The Information Regulator has fined Central Johannesburg TVET College R500,000 for failing to comply with a POPIA enforcement notice it was given in May. The penalty was announced on 26 October 2026 alongside a R1 million fine against FNB, and it is the clearest local signal yet that the regulator has moved from guidance to enforcement.
What happened
The Regulator issued the enforcement notice on 22 May 2026 after three people complained that their personal information had been shared with third parties without a lawful basis. The notice gave the college 120 days to register its Information Officer and Deputy, apologise to the complainants, produce a POPIA compliance framework, run staff awareness training and take disciplinary action against the employee responsible.
When the 120 days expired, the Regulator found the college had not complied. Its statement lists a security compromise that was not reported in the prescribed manner, no compliance framework, a late apology and missed deadlines on the rest. The outcome was an infringement notice and an administrative fine of R500,000.
Who is affected
The finding names one institution, but every obligation it failed on applies to any organisation processing personal information in South Africa.
- Any body that has received a POPIA enforcement notice and treated the deadline as advisory.
- Organisations that have never registered an Information Officer with the Regulator, which remains a common gap.
- Businesses with no written POPIA compliance framework and no record of staff awareness training.
- Anyone who has suffered a security compromise without notifying the Regulator under section 22.
What to do now
Confirm that your Information Officer is registered with the Regulator, and that a compliance framework exists as a document rather than an intention.
- Check the Information Officer and Deputy registrations on the Regulator's portal, and update them when staff change.
- Keep a written POPIA compliance framework, and record the dates of staff awareness training.
- Make sure a security compromise would be reported in time: the duty starts when there are reasonable grounds to believe personal information was accessed, not when a breach is confirmed.
- If you hold an enforcement notice, diary the deadline and be able to evidence every item on it, because failing to comply is a separate offence.
What this means for South African businesses
The R500,000 penalty was not imposed for being breached. It was imposed for ignoring instructions to close documented gaps, which is a failure any organisation can avoid with paperwork and follow-through. In my judgement that is the more dangerous pattern for SMEs than a breach fine, because the trigger is a missed deadline rather than an attacker, and a small firm has no capacity buffer to absorb it.
Source: Information Regulator media statement, 26 October 2026.