Department of Justice and Constitutional Development

Administrative fine imposed. Information Regulator, 3 July 2023.

Record ID

za-ir-2023-0003

Jurisdiction

South Africa

Regulator

Information Regulator

Type

penalty notice

Date decided

3 July 2023

Respondent type

public

Sector

government

Violations

inadequate security safeguards, failure to notify data subjects of breach, non-compliance with enforcement notice

Provisions cited

POPIA 2013 s.19, POPIA 2013 s.22

Outcome

administrative fine imposed

Penalty

ZAR 5,000,000 (≈ USD 265,000 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 67f4d5f51fe96bda…

Record verified

30 July 2026

The facts

The Information Regulator had issued an enforcement notice to the Department of Justice and Constitutional Development on 9 May 2023 after finding contraventions of POPIA arising from a security compromise, requiring the department to prove within 31 days that its Trend Anti-Virus, SIEM and Intrusion Detection System licences had been renewed and to institute disciplinary proceedings against the officials who failed to renew them. The deadline expired on 9 June 2023 with no report or communication from the department, which also did not exercise its right of appeal. The Regulator determined the department had failed to comply with the enforcement notice.

Orders and outcome

An infringement notice was issued ordering the department to pay an administrative fine of R5 million, with 30 days from 3 July 2023 to pay, arrange payment in instalments, or elect to be tried in court on a charge of the alleged offence. Dated 3 July 2023.

ADMINISTRATIVE-FINE · SECURITY-SAFEGUARDS · BREACH-NOTIFICATION · FIRST-OF-KIND

Cite this decision

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.