On 7 October 2026, the Constitutional Court (“the Court”) delivered a unanimous judgment addressing a question on which the High Court and the Supreme Court of Appeal had reached opposite conclusions: whether post-commencement creditors are entitled to vote on the adoption of a business rescue plan. The Court held that they are not.

In Salungano Group Ltd v Mashwayi Projects (Pty) Ltd and Others; Ndalamo Coal (Pty) Ltd v Mashwayi Projects (Pty) Ltd and Others [2026] ZACC 38, the Constitutional Court of South Africa upheld the appeals against the decision of the Supreme Court of Appeal and declared that Chapter 6 of the Companies Act 71 of 2008 (“the Act“) does not permit post-commencement creditors to vote on the adoption of a business rescue plan.

The Court emphasised that statutory interpretation cannot be approached by reference to dictionary meanings alone. Instead, the term “creditor” had to be interpreted in light of the text, context and purpose of Chapter 6 of the Act.

While acknowledging that business rescue proceedings do not create a concursus creditorum as in liquidation proceedings, the Court held that the business rescue framework is nonetheless built around a defined body of creditors whose claims existed when business rescue proceedings commenced.

The Court’s decision turned principally on the text and structure of Chapter 6 of the Act.

As a starting point, the Court held that section 145 of the Act only defines three categories of creditors: secured, unsecured and concurrent. This, together with the fact that the term “creditor” was left undefined in Chapter 6, led the Court to conclude that post-commencement creditors are not entitled to vote to adopt a business rescue plan.

The Court also rejected the argument that the reference to “each creditor” in section 145(2) of the Act, which confers the right to vote on a business rescue plan, extends that right to post-commencement creditors. It noted that section 145(1)(c) entitles creditors to participate formally in business rescue proceedings only “to the extent provided for” in Chapter 6, which allows for the possibility that not all creditors may vote. Voting interests are determined by reference to claims admitted or proved in the business rescue proceedings. The mere fact that a person appears in the company’s books as a creditor therefore does not, on its own, confer a right to vote on the plan.

In particular, section 150(2)(a)(ii) of the Act requires a business rescue plan to identify the company’s creditors when the business rescue began, together with details of their ranking in accordance with insolvency law. The Court considered this significant because it establishes a defined creditor body against which voting interests can be determined.

Importantly, the Act does not require post-commencement creditors to be identified in the business rescue plan, nor does it prescribe any mechanism for incorporating their claims into the statutory voting architecture. The Court considered this omission a deliberate choice by the Legislature, and one that leads to the ineluctable conclusion that post-commencement creditors do not get to vote on a business rescue plan.

Who gets a say?

A key aspect of the Court’s reasoning was the distinction between the rights afforded to pre-commencement creditors and the protections afforded to post-commencement financiers.

The Court found that granting post-commencement creditors both preferential repayment rights and voting rights would upset the carefully calibrated balance created by Chapter 6. Pre-commencement creditors are the parties whose claims stand to be compromised by a business rescue plan. By contrast, post-commencement financiers receive statutory protection in respect of the ranking of their claims and are not intended to participate in deciding whether such compromises should occur.

The judgment notes that, because of their enhanced security and preferential status, post-commencement financiers who were also entitled to vote would distort the collective decision-making of pre-commencement creditors in a manner not contemplated by the Act. The Court added that it would be inherently unfair for a creditor whose rights are not curtailed by the plan to vote on a plan that could deprive pre-commencement creditors, particularly unsecured creditors, of a substantial portion of their claims.

The Court emphasised that, even on its reading of the Act, post-commencement financiers remain incentivised to fund business rescue proceedings. Section 135 of the Act grants post-commencement financiers a statutory “super-preference” in respect of repayment. This enhanced protection exists precisely to encourage lenders, suppliers and other stakeholders to continue supporting a financially distressed company during business rescue. The Court viewed this preferential treatment as the legislative bargain struck by Chapter 6: protection through repayment priority rather than governance through voting rights.

Certainty, predictability and the financing trade-off

The Court was also persuaded by practical considerations. It held that allowing post-commencement creditors to vote would create uncertainty because the voting constituency could change as additional debts are incurred during the rescue process. This would make it difficult for business rescue practitioners to determine voting interests and assess whether the statutory voting thresholds had been met.

By limiting voting rights to creditors existing at the commencement of business rescue, the Act promotes certainty, predictability and the efficient administration of rescue proceedings. The Court considered these objectives central to the successful operation of the business rescue regime.

The implications for business rescue stakeholders

This judgment is the final word in the debate relating to the voting rights of post-commencement financiers.

It provides clarity for business rescue practitioners, existing creditors and potential post-commencement financiers, particularly when determining voting interests and during business rescue. There is no doubt that the judgment will shape restructuring and business rescue practice for years to come.

In particular, the judgment confirms that –

• the voting constituency on a business rescue plan is determined by reference to creditors existing when business rescue commenced;
• post-commencement creditors are not entitled to vote on the adoption of a business rescue plan, even though they are creditors of the company;
• while post-commencement creditors are not entitled to vote to adopt a business rescue plan, they are protected by other mechanisms, such as the statutory preference afforded by section 135 of the Act; and
• allowing post-commencement creditors to vote would undermine certainty and predictability in the business rescue process.

The post Voting rights not afforded to post-commencement creditors appeared first on Werksmans Attorneys.

For decades, the detection of cartels has been heavily reliant on a familiar trinity: the leniency applicant who breaks ranks, the disgruntled employee who blows the whistle, and the dawn raid that turns up the incriminating notebook. That model is changing. Competition authorities around the world are now deploying artificial intelligence (AI)  tools to sift through procurement data to detect statistical fingerprints of collusion. This follows a global trend of competition agencies across the world making use of AI tools to detect bid-rigging. It was only a matter of time until South Africa followed in these footsteps.

The South African development

It is reported that the South African Competition Commission is in the process of developing an AI tool to help identify suspected bid-rigging in the local public procurement industry. Commissioner Doris Tshepe told Parliament’s Select Committee on Economic Development and Trade on 30 September 2026 that the tool would assist the Commission in identifying potential cartel conduct in electronic public procurement. The tool is reportedly being developed with the assistance of the Competition and Consumer Commission of Singapore and AI specialists at the University of Pretoria.

This is a logical step considering that countries such as Singapore, Pakistan and Brazil have experienced much success with tools of a same kind, this is according to the Stanford Computational Antitrust’s Fifty Cross-Agency Report which was published in September 2026.

Collusive tendering is one of the forms of horizontal conduct prohibited outright under section 4(1)(b)(iii) of the Competition Act 89 of 1998, and public procurement has long been a priority enforcement area for the Commission. Importantly, the raw material for such a tool already exists: National Treasury publishes procurement data captured through the eTender portal, covering procurement plans, tenders, awards and contracts, in open, reusable formats.

What the rest of the world is doing

The Commission’s initiative places South Africa within a clear and accelerating international trend.

• United Kingdom. The CMA launched an algorithm-based “Screening for Cartels” tool for public procurers in December 2017, designed to flag unusual bidder behaviour and pricing patterns. That downloadable tool was withdrawn in 2020, and the CMA has since built an in-house capability, the Bid Rigging Intelligence Tool (BRIT), which it describes as offering cutting-edge capabilities to analyse public-sector data at scale. In September 2026 the CMA’s Chief Executive estimated that bid-rigging could be costing UK taxpayers between £1 billion and £3.5 billion a year, and the CMA’s Annual Plan 2026 to 2027 commits to using AI and other data science tools to scan bidding data and identify illegal activity at scale. Notably, the deterrent stakes have risen: under the Procurement Act 2023 debarment regime, cartelists face inclusion on a central debarment register and exclusion from public tenders for up to five years.
• Spain. The Spanish competition authority (CNMC) has built its own procurement database and screening tool, BRAVA (Bid Rigging Algorithm for Vigilance in Antitrust), drawing on data that includes losing bids. The CMA reports that the CNMC claims a classification success rate of at least 90%, and that the CNMC has begun developing ATENEA, an agentic reasoning system to analyse and interpret data flagged by BRAVA.
• Brazil and others. According to the CMA, the Brazilian competition authority receives procurement data directly from public bodies, allowing it to apply AI screens to detect cartels. The CMA has also pointed to Portugal and Korea as jurisdictions using data screening tools to find suspicious patterns at scale, and the 2022 compendium referred to similar initiatives in Australia, Canada and the United States.
• European Union. In its 2021 Notice on tools to fight collusion in public procurement (2021/C 91/01), the European Commission encouraged Member States to collect and analyse large volumes of electronic procurement data, “possibly using algorithms, artificial intelligence algorithms or machine learning”, and to give competition authorities access to procurement databases. At the enforcement level, the Commission’s DG Competition has invested in data analysis capability for its ex officio cartel detection work, run machine-learning proofs of concept to support investigations, and leads AI literacy initiatives to ensure that AI is applied safely and effectively in enforcement.

The lesson from abroad: data is everything

The single clearest message from the international experience is that an AI tool is only as good as the data it is fed. The CMA has been candid that BRIT cannot reach its true potential because, unlike in many other countries, losing-bid data is not routinely collected in the UK or made available in a consistent, machine-readable format. Spain’s success, by contrast, rests on a legal requirement to collect specified information about all participating tenderers.

For South Africa, the success of the Commission’s tool will therefore depend less on the sophistication of the algorithm and more on the completeness and quality of the procurement data, including bids by unsuccessful tenderers, pricing detail and bidder ownership information, and on the degree of cooperation between the Commission, National Treasury and organs of state at national, provincial and municipal level.

Questions of fairness and governance

The use of AI by a regulator also raises legitimate questions. An algorithmic flag is a screening signal, not evidence of contravention. Firms may legitimately ask how a tool was trained, what thresholds it applies, and whether its outputs are being treated as a basis for initiating complaints, conducting searches or applying for information. Internationally, regulators are mindful of these concerns: the Commission’s 2021 Notice repeatedly emphasises compliance with data protection law, and the EU AI Act (Regulation (EU) 2024/1689) now imposes a governance framework on certain uses of AI, including by public authorities. In South Africa, the Protection of Personal Information Act 4 of 2013 will be relevant where personal information is processed, and the constitutional requirements of lawful, reasonable and procedurally fair administrative action continue to apply. We would expect the Commission to keep a human investigator firmly in the loop, and to be transparent about the role played by the tool in any proceedings.

What this means for business

Companies that tender for public contracts, and their advisers, should take note:

• Detection risk is rising. Cartel members can no longer assume that conduct will only come to light if a co-conspirator applies for leniency. By way of example, the Swiss Competition Authority has shared that the use of Al tools to detect big rigging has reduced its reliance on whistleblower information to investigate alleged cartel.  Patterns such as bid rotation, cover pricing, consistent price gaps and geographic allocation are exactly what screening tools are designed to detect.
• The leniency calculus changes. As the probability of independent detection increases, the value of being first through the door under the Commission’s Corporate Leniency Policy increases with it. Firms that discover historic misconduct should obtain advice promptly.
• Compliance must be data-aware. Compliance programmes should include periodic reviews of a firm’s own tendering history, careful control of contacts with competitors (including in joint ventures, subcontracting and consortium bids), and documentation of independent bid determination.
• Consequences go beyond fines. Beyond administrative penalties of up to 10% of turnover, bid-rigging can expose firms to procurement exclusions, civil damages claims and, for directors and managers, criminal liability under section 73A of the Competition Act.

Conclusion

The Commission’s AI initiative, developed with international and academic partners, reflects a global shift from reactive to proactive cartel enforcement. If properly resourced, supported by good-quality procurement data and applied with appropriate safeguards, it has the potential to change the risk profile of public procurement in South Africa significantly. For firms that participate in public tenders, the time to review competition compliance is now, before the algorithm does it for them. In our view, this signals the beginning of new era for competition compliance in South Africa, mainly that Al tools will have a meaningful impact on the enforcement of competition law against anti-competitive practices. What lies ahead however…remains to be seen.

The post The algorithm will see you now: Competition Regulators turn to AI to catch bid-riggers appeared first on Werksmans Attorneys.

If your business manufactures, distributes or repairs phones, appliances, medical devices or other durable goods, this update is for you.

During the first week of October 2026 the Competition Commission published its Guidelines on Repair, Service and Maintenance Aftermarkets under section 79 of the Competition Act 89 of 1998. They build on the automotive aftermarket guidelines the Commission issued in 2021 and amended in September 2024. The Commission has now concluded that the same problems they identified in relation to cars, namely independent repairers being shut out, also arise with electronics, appliances and other durable goods.

Technically, the Guidelines are not binding. In practice, they matter a great deal. Put simply, the Commission has told the market where it intends to look, and manufacturers (OEMs), distributors and authorised repair networks should pay attention.

Scope: what’s in and what’s out

The Guidelines cover repair, service and maintenance for all devices, products and components. The one exception is motor vehicles, which remain under the separate automotive guidelines. The Commission expects the Guidelines to have the biggest impact in five specific areas:

• mobile phones, tablets and gaming consoles
• audiovisual equipment
• white goods
• medical devices
• back-up water and electricity systems

The main focus is on repairs that the customer pays for outside warranty. However, a product being under warranty does not automatically take every related repair out of the picture.

Market definition: don’t count on the “systems market” argument

This is the most important analytical point in the Guidelines. OEMs have often argued that competition in selling the product keeps their after-sales conduct in check. The Commission is clearly unlikely to accept that argument easily.

Its starting point is that selling the product and repairing it are separate markets. It notes that the conditions for treating them as one “systems” market, such as buyers costing repairs over the whole life of the product, low switching costs and generic parts, are rarely met in practice. If you want to argue otherwise, you will need evidence to back it up. This follows the US Supreme Court’s decision in Eastman Kodak. The Court held that a firm without market power in selling its equipment can still have market power in the aftermarket for its own brand.

Three further points are worth noting:

• You can have market power in the aftermarket even if you face strong competition when selling the product.
• You can have that power even if you do not carry out repairs yourself.
• The Commission will look at the size of your installed base, how many existing customers are “locked in” compared with new buyers, and how much control you have over parts, diagnostics and software.

Spare parts: where enforcement will start

If there is one message to take away, it is this: restricting access to spare parts is a serious concern for the Commission, and the Commission has made it an enforcement priority.

The concern goes well beyond refusing to supply. It also covers discriminatory supply terms, margin squeeze and tying. It covers less obvious tactics too, such as:

• insisting on proprietary tools where ordinary tools would do the job
• “parts pairing” software that stops a replacement part working unless the OEM activates it
• warning messages that appear after an independent repair

Setting minimum resale prices for parts, tools or repair services is prohibited outright.

There is also an important procedural change. If the Commission finds a restriction on spare parts, it will expect you to explain and support your justification. You will need to show that the restriction is necessary and proportionate. Where conduct looks exclusionary on its face, any justification will be held to a higher evidentiary standard.

Other conduct on the radar

Spare parts are not the only concern. The Commission will also look at:

• Other repair inputs, such as manuals and diagnostic tools, including margin squeeze, conditional supply and less favourable non-price terms.
• Accreditation schemes that are not transparent or proportionate, or that are applied inconsistently.
• Opaque pricing that leaves independent service providers (ISPs) unable to work out their costs.
• Steering customers away from ISPs, for example by making repair uneconomic compared with replacement, offering loyalty rewards tied to OEM repair, or making switching difficult.
• Warranty terms that restrict customer choice more than is needed to run the warranty.

Justifications: available, but narrow

None of this means that OEMs cannot protect legitimate interests. The Commission accepts that intellectual property, safety and regulatory compliance can justify a restriction. However, any justification must be specific and must go no further than necessary:

• Intellectual property. IP in one component will not normally justify restricting repairs to unrelated parts.
• Regulatory requirements. If you rely on an NRCS, EPR or product-specific rule, you must identify the actual instrument and show that your conduct goes no further than it requires.
• Security and safety components. Accreditation controls limited to security- or safety-critical components are acceptable if they are objective, transparent and non-discriminatory. Accredited ISPs must also get access on terms at least as good as those given to your authorised network.

This reflects the EU’s CEAHR decision, where selective repair systems were upheld because any repairer meeting objective criteria could join.

Conclusion: what to do now

These Guidelines bring South Africa into line with right-to-repair developments in the EU. They also reflect the Act’s wider aim of opening markets to SMMEs and historically disadvantaged persons. Our practical advice is to take five steps now:

• Audit your aftermarket arrangements. Look closely at spare parts policies, distribution and exclusivity agreements, and authorised repairer contracts for both direct and indirect restrictions.
• Review software and design. Check whether parts pairing, activation controls or diagnostic access block independent repair without good reason.
• Prepare your justifications now. The Commission expects them early, so record the regulatory, safety or IP reason for each restriction and the specific legal instrument behind it.
• Test your accreditation and warranty terms. Make sure they are transparent, proportionate and non-discriminatory, and limited to what the warranty genuinely requires.
• Don’t assume being smaller protects you. Firms below the section 6 dominance threshold can still be caught by section 5 if their vertical agreements restrict competition.

For independent repairers, the Guidelines provide a clear basis for raising complaints. For everyone else, the conclusion is simple: how you run your aftermarket is now as much a competition compliance question as a commercial one.

The post Fixing the aftermarket: What the Competition Commission’s new Repair Guidelines mean appeared first on Werksmans Attorneys.

A company in business rescue may be entirely dependent on revenue streams generated by an asset that is essential to the continuation of its business. But what happens where it is established that the asset belongs to a third party and the agreement under which the company was entitled to use the asset has already been cancelled?

This issue arose in Capitec Bank Ltd v Ubuntu Family Health Centre Grayston (Pty) Ltd [1], concerning a Porsche 911 Carrera S. Although the make of the vehicle makes the dispute particularly memorable, the underlying principle has broader application to businesses in rescue that rely on property they do not own.

Ubuntu acquired the Porsche pursuant to an instalment sale agreement financed by Capitec. In terms of the agreement, ownership of the vehicle remained with Capitec until Ubuntu had discharged all amounts owing. Following Ubuntu’s default, Capitec demanded payment of the outstanding arrears and, when those arrears remained unpaid, cancelled the agreement on 17 November 2023. Despite the cancellation, Ubuntu retained possession of the Porsche. Twelve days later, on 29 November 2023, Ubuntu adopted a resolution commencing business rescue proceedings. Capitec subsequently approached the court for the return of the vehicle.

The High Court dismissed Capitec’s application. It held that Ubuntu’s possession would be unlawful for purposes of the moratorium in section 133 of the Companies Act only if it involved conduct of a criminal nature, such as theft or fraud. Because Ubuntu had originally received the Porsche in terms of a lawful agreement, the High Court found that its possession remained lawful and where any attempt to recover the vehicle was prohibited by the application of the moratorium in business rescue proceedings.

The Supreme Court of Appeal (“SCA“) disagreed. How Ubuntu came to possess the vehicle was only part of the enquiry. The decisive question was whether Ubuntu still had a right to possess it, after the agreement had been cancelled. The cancellation was common cause and had taken place before business rescue commenced. Capitec remained the owner, and Ubuntu had no continuing legitimate right to keep the Porsche. Capitec could therefore seek its return without the business rescue practitioner’s consent.

The SCA was also clear that this result followed established law. Earlier decisions had already recognised that the moratorium does not prevent proceedings to recover property that a company in business rescue neither owns nor lawfully possesses. The High Court was bound by those decisions.

The commercial difficulty is easy to see, and where the decision can have far reaching effect. A rescue may depend on the ongoing use and possession of vehicles, equipment or premises held under agreements with third parties. Revenue generation might be entirely dependent on the continued and undisturbed possession of these assets. Losing access to one of them could place the entire company in jeopardy. Yet the importance of maintaining possession of an asset in a rescue scenario cannot trump the company’s contractual rights. Lawful possession which is established when an asset is delivered to the company, does not guarantee a right to keep it after the agreement is lawfully terminated.

A business rescue practitioner preparing a business rescue plan needs to clearly establish from the outset, which assets the company owns, which it holds under lawful agreements, and whether those agreements remain in force, post the commencement of the rescue process. The determination of the right to continue to lawfully use an essential asset is as important to the prospects of rescue, as the company’s financial projections and will, in certain instances, directly impact on the company’s ability to continue trading.

Owners of assets should be equally careful about the reach of the decision. Capitec’s ownership and the valid cancellation of Ubuntu’s agreement were not disputed. Where cancellation or a continuing right of possession is contested, the outcome for the parties will depend on the relevant agreement and the facts. Business rescue alone neither defeats an owner’s rights nor proves that an owner is entitled to its immediate return.

The SCA ordered Ubuntu to deliver the Porsche to Capitec. The question the judgment leaves for every proposed business rescue practitioner is a practical one: does the company have the legal right to continue to lawfully use the assets on which its plan depends? This analysis needs to happen upfront, and before events transpire that severely impact the company’s ability to continue trading.

The post The Porsche that got away in business rescue appeared first on Werksmans Attorneys.

The Ties that Bind Us

As South Africa commemorates Heritage Month under the theme “Celebrating Our Living Heritage: Strengthening the Ties That Bind Us”, we are reminded that our collective identity extends beyond cultural practices, traditions, and languages. As a constitutional democracy, our heritage is also defined by the foundational democratic values of human dignity, equality, and freedom. The preamble to South Africa’s Constitution explicitly sets our collective national mandate as including the establishment of a society based on these democratic values, as well as social justice and fundamental human rights.

Social justice is a value system, rooted in Ubuntu, that enjoins socially responsible individuals or organisations to act toward positive societal transformation by ensuring that every person attains basic human entitlements including, at least: dignity, freedom, equality and justice. Human rights, as encapsulated in the Constitution—particularly the Bill of Rights—are expressions of the primary legal entitlements which members of South Africa’s society may enjoy or benefit from.

Guided by the above, Werksmans views social justice and human rights not as abstract constitutional concepts, but as fundamental principles underlying a call to action to provide access to justice to disenfranchised members of society. To give meaningful effect to social justice and to the realisation of human rights, Werksmans delivers thousands of hours in pro bono legal services every year in several distinct ways.

How Werksmans Provides Access to Justice

>          Public Awareness, Training, and Rights Literacy: Recognising that a lack of awareness of the law and the rights that people are entitled to is a significant barrier to accessing and enjoying numerous rights, we often publish informative articles online providing insights on various legal issues. Additionally, we present at seminars, webinars, community workshops, and other public engagements to educate members of the public about legal issues that are relevant to them or their communities.

>          Supporting Advocacy Initiatives: Werksmans routinely monitors legislative developments or proposed changes to statutes or government policies. In the event that any proposed changes are unconstitutional, contrary to the public interest, or otherwise violate the human rights of any community, we support civil society organisations by making submissions to Parliament to address any legal shortcomings in the proposals.

>          Community Outreach: As a means of bringing legal services to people in underserved communities, Werksmans operates a dedicated law clinic in Diepsloot, a township located in the north of Johannesburg. By establishing a clinic directly in the community, we eliminate barriers such as finances (e.g. transport costs) and geographical limitations that would otherwise prevent those communities from accessing much-needed legal services. We also staff law clinics for other organisations, such as ProBono.Org.

>          Judicial Support: Beyond assisting clients, Werksmans contributes to the broader administration of justice by providing support to the judiciary. Some of Werksmans’ directors serve—on a pro bono basis—as acting judges in the High Court and in the Labour Court, and as commissioners in the Small Claims Court. This contributes to the strengthening of the judiciary’s capacity, thereby advancing access to justice.

>          Direct Legal Representation: Finally, Werksmans provides legal representation to qualifying individuals (i.e. indigent or disenfranchised persons), communities, and entities (e.g. non-profit or civil society organisations) in general dispute resolution and/or human rights litigation (e.g. constitutional, strategic, impact, or public interest litigation). Through legal representation, Werksmans assists clients to enforce their rights against any transgressors.

Conclusion

By providing access to justice in the ways outlined above, it is Werksmans’ hope that the ties that bind the people and communities of South Africa together are strengthened, while continuing to develop the diverse tapestry of our living heritage.

The post Expressing Our Heritage Through Access to Justice appeared first on Werksmans Attorneys.

When we speak about heritage, we often think about what we have inherited. Our languages, cultures, traditions, music, cuisine, and stories all form part of the heritage that makes South Africa unique. However, heritage is not only what we inherit. It is also what we leave behind.

This question is particularly important to consider during Heritage Month, in a year in which South Africa marks 70 years since the historic Women’s March of 1956 and 30 years since the formal adoption of the Constitution of the Republic of South Africa, 1996. These are milestones that remind us of where we come from and of the society we are building for our children.

What kind of South Africa are we leaving behind for our children?

The discovery of the bodies of nine women in Ekurhuleni since July 2026 has brought the issue of violence against women into sharp focus once again. The circumstances of those deaths are being investigated, but they also force us to confront a wider reality: the protections contained in our laws must translate into safety and dignity in people’s everyday lives.

That brings us back to our legal heritage.

In 1956, more than 20 000 women marched to the Union Buildings to oppose the extension of pass laws to women. The Women’s March has become an important part of our collective heritage. Those women were challenging a legal system that restricted their freedom and dignity.

Seventy years later, our legal framework is fundamentally different. The Constitution places equality, dignity and freedom at the centre of our constitutional democracy. Section 9 guarantees equality and prohibits unfair discrimination. Section 10 protects the right to human dignity. Section 12 protects the right to freedom and security of a person, including the right to be free from all forms of violence from either public or private sources. Section 28 provides specific rights for children, including protection from maltreatment, neglect, abuse or degradation and the requirement that a child’s best interests are of paramount importance in every matter concerning the child.

Our legislation has developed alongside these constitutional protections. For instance, the Domestic Violence Act 116 of 1998 provides a legal framework for protection from domestic violence, including through protection orders. The Domestic Violence Amendment Act 14 of 2021 strengthened that framework by expanding the definition of domestic violence and introducing further obligations relating to reporting and assistance. Additionally, the Criminal Law (Sexual Offences and Related Matters) Amendment Act 32 of 2007 comprehensively reformed the law relating to sexual offences and introduced specific protections for children and persons who are mentally disabled. It has subsequently been amended, including by the Criminal Law (Sexual Offences and Related Matters) Amendment Act 13 of 2021.

Further developments include the establishment of a statutory National Council (in terms of the National Council on Gender-Based Violence and Femicide Act 9 of 2024) which is responsible for strategic leadership and coordination in the prevention of, and response to, gender-based violence and femicide. Furthermore, in November 2025, gender-based violence and femicide was also classified as a national disaster in terms of section 23 of the Disaster Management Act 57 of 2002. This placed responsibility on the National Executive for coordinating and managing the disaster within the existing legislative and contingency framework.

The legal framework is substantial. However, the challenge is making it work where people actually need it.

For a woman experiencing domestic violence, that may mean knowing where to seek help, being able to obtain and enforce a protection order, receiving appropriate advice, and having her report taken seriously. For a child, it may mean that a warning sign is recognised timeously, a disclosure is believed, and the relevant institution responds before further harm occurs.

For those working in public interest law, these issues are not theoretical. They are encountered in consultation rooms, community organisations, police stations, and courtrooms. They are encountered by people who know that something is wrong but do not know which legal remedy is available to them, where to go, or whether anyone will listen. Access to justice therefore requires more than a right on paper. It requires people and institutions willing to help translate that right into something a person can actually use.

This is why access to justice cannot begin and end in the court system. It should begin with a person’s relevant legal information, early advice, a referral to the right service or practical assistance before a situation escalates. It also requires institutions to respond swiftly and effectively when protection is sought and to work together where different forms of interventions are required.

However, and arguably most importantly the law cannot, on its own, create the society we want to leave behind. That requires a culture in which women and children are respected, their dignity is protected, and violence against them is never treated as normal or inevitable.

That culture begins long before a matter reaches the police station or a court. It is shaped in, personal spaces, homes, schools, communities, and workplaces, through what children are taught about respect, how violence is confronted, how victims are treated and whether people are prepared to intervene when they see behaviour that puts another person at risk.

The women who marched in 1956 could not have known exactly what South Africa would look like 70 years later. They were demanding a country in which the law could no longer be used to deny women their freedom and dignity.

Today, equality, dignity and freedom are fundamental constitutional principles and enforceable rights. The responsibility now is to ensure that the progress represented by those rights is reflected beyond the law itself: in how institutions respond, how communities act, and how children learn to understand respect and dignity.

Our children will inherit our Constitution, our laws, and our institutions. They will also inherit the consequences of how those systems operate and the values we choose to pass on. Perhaps the most important question for Heritage Month is not what we will tell our children about the past, but what they will be able to say about the society we built for them.

The legacy we leave them should therefore not be measured only by the laws we enacted. It should be seen in whether women and children are safer, whether violence is confronted rather than normalised, and whether equality, dignity, and freedom are part of everyday life.

Heritage is not only a reflection of where we have come from. It is a responsibility for what comes next. The women of 1956 left us a legacy of courage and resistance to injustice. Our responsibility is to carry that legacy forward by building a society in which women and children can live with dignity, safety and freedom.

The post What Are We Leaving Behind? The Law, Our Heritage, and the South Africa We Owe Our Children appeared first on Werksmans Attorneys.

Introduction

The civil litigation process demands disclosure: Parties are expected to lay their cards on the table by producing relevant documents and allowing the court to adjudicate on the full evidentiary record. This principle, deeply embedded in the rules of court, sits in tension with an equally fundamental imperative: the protection of personal information.

Since the Protection of Personal Information Act No 4 of 2013 (“POPIA“) became fully operational on 1 July 2021, litigants have been called upon to confront a question their European counterparts have grappled with for over a decade: how does one reconcile the breadth of discovery obligations with the discipline of data protection?

The answer is not that one regime displaces the other: POPIA does not create a blanket bar to civil discovery; nor do the Rules of Court displace data protection. Rather, data privacy law constrains how discovery is conducted, requiring proportionality in every step of personal data processing. This article discusses how litigants can conduct lawful discovery while still ensuring their POPIA obligations are met. It provides practical steps for common discovery pitfalls.

Discovery and POPIA in a Nutshell: the Balance Between Disclosure and Data Protection

Discovery is a process in the High Court and Magistrates’ Court (rules 35 and 23 respectively) requiring parties to disclose relevant documents by sworn affidavit. Parties may request the production of specific documents; and access to discovered documents. Non-compliance can result in the court mandating compliance, adverse costs, or exclusion of undisclosed documents at trial.

POPIA regulates how organisations process personal information. Although courts are exempt in respect of their judicial functions, litigants are not. Discovery invariably involves processing personal information, including by recording, sharing, and storing discovery materials.  POPIA’s conditions for lawful processing therefore apply.

This tension is not unique to South Africa. In Norra Stockholm Bygg AB v Per Nycander AB, [1] the Court of Justice of the European Union (“CJEU“) held that courts must balance civil disclosure obligations with data protection under the GDPR (POPIA’s European equivalent). In Brillen Rottler, [2] the Court held that the right to data protection “is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality“.

Section 39 of the Bill of Rights requires courts to consider international law when interpreting the Bill of Rights, [3] and the Preamble to POPIA requires processing to be “in harmony with international standards.” The EU experience is therefore not merely comparative; it forms part of the interpretive framework South African courts are constitutionally mandated to engage with.

Common Pitfalls and How to Prevent Them

 We turn to discuss common data-related errors we have identified in practice; and how to prevent them.

(1)   Failing to Identify and Document a Lawful Basis

A common error is failing to identify and record the lawful basis relied on for discovery-related processing of personal information. If later challenged, the responsible party may be unable to demonstrate lawful processing.

For purposes of discovery, the most appropriate basis is usually compliance with a legal obligation: in Divine Inspiration Trading 205 (Pty) Ltd v Katherine Gordon, [4] the High Court recognised the rules of court as delegated legislation sufficient to ground lawful processing. For special personal information – such as health, biometric or criminal data – POPIA permits processing where it is necessary “for the establishment, exercise or defence of a right or obligation in law“. In De Jager v Netcare Limited, [5] the court confirmed that surveillance evidence constituting special personal information was lawfully obtained under this provision.

Legitimate interests may serve as an alternative basis but cannot be used for processing  special personal information. Consent is generally ill-suited to discovery given its strict validity requirements and the risk of withdrawal.

(2)   Overbroad Discovery Requests and the Failure to Define a Litigation Purpose

POPIA requires that personal information may only be processed for a specific, explicitly defined and lawful purpose; and that processing is adequate, relevant and not excessive given its purpose. Accordingly, without a defined litigation purpose, a discovery request cannot satisfy this minimality threshold. [6]

A common mistake is requesting “all documents” without adequate limitation. Where a request cannot be linked to a defined purpose, it is vulnerable to objections of excessiveness. Requests should be framed with reference to the facta probanda or essential facts; and the litigation purpose articulated with sufficient precision to satisfy the aforementioned POPIA requirements.

Where personal information originally collected for other purposes is sought for discovery, further processing must be addressed. POPIA provides that further processing is not incompatible where “necessary for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated.” [7] A bare assertion that information is needed “for litigation” will not suffice: data minimisation and purpose limitation must still be applied.

(3)   Collecting Personal Information from Third-Party Sources Without a Valid Exception

POPIA restricts collection from sources other than the data subject. An exception is where collection is “necessary for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated.” [8] A common error is assuming that litigation automatically authorises collection from any source. Litigants should document the basis on which the exception applies and limit collection to what is necessary for the proceedings.

(4)   Neglecting the Duty to Notify Data Subjects

POPIA requires that data subjects be notified of processing. A common pitfall is the failure to account for litigation-related processing in existing or additional privacy notices. This is especially problematic for high-risk processing related to discovery. Although notification exemptions exist, these must be interpreted narrowly.

(5)   Inadequate Security Safeguards and Data Minimisation Measures

POPIA requires responsible parties to safeguard the integrity and confidentiality of personal information. Parties often fail to implement proportionate safeguards regarding discovery information. POPIA’s security requirements should be applied, including  applying anonymisation and pseudonymisation where possible.

(6)   Non-Compliance with Cross-Border Transfer Requirements

Discovery may involve the transfer of personal information outside South Africa; for example, where e-discovery platforms are located abroad. Litigants should assess this at the outset and ensure they have a lawful basis to transfer the personal information in terms of section 72 of POPIA, such as by way of appropriate contractual safeguards.

(7)   Indefinite Retention of Discovery Material

POPIA requires that personal information not be retained longer than necessary. It is a mistake to indefinitely retain discovery material after proceedings conclude. Litigants should establish retention and deletion policies and processes.

Proportionality as an Overarching Discipline

The lesson we should take from the EU is that proportionality should guide the entire discovery process. Disclosure must satisfy procedural obligations whilst safeguards minimise unnecessary intrusion into privacy. POPIA’s Preamble acknowledges the “fine balance” between privacy and the free flow of information. [9] Practitioners should treat proportionality as an overarching discipline informing every decision in the course of discovery.

Conclusion

POPIA compliance during discovery requires measured judgement, documented policies, proportionate safeguards, and a careful balancing of legal obligations with privacy rights.

As POPIA matures and the Information Regulator becomes more active, the consequences of non-compliance will become increasingly significant. Litigants who develop robust frameworks for discovery will be better positioned to process personal information lawfully, comply with the court of court, and avoid regulatory enforcement.

[1] (Case C‑268/21) EU:C:2022:755.

[2] (Case C‑526/24).

[3] Burns and Burger-Smidt (2023) 113, 158.

[4] [2021] JOL 49822 (WCC).

[5] (2025) JDR 0793 (GP).

[6] POPIA sections 10 and 13.

[7] POPIA section 15(3)(c)(iii).

[8] POPIA section 12(2)(d)(iii); Burns and Burger-Smidt (2023) 234.

[9] POPIA preamble.

The post When discovery meets data privacy: Navigating the tension between litigation obligations and data protection appeared first on Werksmans Attorneys.

The notice is usually brief. Your customer has entered business rescue, a business rescue practitioner has been appointed, and creditors will shortly be invited to submit their claims.

What the notice does not tell you is whether you should stop supplying goods or services, what happens to the invoices already outstanding, whether you can cancel your supply contract, or whether the next order you fulfil will ever be paid.

Those decisions should not be deferred until the business rescue plan is published. By then, you may have supplied another month’s goods or services, missed an opportunity to exercise an important contractual right, or discovered that your claim has been recorded incorrectly.

When a customer enters business rescue, your unpaid account is only the beginning of the enquiry.

Business rescue a game changer for recovery

Business rescue is intended to rehabilitate a financially distressed company by temporarily placing it under the supervision of a business rescue practitioner and allowing a plan to be published and approved by affected persons. The plan may seek to preserve the company as a solvent business. Alternatively, it may propose a restructuring that achieves a better return for creditors than an immediate liquidation.

For creditors, one of the most significant consequences is the general moratorium under section 133 of the Companies Act 71 of 2008 applies. While the rescue continues, legal proceedings and enforcement action against the company, or in relation to property belonging to or lawfully possessed by it, generally cannot be commenced or continued without the practitioner’s written consent or the leave of the court.

The moratorium provides the company with breathing space. It does not extinguish your claim and it does not necessarily suspend your contractual rights.

A creditor exposed to a customer in business rescue may, depending on the circumstances, retain existing rights allowing it to enforce against security held, such as a cession of debtors, a notarial bond registered against the company’s moveable assets or a mortgage bond registered against immovable property. In addition, a suretyship, the application of set-off, reservation of ownership of goods or a valid right to cancel an agreement will have to be considered if applicable. The Supreme Court of Appeal has confirmed that cancellation of an agreement does not, without more, constitute enforcement action prohibited by section 133. However, the existence and proper exercise of a right to cancel must still be considered against the terms of the relevant contract and the facts.

The critical point is that the words “business rescue” should not result in immediate action or complete inaction. Legal advice should be taken so that rights are not waived or squandered.

Distinguish the old debt from the next order (continuation of trade)

Claiming an existing outstanding amount owed when business rescue commenced and any new exposure incurred subsequent to the commencement of business rescue (post commencement debt), have different legal consequences.

The pre-rescue claim must be reconciled as at the commencement date of business rescue. Invoices should be checked against payments, credit notes, delivery records and any existing disputes relevant to the supply of goods and services. The claim should then be submitted to the practitioner with the relevant agreements and documentation supporting the claim.

It is equally important to establish the manner in which the practitioner has classified the claim. A creditor holding security, relying on a reservation of ownership clause or a third-party suretyship, may be in a materially different position from an ordinary concurrent creditor. Claims must be accurately recorded when submitted for proof to the practitioner, as it can affect the proposed treatment of the claim and the creditor’s voting interest.

Then comes the more difficult question: should you continue trading with the company?

Business rescue does not automatically release either party from rights recorded in an existing contract of supply. Section 136 also gives the practitioner certain powers to suspend or cancel contractual obligations of the company, subject to the provisions of the Company’s Act. A supplier or service provider should therefore not assume that it may simply stop performing. The ability to do so depends on the terms of the agreement, any existing breach and the steps taken by the practitioner.

At the same time, there is no commercial sense in continuing to supply goods and services to a company in business rescue or allowing further credit to accumulate without considering the prospects of receiving payment. Careful consideration must be given to the following issues –

• Who has authorised the further work or supply of goods and services?
• Is such supply in terms of an existing agreement?
• Has the practitioner approved it?
• From what funds will the new invoices be paid?
• Can payment be made in advance, on a cash basis, on delivery or against agreed milestones?
• What protection is available if the company defaults again?

Whatever occurs should be recorded in writing and where the rights of the party providing the goods and services are carefully dealt with. Claims arising after date of commencement (are deemed to be post-commencement finance) and may be treated (with the written consent of the practitioner) differently from pre-rescue debt, but that does not mean every new invoice automatically enjoys priority or is guaranteed to be paid.

Treat the rescue plan as an investment proposal

The practitioner must convene the first meeting of creditors within 10 business days of appointment and advise whether there is a belief that there is a reasonable prospect of rescuing the company. The business rescue plan must ordinarily be published within 25 business days of the practitioner’s appointment, unless the required extension is obtained. Generally, business rescue plans are published some months after the date of commencement of the rescue, provided the consent of creditors for an extension has been obtained by the practitioner.

When the plan is published, one should not only focus only on the proposed dividend to be paid on the outstanding debt. A promise to pay 60 cents (for example) in the rand is not meaningful without understanding the mechanics of the business rescue plan. Firstly, one has to consider if the plan is workable and whether it will be approved by creditors. Secondly, when will the payment be made and where will the money come from. Is the proposal dependent on the sale of an asset, a new investor, litigation proceeds or improved future trading? Has funding been secured, or is it merely anticipated? What happens if the transaction is delayed or the assumptions prove incorrect?

The plan should also compare the proposed business rescue outcome with the estimated return in liquidation. That comparison must be considered critically. A rescue proposal should not be supported merely because it produces a higher percentage on paper. The proposed return must be credible, properly funded and achievable within a commercially acceptable period.

Once the business rescue plan has been published, creditors are entitled to participate, by asking questions and proposing amendments to the plan. This matters because an adopted plan binds creditors regardless of whether they attended the meeting, voted against it or proved their claims.

Silence is therefore not a neutral position and can have consequences.

Remain informed and act timeously

The business rescue process can be complex, and one needs to act on an informed basis before it is too late. On receiving a business rescue notice, establish the commencement date of the rescue process, quantify the exposure and review the relevant underlying contracts. In addition, it is necessary to review existing supply agreements, identify your claim and any security held, review supporting documentation (such as invoices, credit notes), suretyships held, and any rights of reservation in goods supplied. Importantly, has the filing for rescue breached any ongoing rights to supply goods and services. Take legal advice so that no mistakes are made in the process.

Most importantly, decide whether further trade remains commercially viable and, if so, on what terms. Engage with the practitioner before the plan is put to a vote.

The correct response will depend on the size and nature of the pre-commencement claim, the importance of the ongoing relationship with the company in the future, and the rights contained in the relevant supply agreements.

What should remain consistent is the timing. The best opportunity to take legal advice in order to protect a creditor’s position is often at the commencement of the rescue. Advice should be taken before further exposure is incurred and before the proposed treatment of the claim becomes embedded and approved in the plan.

The post Your customer has entered business rescue. The next move matters appeared first on Werksmans Attorneys.

More than seven million pairs of Meta’s Ray-Ban smart glasses were sold worldwide in 2025. That figure alone should make any compliance officer focus. Apple’s AirPods Pro 3, launched in September 2025, now monitor heart rate and translate live conversations using artificial intelligence. [1] A next-generation Apple AirPod with an embedded camera is in advanced testing. These are not consumer curiosities, they are data collection instruments that walk through office doors, and POPIA has something to say about every byte they capture.

The global regulatory response has been swift. France’s CNIL warned in May 2026 that smart glasses risk normalising surveillance that is “almost invisible and omnipresent.” [2] Germany’s Hamburg data protection commissioner concluded that covert filming with these devices violates data protection law, and a sales ban is under active review. [3] The UK’s ICO has formally written to Meta demanding compliance information, [4] and a US class action alleges the glasses are a “surveillance nightmare disguised as fashion.” [5] In East Africa, a Russian vlogger was identified in early 2026 recording intimate encounters with women in Kenya and Ghana using Meta smart glasses and posting the footage online for profit. [6]

South Africa is not insulated from any of this. POPIA’s framework for special personal information, its transparency obligations, and its transborder transfer restrictions are all directly engaged.

The POPIA Exposure: Five Critical Risk Areas

Biometric and Health Data as Special Personal Information

Biometric information occupies a privileged category under POPIA. It is classified as “special personal information,” and processing it is generally prohibited unless a specific statutory exception applies, most commonly, explicit consent or a substantial public interest justification. The practical implications are significant. Meta’s smart glasses capture facial features, voiceprints, and video footage of identifiable individuals. Apple’s AirPods Pro 3 collect heart rate, motion, and calorie data via an in-ear optical sensor, transmitting this to Apple’s Health ecosystem and, with user permission, to third-party fitness applications. [7]

Bystander and Third-Party Rights

Every data subject has the right to know when personal information about them is being collected. That right is effectively annihilated by a device designed to record people covertly. Smart glasses are, by their nature, silent observers. The sole notification mechanism on Meta’s Ray-Ban glasses is a small LED light, which a peer-reviewed CHI 2026 study concluded is “inadequate” as a bystander safeguard. [8] Regulators across France, Germany, and the Netherlands have reached the same conclusion. The legal difficulty is plain: section 11 of POPIA requires a responsible party to demonstrate a lawful basis for processing which becomes a near-impossibility when the data subject has no knowledge that processing is occurring at all.

Transparency and Notice Failures

Section 18 of POPIA requires reasonably practicable steps to ensure data subjects know what information is being collected, why it is being collected, and who is responsible. What the major technology companies have been doing sits uncomfortably with that obligation. Meta’s April 2025 privacy policy update removed the option for users to disable voice recording storage and enabled AI features by default. [9] A Swedish investigation in early 2026 revealed that intimate footage, including nudity and financial information, was reviewed by human contractors in Kenya without adequate disclosure to users. [10] That kind of murkiness can be said to be fundamentally inconsistent with POPIA’s transparency mandate.

Transborder Data Transfers

Personal information may only leave South Africa where the recipient country provides an adequate level of protection, or where binding corporate rules or consent apply. This is not an abstract concern. Meta’s routing of footage captured by South African users to contractor facilities in Nairobi for AI training annotation raises serious questions about compliance with section 72. [11] Apple’s transmission of aggregated health and activity data to its US-based servers engages the same provision.

Security of Processing

Responsible parties must secure the integrity and confidentiality of personal information through appropriate technical and organisational measures. Section 19 demands nothing less. The revelation that Meta’s AI training pipeline could not distinguish between mundane footage and deeply sensitive content, and that no adequate filtering existed, represents a failure that would be difficult to defend under any reasonable reading of the provision.

What Does This Mean for Organisations

The Information Regulator’s 2025/26 Annual Performance Plan signals a firmer enforcement posture, [12] including a new compliance monitoring programme, a Code of Conduct for data collection at controlled entry points (covering biometric systems and surveillance technologies at business premises), and mandatory e-portal breach reporting since April 2025. Against this backdrop, South African organisations should consider, amongst others, the following:

• Consider whether to restrict smart glasses and AI-enabled earbuds in offices, boardrooms, client-facing areas, and controlled environments. Also, review workplace policies on wearable devices.
• Update privacy notices to address the possibility that employees, visitors, or clients may be recorded by wearable devices, and specify the organisation’s position on such recording.
• Conduct Personal Information Impact Assessments (PIIAs) as required by Regulation 4(b) of the POPIA Regulations, specifically for any deployment of wearable technology that captures biometric or health data.

Looking Ahead

South Africa has both the constitutional foundation and the legislative architecture through POPIA to shape the regulatory response to wearable AI across the continent. The Information Regulator has not yet issued specific guidance on smart wearables, but the trajectory is unmistakable: the draft Code of Conduct on controlled-entry-point data collection, the compliance monitoring programme, and the Regulator’s enforcement action against WhatsApp for applying weaker privacy terms to South African users than to Europeans [13] all signal a regulator that will not tolerate a two-tier approach to data protection.

Specific AI legislation is not imminent in 2026, but POPIA already provides a comprehensive framework for regulating wearable AI.

Are these devices already in your building? The question is whether your compliance framework has kept pace.

[1] Apple Newsroom ‘Introducing AirPods Pro 3, the ultimate audio experience’ https://www.apple.com/newsroom/2025/09/introducing-airpods-pro-3-the-ultimate-audio-experience/ (accessed 09-09-2026).

[2] PetaPixel ‘Meta Smart Glasses Face Calls for Bans Across Europe Over Privacy Concerns’ https://petapixel.com/2026/08/04/meta-smart-glasses-face-calls-for-bans-across-europe-over-privacy-concerns/ (accessed 09-09-2026). France’s CNIL issued its warning on 11 May 2026.

[3] 5thscape Blog ‘Meta Smart Glasses Privacy Test Expands to Germany’ https://5thscape.com/blog/meta-smart-glasses-germany-privacy/ (accessed 09-09-2026).

[4] ALM Corp ‘Meta Ray-Ban AI Smart Glasses: UK Investigation & US Lawsuit’ https://almcorp.com/blog/meta-ray-ban-ai-smart-glasses-privacy-investigation-uk-us/ (accessed 09-09-2026).

[5] Bartone v Meta Platforms Inc Case 3:26-cv-01897 (ND Cal, filed March 2026).

[6] A Juma ‘How smart glasses are rewriting the rules of consent in South Africa’ https://www.intelligentcio.com/africa/2026/05/26/how-smart-glasses-are-rewriting-the-rules-of-consent-in-south-africa/ (accessed 09-09-2026).

[7] Apple Support ‘Track your heart rate during workouts with AirPods Pro 3’ https://support.apple.com/guide/airpods/track-heart-rate-workouts-airpods-pro-3-dev1b40fb47d/web (accessed 09-09-2026).

[8] The study was presented at CHI 2026 by researchers at Tsinghua University and the University of Utah, concluding that notification mechanisms in camera glasses ‘prove inadequate’ as bystander safeguards. See TechTimes ‘Germany Invokes Cayla Spy-Device Law Against Meta Smart Glasses’ https://www.techtimes.com/articles/324064/20260812/germany-invokes-cayla-spy-device-law-against-meta-smart-glasses-owners-face-destruction-risk.htm (accessed 09-09-2026).

[9] The Verge ‘Meta tightens privacy policy around Ray-Ban glasses to boost AI training’ https://www.theverge.com/news/658602/meta-ray-ban-privacy-policy-ai-training-voice-recordings (accessed 09-09-2026).

[10] Popular Mechanics ‘Meta’s Smart Glasses Have Even Bigger Privacy Issues Than We Thought’ https://www.popularmechanics.com/technology/gear/a70782916/meta-smart-glasses-privacy-report-spring-2026/ (accessed 09-09-2026). See also ALM Corp (note 5 above).

[11] EU Perspectives ‘Meta smart glasses: MEPs question regulator on privacy protection’ https://euperspectives.eu/2026/03/meta-smart-glasses-meps-question-regulator-on-privacy-protection/ (accessed 09-09-2026).

[12] A Burger-Smidt ‘Information Regulator signals tougher POPIA and PAIA enforcement’ https://www.moonstone.co.za/information-regulator-signals-tougher-popia-and-paia-enforcement/ (accessed 09-09-2026).

[13] Information Regulator Enforcement Notice against WhatsApp (16 April 2025).

The post Invisible data collection through a privacy lens appeared first on Werksmans Attorneys.

In Part one of this series, we detailed the disparity amongst the African countries in mainly Southern Africa and the various approaches to cybersecurity. Unfortunately, this creates a uncertainty for many multi-jurisdictional entities operating across the African continent on how to best approach the issue of cybersecurity when there are discrepancies in the promulgation of legislation targeted at addressing this very issue.

In the second and final part of this series, we focus specifically on East and West Africans countries. At first glance, it seems strides are being made particularly in East Africa to enact  viable cybercrime laws which combat and adequately address the issue of cybersecurity, however, numerous constitutional challenges have impeded on this aspiration. With civil society organisations in some countries arguing that certain provisions in these laws infringe on the right to freedom of expression and the right of privacy. In essence, it seems some African countries have merely pledged to enacting laws addressing and aimed at curbing cybercrime but no progressive measures have been taken thereafter.

East Africa: Constitutional Volatility amid Evolving Frameworks

• Kenya: A Moving Target

Kenya’s Computer Misuse and Cybercrimes Act of 2018 ^[1] reaches a broad range of conduct: unauthorised interference with computer systems, interception, publication of false information, cyber harassment, cybersquatting and fraudulent use of electronic data. It also establishes the National Computer and Cybercrimes Co-ordination Committee. For basic offences, penalties can reach KES 200,000 or two years’ imprisonment; for aiding and abetting, they rise to KES 7 million or four years.

Several provisions of the Act have faced constitutional challenge after its enactment including concerns that the provisions may possibly infringe on the right to freedom of expression which can have a dire impact on also the freedom of media. Nonetheless, the core Act has been upheld. The 2025 amendments, which sought higher penalties and broader content-takedown powers, now face a fresh constitutional challenge, with conservatory orders in place. ^[2] Kenya captures a pattern increasingly visible across the continent: cybercrime laws are enacted, challenged, partly struck down, re-enacted and challenged again, leaving compliance teams to work against a moving legal target.

• Tanzania: Broad Powers, Narrow Oversight

Tanzania’s Cybercrimes Act of 2015 ^[3] criminalises illegal access, interception, data interference, data espionage and computer-related forgery and fraud. It has nevertheless drawn criticism for giving law enforcement extensive search-and-seizure powers with limited judicial oversight and that the enactment fails to provide procedural safeguards for human rights protection which would uphold the right to freedom of expression and the right to privacy, ^[4] prompting concerns about misuse familiar from the wider African cybercrime debate.

• Uganda: Constitutional Volatility

Uganda offers perhaps the clearest example of constitutional volatility in this field. The Computer Misuse Act of 2011 was amended in 2022 ^[5] to broaden the unauthorised-access offence and introduce new provisions on the unauthorised sharing of children’s information and social media abuse. In March 2026, however, Uganda’s Constitutional Court declared the 2022 amendment “null and void” because Parliament had not met the constitutionally required quorum when it was passed. ^[6] The Court also struck down the criminal defamation provisions. As a result, the pre-2022 principal Act currently governs, pending re-enactment.

• Rwanda: A Proactive Framework

Rwanda’s Law on Prevention and Punishment of Cybercrimes, enacted in 2018, ^[7] places the country among East Africa’s more proactive states in this field. Rwanda is both a Budapest Convention signatory and a Malabo Convention ratifier, reflecting a deliberate effort to align its domestic framework with international standards. That dual alignment remains relatively unusual on the continent and fits Rwanda’s broader ambition to position itself as a technology and innovation hub.

West Africa: Diversity, Ambition and Contested Levies

• Nigeria: Scale and Contested Reform

Nigeria’s Cybercrimes (Prohibition, Prevention, Etc) Act of 2015, significantly amended in 2024, ^[8] is West Africa’s most consequential cybercrime statute, given the scale of the Nigerian financial services sector. It criminalises unauthorised and fraudulent access to computer systems to obtain data vital to national security and requires incidents to be reported to the National Computer Emergency Response Team within 72 hours; non-compliance is punishable by denial of internet services and be liable for paying a mandatory fine of N2,000,000 into the National Cyber Security Fund. ^[9]

The 2024 amendment matters for several reasons. It revised section 24 of the 2015 Act, a provision the ECOWAS Community Court of Justice condemned for its use against journalists. ^[10] It also broadened the coverage of payment-technology fraud. Most controversially, it introduced a 0.5 per cent National Cybersecurity Levy on banks and payment service providers, a provision that prompted significant industry opposition and was subsequently suspended by the House of Representatives. ^[11] The Central Bank of Nigeria regulates financial institutions’ compliance, and the data protection regulator has sanctioned at least one bank for breach. Nigeria’s framework is therefore both ambitious and contested, and it demands close monitoring.

• Ghana: Institutional Regulation

Ghana’s Cybersecurity Act of 2020 ^[12] takes an institutional and regulatory approach. It makes the Cyber Security Authority the primary regulator, with power to license cybersecurity service providers and to designate and audit critical information infrastructure, a category that expressly includes banking and financial services. The Act also creates a National Computer Emergency Response Team and a Cybersecurity Fund financed by levies on Bank of Ghana-licensed entities. ^[13] Alongside the Data Protection Act and the Electronic Transactions Act, it forms a layered regulatory architecture that must navigate carefully.

• Francophone West Africa: A Distinctive Tradition

Francophone West Africa has its own legislative character. The region often draws on French civil-law models and reflects the influence of regional harmonisation efforts.

Côte d’Ivoire enacted its cybercrime law in 2013 and amended it in 2023, ^[14] covering ICT-specific offences, online intellectual-property infringements and offences committed over electronic communications networks. The amendment revised several key provisions, showing a willingness to update the framework as threats evolve. A companion personal data protection law and an electronic transactions law complete the regulatory architecture.

Senegal’s 2008 cybercrime law, ^[15] modelled on the Budapest Convention, ranks among the earliest francophone African cybercrime statutes. Senegal’s accession to the Budapest Convention in December 2016 strengthened that alignment with the European standard and was followed by the creation of a dedicated cybercrime police division.

Benin may have the region’s most ambitious approach. Its Code du numérique, adopted in 2017 and amended in 2021, ^[16] is a consolidated 647-article digital code; its sixth book is devoted to “Cybercriminalité et cybersécurité The Code creates a national information systems security agency and a central office for the repression of cybercrime. What is even more impressive is that the Code places an obligation on network operators and trust-service services providers to prioritise cybersecurity within their respective organisations. Comprehensive, if complex, it reflects a civil-law preference for codification.

Togo enacted its cybersecurity and cybercrime law in 2018, ^[17] establishing a Computer Emergency Response Team, a Security Operating Centre and a National Cybersecurity Agency. It has ratified the Malabo Convention and hosted the Lomé Cybersecurity Summit, presenting itself as a continental advocate for cybersecurity governance.

Burkina Faso is an instructive transitional case. It has no standalone modern cybercrime act and instead relies on its Penal Code and institutional cybersecurity structures, including a Central Brigade for Combating Cybercrime, a national Computer Incident Response Team and the Agence Nationale de Sécurité des Systèmes d’Information. It adopted a National Cybersecurity Strategy from 2019 to 2023, and legislative revision is under way to align domestic law with both the Council of Europe’s Convention 108 ^[18] and the Malabo Convention.

Looking Forward: Harmonisation, Vigilance and Proactive Compliance

The adoption of the UN Convention Against Cybercrime in December 2024 ^[19] could mark a turning point in the global governance of cybercrime. If the Convention secures broad ratification and, crucially, ratifying states enact robust, consistent domestic implementing legislation, it could provide the harmonising force the patchwork continental landscape so urgently needs.

Africa’s digital transformation is accelerating, and the cybercrime threat is moving with it. The legislative response remains uneven, but momentum is building.

The organisations best placed to navigate this landscape will be those that treat cybercrime compliance not as a box-ticking exercise but rather as a strategic governance imperative, one demanding rigour, resources and board-level attention.

[1] Computer Misuse and Cybercrimes Act No 5 of 2018 (Kenya), assented 16 May 2018.

[2] The Computer Misuse and Cybercrimes (Amendment) Bill, 2025, which sought to expand penalties and introduce broader content takedown powers, was subject to conservatory orders by the High Court of Kenya as at mid-2025.

[3] Cybercrimes Act, 2015 (Tanzania), passed 1 April 2015.

[4] See, eg, Article 19 “Tanzania: Cybercrimes Act 2015 Undermines Free Expression” (2015).

[5] Computer Misuse Act, 2011 (Uganda), as amended by the Computer Misuse (Amendment) Act, 2022.

[6] The Constitutional Court of Uganda declared the Computer Misuse (Amendment) Act 2022 null and void in March 2026 on the ground that Parliament had lacked the constitutionally required quorum at the time of passage.

[7] Law No 60/2018 of 25 September 2018 on Prevention and Punishment of Cybercrimes (Rwanda).

[8] Cybercrimes (Prohibition, Prevention, Etc) Act, 2015 (Nigeria), as amended by the Cybercrime (Prohibition, Prevention, Etc) (Amendment) Act, 2024, signed 28 February 2024.

[9] Section 21(3) of the Cybercrimes (Prohibition, Prevention, Etc) Act 2015 (as amended 2024).

[10] Section 24 of the 2015 Act was condemned by the ECOWAS Community Court of Justice for its deployment against journalists. The 2024 amendment revised the provision.

[11] The contested 0.5% National Cybersecurity Levy on banks and payment service providers was introduced by the 2024 amendment but subsequently suspended by the House of Representatives following industry opposition.

[12] Cybersecurity Act, 2020 (Act 1038) (Ghana).

[13] Ibid.

[14] Loi n° 2013-451 du 19 juin 2013 relative à la lutte contre la cybercriminalité (Côte d’Ivoire), as amended by Loi n° 2023-593 of 7 June 2023.

[15] Loi n° 2008-11 du 25 janvier 2008 portant sur la Cybercriminalité (Senegal). Senegal acceded to the Budapest Convention in December 2016.

[16] Code du numérique, Loi n° 2017-20 (Benin), adopted 13 June 2017, as amended by Loi n° 2020-35 of 6 January 2021.

[17]Loi n° 2018-026 du 7 décembre 2018 relative à la cybersécurité et à la lutte contre la cybercriminalité (Togo).

[18] Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), opened for signature 28 January 1981.

[19] United Nations Convention Against Cybercrime (n 3). The Convention enters into force 90 days after the fortieth ratification.

The post Cybercrime across borders: Navigating Africa’s fragmented legislative landscape – Part 2 appeared first on Werksmans Attorneys.