Advocate Pansy Tlakula, chairperson of the Information Regulator. (Photograph by Strike A Pose Studio)
The Information Regulator (InfoReg) has, to date, received over 8 000 security compromise (data breach)incident reports, with 1 220 reported from April.
This, as South Africa continues to experience an increasingly hostile cyber security environment, with data breaches and cyber attacks exposing the personal information of millions of citizens, said advocate Pansy Tlakula, InfoReg chairperson.
South Africa’s data privacy enforcer hosted a media briefing at its new headquarters in Woodmead this morning, sharing insights into several high-profile cases and other key developments.
Tlakula pointed to the severity of the state of security compromises, saying the 1 220 reports, so far, come less than five months since the beginning of the 2026/2027 financial year.
With this trend, there may be over 3 000 reported data incidences produced by the end of the financial year, she added.
See also
“The consequences of a security compromise can extend well beyond the exposure of personal information. Depending on the depth, a security compromise can interrupt essential services, damage institutional credibility, undermine public confidence and have significant economic consequences.”
Responding to ITWeb’s question on the incident report numbers, Tlakula said the situation is “very alarming”.
“I think we [South Africa] rank among the highest globally on issues of cyber security. As the regulator, from where we sit, we are not sure whether public and private bodies are as alarmed as we are. It is scary…cyber security has an impact not only on personal information of data subjects but on the economy, and huge reputational risk for the country as well.”
Advocate Tshepo Boikanyo, InfoReg executive for POPIA, elaborated that there are instances where affected organisations, or responsible parties do not report the security compromises.
“The source of these security compromises would be inadequate security controls, which is what we pick up during our assessments. For example, employee negligence or human error. In certain instances, we pick up that the responsible party would have weak passwords, there would be instances of malware, ransomware and phishing attacks – that’s the trend we’ve been picking up insofar as our assessments are concerned.
“On a daily basis, we keep having these security compromise [reports] coming through. Our assessments have also revealed that the public sector may not be putting as much effort as the private sector into ensuring it has appropriate security measures to protect the personal information that it holds.
“We see that there is a concerted effort by the private sector to ensure the measures that are put in place are sufficient to protect and appropriate to protect the personal information that an organisation holds.”
The Information Regulator, headed by Tlakula, has a dual mandate to ensure organisations put in place measures to protect the data privacy of South Africans, in terms of the Protection of Personal Information Act (POPIA) and Promotion of Access to Information Act.
The InfoReg’s website states security compromises that result in breaches of personal information must be reported to it and those affected “as soon as it is reasonably sure that a security compromise has occurred. The security compromise does not have to be confirmed before it is reported.”
Cyber security company Surfshark’s quarterly analysis of global data breaches shows South Africa ranks as the 42nd most breached country in the first quarter of this year.
Since 2004, South Africa has been ranked as the second most breached country in Africa, with 45.7 million compromised user accounts.
Persistent direct marketers
Under POPIA, organisations must inform the Information Regulator if they expose the personal information of data subjects to unauthorised third-parties without their approval.
The Act sets down firm frameworks that companies must abide by to avoid fines, criminal persecution and potential reputation loss. Perpetrators can face fines of up to R10 million, or 10 years of imprisonment, depending on the seriousness of the breach.
Tlakula underscored the issue of direct marketers, saying the growing frustration that data subjects have with direct marketing through unsolicited electronic communications keeps her up at night.
According to the chairperson, last year, the regulator received over 3 800 complaints, with 10% of the complaints related to direct marketing.
Direct marketing, therefore, remains a material source of concern, she said. “The complaints demonstrate continued concern among data subjects about the use of their personal information for marketing purposes, particularly through electronic communications.”
She explained that two direct marketing matters – involving OUTsurance and MTN − have been referred to the InfoReg’s enforcement committee.
“These matters are significant because they raise important questions regarding the interpretation and application of section 69 of POPIA on direct marketing by means of unsolicited electronic communications.
“The outcome of these matters will be important in providing greater certainty to both responsible parties and data subjects. We emphasise that POPIA is not an obstacle to legitimate commerce; it is a framework within which promise must take place lawfully and fairly.”
She added that the regulator welcomes the recent amendment to the Consumer Protection Act regulations aimed at unsolicited marketing communication, including spam calls.
“We regard the pre-emptive block register as an important additional matter in addressing the scourge of unwanted direct marketing. Registration in the pre-emptive block register does not displace the obligations imposed by POPIA. Bodies still have an obligation to obtain consent from a person before sending unsolicited direct marketing communication to them.”
Providing insights into other matters within the regulator’s ambit, Tlakula said it issued the South African Bureau of Standards (SABS) with an enforcement notice last week.
The move follows the “significant” ransomware attack it suffered in 2024. “We found that they have violated the POPIA conditions for unlawful processing of personal information.
“We have instructed SABS to improve security and data protection practices by revising its policies, conducting thorough personal information impact assessments, and implementing security measures to protect personal information it processes within 90 days of receipt of the enforcement notice.”
