POPIA allows the Information Regulator to fine an organisation up to R10 million. By its briefing of 31 August 2026 the Regulator had issued six fines, and the largest was R5 million. The amounts matter less than the reasons, because the same reason appears in almost every case.
The six fines
- Department of Justice, R5 million (2023). After a ransomware attack in 2021, the department let its security software licences lapse and did not carry out the fixes the Regulator ordered. The fine is disputed in court.
- Department of Basic Education, R5 million (2024). The department published matric results in newspapers after the Regulator ordered it to stop. At the time of writing, sources disagree on where this fine stands. News reports say the High Court set it aside in December 2025 and refused the Regulator leave to appeal in June 2026. A summary of the Regulator’s briefing on 31 August 2026 still lists the matter as before the courts.
- Blouberg Local Municipality, R500,000. The municipality published a former employee’s personal information and ignored the Regulator’s notices. A court reduced the fine to R250,000.
- Electoral Commission, R100,000. Candidate lists leaked before the 2024 election. Paid.
- Lancet Laboratories, R100,000. The pathology group had repeated breaches that it did not report as section 22 requires. Paid.
- FT Rams Consulting, R100,000. The firm kept sending marketing emails to people who had opted out, then ignored the Regulator’s notice. The fine remains unpaid.
What the fines have in common
A POPIA fine arrives in two steps. The Regulator investigates and issues an enforcement notice, which is a written order to fix named problems by a set date. A fine normally follows only when the organisation fails to do what the notice says.
So the usual cause of a fine is an ignored order. The breach or the complaint starts the process, and the failure to respond finishes it. Organisations that complied with their enforcement notices generally paid nothing.
What this means for a private business
- Private firms are in scope. A laboratory group and a consulting firm are on the list next to government departments.
- Small duties draw notices. In May 2026 a college received an enforcement notice for failing to register its information officer, the person POPIA makes accountable for compliance.
- Breach reports are routine. The Regulator has received more than 8,000 breach notifications since POPIA took effect, and more than 1,220 between 1 April and the end of August 2026. Reporting a breach is ordinary. Hiding one is what Lancet was fined for.
- Answer the letter. When the Regulator writes, reply by the date it gives and do what the notice asks. Every unpaid fine on this list began with a notice that went unanswered.
Would a letter from the Regulator reach the right person in your business? Tell us what’s on fire