Lancet Laboratories

Enforcement notice issued; fine paid for non-compliance. Information Regulator, September 2024. month-precision date

Record ID: za-ir-2024-0006
Jurisdiction: South Africa
Regulator: Information Regulator
Type: enforcement notice
Date decided: September 2024
Respondent type: private
Sector: healthcare
Violations: inadequate security safeguards, repeated security compromises, delayed breach notification
Provisions cited: POPIA 2013 s.19, POPIA 2013 s.22
Outcome: enforcement notice issued; fine paid for non-compliance
Status: final
Source: Official document ↗
Record verified: 14 March 2026

Summary

The Information Regulator issued an enforcement notice against medical laboratory Lancet Laboratories following multiple data breaches, ordering urgent implementation of adequate security safeguards. Lancet had failed to notify data subjects of the breaches within a reasonable timeframe. A November 2025 regulator briefing recorded that the company later paid a fine for non-compliance with the notice; the amount was not disclosed.

HEALTHCARE · DATA-BREACH · BREACH-NOTIFICATION

Cite this decision

Information Regulator (South Africa), Lancet Laboratories, enforcement notice of September 2024. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/south-africa/information-regulator/2024/lancet-laboratories-security-breaches/ (accessed 22 July 2026).

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.