Lancet Laboratories

Complaint upheld; enforcement notice issued; infringement notice issued. Information Regulator, September 2024.

Record ID

za-ir-2024-0006

Jurisdiction

South Africa

Regulator

Information Regulator

Type

enforcement notice

Date decided

September 2024

Respondent type

private

Sector

healthcare

Violations

inadequate security safeguards, repeated security compromises, delayed breach notification

Provisions cited

POPIA 2013 s.19, POPIA 2013 s.22

Outcome

complaint upheld; enforcement notice issued; infringement notice issued

Penalty

ZAR 100,000 (≈ USD 5,440 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 2a4071f08e739980…

Record verified

30 July 2026

The facts

Lancet Laboratories suffered multiple data breaches and did not notify affected data subjects within a reasonable period. The Information Regulator issued an enforcement notice in September 2024 ordering it to urgently implement adequate security safeguards, establish and maintain proper breach notification processes so affected data subjects are notified without undue delay, and review and update its internal breach-disclosure procedures. When Lancet failed to meet the requirements, the Regulator imposed a R100,000 penalty through an infringement notice, which the Regulator's chairperson confirmed has been paid.

Orders and outcome

Enforcement notice with the security, notification and procedure requirements above; on non-compliance, an infringement notice imposing a R100,000 fine, which Lancet paid.

HEALTHCARE · DATA-BREACH · BREACH-NOTIFICATION

Cite this decision

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.