Stephanus Johannes Stehan Grobler (former director, Steinhoff International Holdings)
USD 265,000
median penalty (USD approx.)
across 5 penalties
2026-04
latest decision
data updated 22 July 2026
The law
Protection of Personal Information Act 4 of 2013 (POPIA) IN FORCE
commenced 2021-07-01 (full effect; commenced 2020-07-01 with one-year grace) · Official full text ↗
Scope
Processing of personal information entered in a record by or for a responsible party domiciled in South Africa, or using means in South Africa.
Key obligations
Eight conditions for lawful processing (ss.8-25); Information Officer registration with the Regulator; Prior authorisation for certain processing (ss.57-58); Direct marketing opt-in regime (s.69)
DPO required
Information Officer (statutory default: head of the body) plus deputies; registration required.
Registration
Information Officer registration; no general controller registration.
Cross-border transfers
s.72: transfers only with adequate protection (law/binding rules/agreement), consent, contract necessity, or subject benefit.
Breach notification
s.22: notify Regulator and data subjects as soon as reasonably possible after discovery of compromise.
Penalties
Administrative fines up to ZAR 10,000,000; criminal offences up to 10 years' imprisonment for certain violations.
Authority
Information Regulator (also administers PAIA 2000)
Verified 2026-07-06
Access to information
Promotion of Access to Information Act 2000 (PAIA) IN FORCE