TransUnion (Pty) Ltd

Enforcement notice issued. Information Regulator, 26 March 2024.

Record ID

za-ir-2024-0002

Jurisdiction

South Africa

Regulator

Information Regulator

Type

enforcement notice

Date decided

26 March 2024

Respondent type

private

Sector

credit reference

Violations

inadequate security safeguards, failure to implement remedial measures after breach

Provisions cited

POPIA 2013 s.19

Outcome

enforcement notice issued

Status

final

Source

Official document ↗

Record verified

14 March 2026

Summary

The Information Regulator ordered credit bureau TransUnion to implement comprehensive remedial security measures following its 2022 data breach that affected millions of South Africans. TransUnion was given until 26 May 2024 to submit proof of compliance.

SECURITY-SAFEGUARDS · DATA-BREACH · CREDIT-BUREAU

Cite this decision

Track South Africa enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.