What's changed in POPIA enforcement and guidance

The Information Regulator has moved from issuing warnings to actively enforcing: it has taken a municipality to the High Court to convert an infringement fine into a court order, issued fresh enforcement notices against a public college and a mining company in 2026, and published its long-awaited Guidance Note on Direct Marketing at the end of 2024. Reporting a security compromise now runs through a single eServices Portal.

Reviewed by TefCo Compliance Research — last verified 15 September 2026.

In short

Direct marketing guidance clarifies section 69

On 3 December 2024 the Information Regulator published its Guidance Note on Direct Marketing in terms of the Protection of Personal Information Act 4 of 2013. It draws a line between direct marketing by non-electronic means (post, hand-delivered mail, in person), which can rely on a legitimate-interest justification, and direct marketing by electronic communication under section 69, which needs prior opt-in consent from anyone who is not an existing customer.

The Guidance Note lists telephone calls, automated calling machines, faxes, SMSs, email, push notifications and direct messaging on social media as forms of electronic direct marketing caught by section 69 — a wider list than many businesses had assumed applied.

From enforcement notices to court-confirmed fines

The Regulator's practice has been to issue an enforcement notice first; a fine (an infringement notice) follows only where the enforcement notice is ignored. That escalation played out against Blouberg Local Municipality: after the municipality failed to comply with an enforcement notice over personal staff information published on its website, the Regulator issued an infringement notice imposing a fine, and then approached the Polokwane High Court under section 109 of POPIA to have the fine made an order of court. The court order was granted in early April 2026.

In June 2026 the Regulator issued fresh enforcement notices against Central Johannesburg TVET College, for sharing special personal information — including criminal charge and conviction data — without legal justification and without notifying the Regulator or affected individuals of the resulting security compromise, and against Sibanye Stillwater Limited for a PAIA contravention.

The Central Johannesburg TVET College notice again cites a failure to register an Information Officer as a root cause. It remains the fastest, cheapest fix on this list.

Security compromise reporting moved onto the eServices Portal

The Regulator's 2025 fact sheet on security compromises confirms that all security compromise reports must now be submitted through the Information Regulator's eServices Portal, rather than by the previously used PDF form sent by email, for a process the Regulator describes as faster and more secure.

Frequently asked

Has the Information Regulator actually collected a fine, or only threatened them?

Yes — the Blouberg Local Municipality matter went as far as a Polokwane High Court order confirming the fine, after the municipality did not comply with the Regulator's enforcement and infringement notices.

Did the direct marketing rules themselves change, or just the guidance?

The statutory text of sections 11 and 69 of POPIA has not changed. What changed is the Regulator's published interpretation — its December 2024 Guidance Note gives a much more detailed, and in places broader, reading of what counts as electronic direct marketing.

Where does an Information Officer report a new security compromise today?

Through the Information Regulator's eServices Portal, using the prescribed notification process — not by emailing a PDF form to the Regulator, which was the earlier route.

Sources

TefCo Corporate Compliance (Pty) Ltd is a compliance management platform, not a legal, tax or advisory firm. This guide is general information, not advice. Fees, dates and thresholds change — confirm current figures with the regulator before you rely on them.

Related guides