suppliers,...