Department of Justice and Constitutional Development

Administrative fine imposed. Information Regulator, 3 July 2023.

Record ID: za-ir-2023-0003
Jurisdiction: South Africa
Regulator: Information Regulator
Type: penalty notice
Date decided: 3 July 2023
Respondent type: public
Sector: government
Violations: inadequate security safeguards, failure to notify data subjects of breach, non-compliance with enforcement notice
Provisions cited: POPIA 2013 s.19, POPIA 2013 s.22
Outcome: administrative fine imposed
Penalty: ZAR 5,000,000 (≈ USD 265,000 at the decision date)
Status: final
Source: Official document ↗
Record verified: 14 March 2026

Summary

The Information Regulator issued the first administrative fine under POPIA, R5 million against the Department of Justice and Constitutional Development, on 3 July 2023. The fine followed a May 2023 enforcement notice after a 2021 security breach: the Department had failed to implement adequate security safeguards, failed to notify affected data subjects, and then failed to comply with the enforcement notice.

ADMINISTRATIVE-FINE · SECURITY-SAFEGUARDS · BREACH-NOTIFICATION · FIRST-OF-KIND

Cite this decision

Information Regulator (South Africa), Department of Justice and Constitutional Development, penalty notice of 3 July 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/south-africa/information-regulator/2023/department-of-justice-r5m-administrative-fine/ (accessed 22 July 2026).

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.