Legal updates and opinions
News / News
Enforcement notice issued to Dis-Chem due to contravention of POPIA
and Chiara Ferri, Candidate Attorney
The importance of compliance has once again been highlighted as the Information Regulator issued an Enforcement Notice to Dis-Chem Pharmacies Ltd (“Dis-Chem“) on 1 September 2023 for non-compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA“).
The Information Regulator is casting their net wide when it’s come to investigating contraventions, whether it be against large, small, private or public companies and is cracking down on ensuring consumers’ information is safeguarded and lawfully processed.
The Information Regulator found that Dis-Chem failed to identify the risk of using weak passwords, failed to implement measures to monitor and detect unlawful access to their environment and that they hadn’t entered into any operator agreement with their third party service provider which would have, amongst other things outlined the process of reporting to Dis-Chem in the event of a security compromise.
The Information Regulator has ordered Dis-Chem to conduct a Personal Information Impact Assessment and to ensure that adequate measures and standards exist to comply with the conditions for the lawful processing of personal information. They have also been mandated to implement an adequate Incident Response Plan, involving strong access control measures, maintaining a vulnerability management programme, implementing strong access control measures and maintaining an Information Security Policy.
Dis-chem have been ordered to conclude written contracts with all operators who process personal information on its behalf and to develop, implement, monitor and maintain a compliance framework. Failure to comply with such obligations will result in an administrative fine or result in a conviction of imprisonment or both.
A breach of this nature, and the finding as to the lack of safeguards in place should come as a shock for an organisation of this size and an organisation which holds such a vast quantity of data. One would expect that all prominent companies in South Africa would have conducted an impact assessment and would give credence to their responsibilities in protecting their customers’ data. The Information Regulators guidance to Information Officers is clear. Understanding the privacy landscape together with rights, obligations and duties are not negotiable. A robust privacy programme empowers companies to demonstrate that they reasonably comply with the obligations as stipulate in POPIA.
The Werksmans regulatory team has developed electronic tools and a sound methodology which aim to assist with impact assessments and the implementation of a compliance road-map. Compliance with POPIA is not a template that is downloaded and copied. A clear understanding of the legislation is paramount.
Click below to access Ahmore Burger-Smidt’s latest publication:
Latest News
New Code of Good Practice: Dismissal
by Anastasia Vatalidis, Director and Anna Tchalov, Associate On 4 September 2025, the new Code of Good Practice: Dismissal ("New Code") [...]
Balancing union duties and job performance: Association of Mineworkers & Construction Union obo Ntuli v Ferroglobe Silicon Smelters (Pty) Ltd
by Jacques van Wyk, Director and Mike Searle, Candidate Attorney In the construction and engineering sectors, senior employees often [...]
The slippery slope of financial distress
by Eric Levenstein, Director and Head of Insolvency and Business Rescue and Brendan Olivier, Director Negative economic news stories [...]
Reinstatement – not always fair
by Bradley Workman-Davies, Director South Africa’s labour law often elevates reinstatement as the primary remedy for unfair dismissal, but [...]
National Minimum Wage Act: What employers need to know about the 2026 review
by Andre van Heerden, Director, Bradley Workman-Davies, Director and Jacques van Wyk, Director South Africa’s National Minimum Wage Act [...]
Tanzania introduces Trade Mark Rights Recordation for all imports
by Donvay Wegierski, Director and Andreya John, Candidate Attorney As of 1 December 2025, in an initiative administered by the [...]