South African Police Service (SAPS)
Enforcement notice issued. Information Regulator, 6 April 2023.
The facts
After the July 2022 Krugersdorp sexual assaults, the survivors' personal information, including names, ages, addresses and details of the assaults, was circulated on WhatsApp within the South African Police Service and later on social media. Following an own-initiative investigation, the Regulator found SAPS processed personal information unlawfully and unreasonably, failed to take reasonable technical measures against unlawful access, and failed to notify the Regulator and the data subjects of the security compromise.
Orders and outcome
An enforcement notice ordered SAPS to notify the data subjects of the compromise, publish an apology, investigate the members responsible, and build POPIA training into all SAPS training programmes. Reported April 2023.
Cite this decision
Track South Africa enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.