POPIA FINES ARE HERE

What the Penalty Means for South African Law Firms

There’s something wonderfully South African about taking a legal obligation seriously only once someone else gets an invoice.

Law firms have had the policies and sat through the workshops on client confidentiality. Yet a password stuck beneath a keyboard can apparently coexist quite happily with the conviction that discretions sacrosanct. Reconciling those positions seems to cause less trouble than remembering twelve characters.

On 26 October 2026, the Information Regulator announced administrative fines of R1 million against First National Bank and R500 000 against Central Johannesburg TVET College. Different failures. Same uncomfortable message – the compliance file isn’t an invisibility cloak.

The uncomfortable part is how easily a firm can advise a client to address a risk, then tolerate much the same risk in its own office because changing the process would be inconvenient. Forwarding this news to the team won’t resolve that contradiction, however emphatically the accompanying message says, “please take note”.

What the FNB POPIA fine actually means

It’s tempting to reduce the bank’s experience to an expensive technical hiccup. That misses the point. According to the Regulator’s statement, its assessment identified shortcomings in recognising, classifying, and responding to repeated security incidents, inadequate section 19 safeguards under the Protection of Personal Information Act 4 of 2013 and weaknesses in information-retention governance.

The exposed information included account numbers. The Regulator found an offence under section 105 relating to their unlawful processing and imposed an administrative fine through an infringement notice. That’s the Regulator’s finding, not a reported criminal conviction. Precision matters, particularly when lawyers are doing the tutting.

South African Lawyer’s report adds that a system error exposed 88 people’s information to 696 unauthorised individuals. Those are different groups, not interchangeable breach statistics. A misplaced access classification can do considerable damage without a criminal needing to arrive wearing a balaclava.

The lesson isn’t that every breach comes with a million-rand invoice. It’s that foreseeable risks, weak safeguards and inadequate responses can become regulatory business. A firm would recognise that distinction immediately when advising someone else. Buying software doesn’t relieve management of having to manage, which is an unfortunate defect from management’s perspective.

Central Johannesburg TVET College: a POPIA checklist with consequences

The college’s fine followed failure to comply with an enforcement notice, rather than merely being the victim of an attack. The Regulator identified failures including prescribed breach reporting, developing a compliance framework, and meeting corrective deadlines.

In Information Regulator’s first enforcement notice for 2026, ENS’s Rakhee Dullabh explains the practical requirements – Information Officer registration, designated deputies, notification, an apology, appropriate employee action, a compliance framework, and staff training. The framework needed privacy, retention, incident-response, and information-security policies.

There’s a ready-made management agenda. Conveniently supplied by someone else’s unpleasant experience.

The original problem involved unlawful internal disclosure, not necessarily an outsider defeating sophisticated defences. That should unsettle anyone who thinks a recalled email is a time machine. It isn’t. Neither is an apologetic follow-up marked “please delete”.

POPIA enforcement: the grace period’s over

ITWeb’s report of the Regulator’s November 2025 briefing records 2 374 security-compromise notifications during the 2024/25 financial year. That’s a count of reported incidents, not a census of every breach. There’s enough cause for concern without making the statistics do overtime.

People of Internet’s sector-targeting analysis describes a shift towards proactive, sector-focused enforcement, including education, health, and local government. For municipal managers and executives, “nobody’s complained” is therefore a particularly fragile operating model.

Werksmans’ Ahmore Burger-Smidt, Armand Swart and Hlonelwa Lutuli place this in the Regulator’s tenth-anniversary year. Their discussion of the South African Bureau of Standards makes an important distinction – enforcement concerned underlying compliance failures, not simply the fact that a cyberattack occurred.

That distinction matters. Nobody can promise an incident-free existence, but avoidable chaos shouldn’t be presented as an unforeseeable act of God. A firm needs to be able to explain what it did to prevent the problem, not merely how surprised its leadership was when it happened.

Conveyancing fraud: the uninvited guest in the inbox

The payment instruction is the opportunity. In the pattern Fazel Bulbulia describes in De Rebus, fraudsters intercept a conveyancer’s email and substitute their own banking details. The recipient believes the instruction’s genuine and pays the wrong account. Familiar correspondence isn’t independent verification, however reassuring the letterhead.

By the time the dispute turns to who should’ve checked what, the payment’s already gone to the wrong account. The effort would be better spent on verification than on preparing a persuasive account of why nobody did it.

Verification belongs in the payment process, including independent confirmation using a previously verified telephone number. Expecting every employee to become a forensic linguist isn’t a sensible defence against manipulated trust-account instructions.

Nor should firms treat Edward Nathan Sonnenberg Inc v Hawarden (421/2023) [2024] ZASCA 90; 2024 (5) SA 9 (SCA), decided on 10 June 2024 as permission to relax. The Supreme Court of Appeal rejected liability on the facts, including the purchaser’s compromised mailbox, her ability to protect herself and the absence of an attorney-client relationship with ENS.

That’s a decision about delictual wrongfulness arising from a 2019 transaction, not a ruling that today’s POPIA security duties disappear. Michalsons’ analysis expressly warns against that reading – the events preceded the commencement of POPIA’s substantive processing provisions. Remember – winning an argument about who carries a loss isn’t the same as preventing it.

Client confidentiality: WhatsApp isn’t a filing policy

Law firms hold ID documents, bank statements, medical records in personal injury and Road Accident Fund matters, as well as intimate family-law histories. The people behind those documents didn’t retain legal representation only to become involuntary case studies in information leakage.

The risks need consideration before a file goes through WhatsApp, documents reach a personal email account or a client’s papers land in a free online tool. None of those labels settles legality by itself. The questions are who can access the information, where it’s retained, what the terms permit and whether the disclosure’s justified.

Under the POPIA, security safeguards aren’t merely an IT purchasing decision. They’re part of lawful processing. Confidentiality deserves an operational budget, not just a handsome paragraph in the engagement letter.

Nor does section 22 of POPIA give a firm a leisurely public-relations interval. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Regulator and, subject to the statutory exceptions, affected data subjects as soon as reasonably possible after discovery. The Act allows for legitimate law-enforcement needs and measures reasonably necessary to establish the scope and restore system integrity. It doesn’t impose a blanket 72-hour deadline. Sadly, embarrassment isn’t a statutory exception.

A ten-point POPIA health check for law firms

For small and mid-sized firms, the following checks offer a practical starting point. They’reinformed by the college findings and POPIA, not ten statutory boxes that magically confer an immunity idol –

1. Register the Information Officer – a firm should confirm the appointment, registration,and deputy arrangements, then give the role enough authority, time, and resources to do the work. The title alone won’t help when the incident call comes.

2. Map the information – what personal information does the firm hold, and why does itneed it? The exercise needs to establish where it lives and who receives it, including the paper files, phones, and exports everyone’s forgotten about.

3. Restrict access – staff need individual accounts with appropriate permissions, and access should be removed promptly when they leave. If everyone uses the same password, working out who did what becomes a rather pointless group discussion.

4. Strengthen sign-in – strong, unique passwords, managed devices, and multi-factor authentication where available belong in the routine, including for the busiest partner. Especially when they’d prefer a permanent exemption.

5. Control document sharing – approved channels and clear rules for personal email, messaging and online tools need to be agreed. The approved route also needs to be usable. Otherwise, the firm has written a policy people will purposefully work around.

6. Verify payment instructions – before money leaves, new or changed banking details need independent confirmation, recorded verification and the appropriate approval. However urgent the request, that process stays.

7. Check service providers – security commitments, operator agreements, access arrangements, and breach escalation all need scrutiny. Processing happening elsewhere isn’t evidence that the provider’s handling everything.

8. Keep records purposefully – forever isn’t a filing strategy. A defensible retention schedule accounts for legal obligations and litigation holds, with secure deletion when justified.

9. Rehearse incident response – the plan should identify decision-makers, provide for evidence preservation and containment, and ensure notification is assessed promptly. It needs rehearsal. An actual incident’s a poor time to discover that nobody knows who’s in charge.

10. Train and test – training needs realistic scenarios, alongside recovery testing and regular control reviews. Improvements should be recorded. The attendance register matters, but it won’t establish whether anyone understood the session or whether the firm’sarrangements are resilient and compliant.

The unresolved items then need to reach management, with named owners and deadlines. If everything’s everyone’s responsibility, the eventual recipient of the Regulator’s letter may become the compliance lead by default – usually whoever’s nearest the printer.

---

Build safer legal workflows with AJS

A working day in which filing a client’s documents properly is easier than sending them to whichever inbox happens to be open would be a useful start. Another solemn promise about data protection won’t get a firm there. A system its staff can actually use has a better chance.

AJS describes guarded data centres, multi-server redundancy and encrypted daily backups. Its centralised KYC records offer an alternative to scattering identity documents across inboxes and desktops. The Outlook and Word toolbar files correspondence and documents into matters, while browser-based access lets authorised staff work remotely.

That’s a practical starting point for a better-controlled workflow, not a compliance guarantee. Filing an email doesn’t automatically remove every mailbox copy, permissions, retention, training, and payment verification still need attention. The point is to make good practice easier, not to buy an alibi.

For firms ready to replace digital improvisation with a more coherent approach, a conversation with AJS is a practical next step. A walkthrough of the firm’s actual document and matter workflows should cover access, hosting, and recovery arrangements. Awkward questions belong on that agenda. They’re cheaper than an incident.

– Written by Alicia Koch on behalf of AJS

(Sources used and those to whom we owe thanks – Information Regulator fines Central Johannesburg TVET College and First National Bank for POPIA contravention; Enforcement Notices; Protection of Personal Information Act 4 of 2013 (sections 19, 22 and 105); Section 22 Notification of security compromises; Bank fined R1m for not protecting customer data; Information Regulator’s first enforcement notice for 2026; The Regulator is Watching: New Enforcement Signals for POPIA and PAIA Compliance; South Africa’s Information Regulator Moves POPIA Enforcement from Complaint Response to Sector Targeting; Business e-mail compromise: A critical solution to protect attorneys, conveyancers, and the public; Edward Nathan Sonnenberg Inc v Hawarden (421/2023) [2024] ZASCA 90; 2024 (5) SA 9 (SCA), 10 June 2024 and court’s accompanying media summary; Admire Moyo, InfoReg exposes POPIA violators as data breaches mount, ITWeb, 14 November 2025; Michalsons, Edward Nathan Sonnenbergs (ENS) v Hawarden | BEC, 14 June 2024)