Electoral Commission of South Africa (IEC)

Enforcement notice issued. Information Regulator, 11 September 2024.

Record ID: za-ir-2024-0005
Jurisdiction: South Africa
Regulator: Information Regulator
Type: enforcement notice
Date decided: 11 September 2024
Respondent type: public
Sector: government
Violations: inadequate access controls, unauthorised disclosure, inadequate security safeguards
Provisions cited: POPIA 2013 s.19
Outcome: enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 b4458174b8bc1ab6…
Record verified: 30 July 2026

The facts

After candidate nomination lists of two political parties leaked and spread on social media before the May 2024 national and provincial elections, the Information Regulator assessed the Electoral Commission's security systems and found it lacked adequate access control measures to protect the confidentiality of personal information, and that its breach notification to affected data subjects was inadequate.

Orders and outcome

Enforcement notice issued against the Electoral Commission. Announced September 2024.

ELECTIONS · UNAUTHORISED-DISCLOSURE · ACCESS-CONTROLS

Cite this decision

Information Regulator (South Africa), Electoral Commission of South Africa (IEC), enforcement notice of 11 September 2024. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/south-africa/information-regulator/2024/electoral-commission-candidate-data/ (accessed 30 August 2026).

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.