TransUnion (Pty) Ltd

Enforcement notice issued. Information Regulator, 26 March 2024.

Record ID: za-ir-2024-0002
Jurisdiction: South Africa
Regulator: Information Regulator
Type: enforcement notice
Date decided: 26 March 2024
Respondent type: private
Sector: credit reference
Violations: inadequate security safeguards, failure to implement remedial measures after breach
Provisions cited: POPIA 2013 s.19
Outcome: enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 3d2216fd07e1fd17…
Record verified: 30 July 2026

The facts

Following the 2022 TransUnion hack, in which attackers demanding a ransom claimed access to millions of South Africans' personal records, the Information Regulator investigated and announced on 26 March 2024 that it had issued an enforcement notice against the credit bureau, joining earlier notices against Dis-Chem, SAPS and the Department of Justice and Constitutional Development.

Orders and outcome

Enforcement notice issued; the announcement did not detail the corrective steps ordered. Announced 26 March 2024.

SECURITY-SAFEGUARDS · DATA-BREACH · CREDIT-BUREAU

Cite this decision

Information Regulator (South Africa), TransUnion (Pty) Ltd, enforcement notice of 26 March 2024. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/south-africa/information-regulator/2024/transunion-security-remediation/ (accessed 30 August 2026).

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.