What the Information Regulator can do to you
How the Information Regulator assesses a South African business under POPIA, what an enforcement notice and an infringement notice mean, and the fine.
By Achekam · · 4 min read · For Running a business businesses in South Africa
Some South African business owners still treat POPIA as a law with no teeth: a form to file, a policy to download, and little chance of anyone checking. That view is hard to hold. The Information Regulator assesses organisations, issues notices and can impose fines, and the process can start with a single complaint.
Understanding how that process runs is useful even for a business that has never heard from the Regulator, because it shows what the Regulator will look for and what you would need to produce. This article walks through how an assessment starts, what follows if problems are found, the fine and your options when one is imposed, and the evidence that puts a business in a better position.
Who the Regulator can look at
The Information Regulator says any organisation, public or private and irrespective of its size, or any individual that processes personal information, is a responsible party with a duty to comply with POPIA's eight conditions for lawful processing.
So the question is not whether your business is big enough to attract attention. If it holds customer lists, staff records or supplier details, it is a responsible party, and the Regulator's powers apply to it.
Assessments on the Regulator's own initiative
The Regulator does not have to wait to be asked. It says it may assess a responsible party's compliance on its own initiative, for example where complaints or reported security compromises are numerous or high-risk. It adds that this is usually done through a two-day on-site assessment.
An on-site assessment means the Regulator sees how systems are actually used, so a business should expect to show, not just describe, how it handles personal information.
Form 11: anyone can ask for an assessment
Assessments can also start from outside. The Regulator says any data subject, responsible party or other person may ask it to assess whether processing complies with POPIA, by e-mailing a completed Form 11.
That is a low barrier. A customer unhappy about marketing messages, a former employee concerned about their records, or a competitor can submit the form. The business does not choose when it is assessed; it can only choose how ready it is.
The Regulator's website covers POPIA and PAIA, the registration of information officers, complaints and enforcement, and it is where the forms and the Regulator's own description of these powers are published.
From enforcement notice to infringement notice
An assessment can lead to an enforcement notice setting out what the business must do. What happens if the business does not act on it is set out by the Regulator: if a responsible party does not comply with an enforcement notice issued after an assessment, the Regulator may issue an infringement notice under section 109 of POPIA.
The sequence matters. The enforcement notice is the business's chance to put things right. The infringement notice, with its fine, follows when that chance is not taken.
| Stage | What it means for the business |
|---|---|
| Assessment | The Regulator examines how personal information is handled, on its own initiative or after a Form 11 request |
| Enforcement notice | The business is told what it must do |
| Infringement notice | If the enforcement notice is not complied with, a fine can be imposed under section 109 |
The administrative fine and the 30-day choice
The POPIA text published on the government's page, in section 109 of the Act as published, allows the Regulator to issue an infringement notice with an administrative fine of up to R10 million. The infringer may pay the fine, arrange to pay it in instalments, or elect to contest it in court within 30 days.
Thirty days is not long to take legal advice and decide whether to contest. A business that receives an infringement notice should put it in front of its lawyer the same day.
Keeping evidence of how personal information is handled
Everything above points the same way: the business that can produce evidence quickly is in a better position at every stage. What evidence looks like varies, but it usually includes the information officer's registration, a compliance framework, an impact assessment, the PAIA manual, records of security measures and records of who changed what. The information officer's documents are covered in what a POPIA information officer must do, and the security side in POPIA security safeguards for a small business.
Two Achekam features help with parts of that picture.
A log of changes to governed records. Record Governance keeps a log of changes to governed records showing who did what, when and with what result, which can be filtered and checked for an unbroken chain. It sits under QUALITY & GOVERNANCE, in Record Governance, and viewing it needs the AUDIT_LOG_VIEW permission. It covers records under record governance, not every screen, so know which records it applies to before you rely on it.
Limits on what the AI engine does with personal information. Achekam's AI engine refuses any task whose type is giving an opinion, reaching a conclusion, approving or signing. By default it also removes South African ID numbers before text is sent to an AI vendor. That removal can be switched off in AI settings, so if you rely on it, check the setting and keep a note of who may change it.
Neither feature satisfies POPIA on its own. They are evidence of particular controls, which is exactly what an assessment asks for.
Prepare as if the form were already submitted
Imagine a Form 11 has just been e-mailed about your business. List what you would want to show the Regulator, check whether each item exists and is current, and fix the gaps now. That exercise costs nothing, and it is the best protection against every stage in the table above.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
