Picture this.

A retailer with operations spanning southern and eastern Africa discovers on a Friday evening that a threat actor has exfiltrated customer records from a compromised cloud environment. The breach touches individuals in Kenya, Zambia, Zimbabwe, and South Africa. In Zambia and Zimbabwe, the clock gives them just 24 hours to notify the regulator. [1] In Kenya, they have 72 hours, unless their systems qualify as critical information infrastructure, in which case the window shrinks to a mere 24 hours. [2] South Africa’s POPIA, by contrast, imposes no fixed-hour deadline at all, requiring notification only “as soon as reasonably possible”. [3]

And the regulatory bodies receiving those notifications? Entirely different institutions, with different forms, different portals, and different expectations.

Welcome to the reality of cross-border breach response in 2026.

 The Myth of the Universal Playbook

Too many organisations still treat data breach response as a single procedure, a single plan, a single template, a single timeline. That approach was always fragile. Today, it is genuinely dangerous.

Across sub-Saharan Africa alone, the legislative landscape has shifted dramatically in the past three years. Botswana replaced its 2018 Act with substantially enhanced breach-notification obligations in 2024, introducing a 72-hour reporting window and prison terms of up to nine years for certain violations. Malawi’s Data Protection Act came into force in June 2024, with its own 72-hour reporting requirement and a novel public notification mechanism via newspapers when direct notice requires disproportionate effort or expense. Tanzania enacted comprehensive data protection legislation in 2022, backed by administrative fines up to TZS 100 million and criminal imprisonment of up to ten years. These are not legacy frameworks gathering dust, they are recent, actively enforced, and strikingly divergent from one another.

The Devil Lives in the Differences

What makes cross-border compliance genuinely difficult is not the existence of notification obligations, most sophisticated organisations expect those. The difficulty lies in the granular inconsistencies.

Firstly, timelines pull in different directions. Rwanda requires notification to the NCSA within 48 hours. Nigeria mirrors the GDPR’s 72-hour notification standard for the NDPC. Uganda requires notification “immediately” upon discovery. Ghana offers no fixed hour count at all, relying instead on a “reasonably practicable” standard. When a single incident spans four of these jurisdictions, the compliance team must operationalise the shortest deadline as the effective floor, while still satisfying the specific procedural requirements of each.

Secondly, notification thresholds diverge significantly. South Africa and several other countries require reporting of all security compromises irrespective of assessed risk level. Kenya and Nigeria, echoing GDPR principles, trigger individual notification only where there is a “likely high risk” to rights and freedoms. Botswana requires reporting unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject. Morocco doesn’t impose a mandatory notification regime at all, merely a strong expectation of responsible incident management from the CNDP. [4] For a single breach affecting data subjects across these territories, the compliance team faces a zero-threshold obligation, divergent risk-based obligations, and a soft-law expectation simultaneously.

Thirdly, the level of detail required in data breach notifications differs significantly across jurisdictions. At one end of the spectrum, Zambia does not prescribe what must be included in a notification. Ghana adopts a general standard, requiring only “sufficient information” to allow the data subject to take protective measures. Botswana, Kenya, Malawi and Nigeria prescribe detailed content requirements closely aligned with the GDPR. South Africa goes further, requiring additional elements including the identity of the intruder (if known). Kenya imposes more onerous requirements: a chronological account of steps taken, details of how the breach occurred, and prescribed document uploads including the incident response policy, internal incident logs, and copies of reports sent to other regulators.

Fourthly, penalties vary widely. Kenya’s administrative fines cap at KES 5 million or 1% of annual turnover. [5] Rwanda imposes fines of RWF 2–5 million or 1% of prior-year global turnover. [6] Botswana has adopted what observers describe as a “GDPR-plus enforcement posture,” with potential prison terms of up to nine years. [7] Criminal sanctions, including imprisonment, feature across Nigeria, Tanzania, and Uganda. [8]

Building a Jurisdiction-Aware Response Framework

So, what does good practice look like? A few principles stand out.

1. Map your exposure before the breach happens. In-house teams should maintain a living matrix that documents the notification obligations, timelines, thresholds, and designated authorities for every jurisdiction in which they process personal data. This is not a once-off exercise, but must be reviewed and updated whenever there are legislative or other developments in a country’s data protection regulatory framework. Botswana, Malawi, and Tanzania all overhauled their frameworks within the past two years. [9]
2. Design for the tightest deadline. If your operations affect Zambia or Zimbabwe, your internal escalation and triage processes must be able to produce a regulatory notification within 24 hours. That becomes the design constraint for your entire incident response architecture.
3. Appoint jurisdiction leads, not a single breach coordinator. Each relevant jurisdiction requires someone who understands the local regulator’s expectations, prescribed forms, portal requirements, and the practical nuances of engagement.
4. Invest in threshold analysis upfront. Because jurisdictions apply different tests, from South Africa’s all-in approach to Kenya’s risk-based trigger, a rapid, defensible methodology for assessing severity across multiple frameworks is essential. You cannot afford to work this out on the night of discovery.

The Direction of Travel

The trajectory is unmistakable. Namibia remains the conspicuous outlier, lacking a comprehensive data protection statute, but political pressure following the 2025 NSFAF data breach has intensified calls to finalise its draft Bill. [10] Elsewhere, the pattern is one of convergence toward mandatory, time-bound notification regimes, with increasingly severe penalties for non-compliance.

For organisations operating across multiple African jurisdictions and, indeed, globally, the message is straightforward. The window for treating breach response as a reactive, ad hoc exercise has closed. What is needed now is infrastructure: legal mapping, operational readiness, jurisdictional expertise, and the institutional muscle to execute across borders under intense time pressure.

The breach will come.

The only question is whether your response architecture was built for the world as it actually is, fragmented, fast-moving, and unforgiving of those who failed to prepare.

[1] Data Protection Act 3 of 2021 (Zambia) s 24; Cyber and Data Protection Act [Chapter 12:07] of 2021 (Zimbabwe) s 29.

[2] Data Protection Act 24 of 2019 (Kenya) s 43. The Data Protection (General) Regulations, 2021 (Kenya) prescribe a 72-hour notification period, reduced to 24 hours for operators of designated critical information infrastructure.

[3] Protection of Personal Information Act 4 of 2013 (POPIA) s 22(1). From April 2025, the Information Regulator introduced a mandatory e-Services Portal for reporting security compromises.

[4] Law No 09-08 of 18 February 2009 on the Protection of Individuals with regard to the Processing of Personal Data (Morocco), with implementing Decree 2-09-165. No general GDPR-style mandatory breach notification regime with fixed timelines exists; the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) expects “prompt and responsible incident management.”

[5] Data Protection Act 24 of 2019 (Kenya) s 62. Administrative fines up to KES 5 million or 1% of annual turnover (whichever is lower) for controllers; KES 3 million or 0.5% of turnover for processors.

[6] Law No 058/2021 (Rwanda) art 68. Administrative fines of RWF 2–5 million or 1% of prior-year global turnover for misconducts including failure to notify or report a breach.

[7] Data Protection Act 18 of 2024 (Botswana). Described as among the strictest breach-related penalty regimes in the region, adopting a notably GDPR-plus enforcement posture.

[8] Nigeria Data Protection Act, 2023 (n 8 above) s 48 (up to one year’s imprisonment for non-compliance with NDPC orders); Personal Data Protection Act 11 of 2022 (Tanzania) s 62 (criminal fines and imprisonment up to 10 years); Data Protection and Privacy Act 9 of 2019 (Uganda) ss 39–40 (administrative penalties and compliance orders).

[9] Data Protection Act 18 of 2024 (Botswana); Data Protection Act 3 of 2024 (Malawi); Personal Data Protection Act 11 of 2022.

[10] Draft Data Protection Bill, 2021 (Namibia). No comprehensive data protection statute is currently in force; only the constitutional right to privacy under article 13 of the Constitution of the Republic of Namibia, 1990 applies.

The post When the clock starts ticking…… Why cross-border data breach response demands more than good intentions appeared first on Werksmans Attorneys.

In our article published in February 2025, which can be accessed at https://werksmans.com/are-raising-fees-similar-to-interest/, we discussed a judgment by the Tax Court sitting in Cape Town determining that raising fees constitute finance charges which are “similar to interest” and therefore tax deductible if they are incurred in the production of income, even if they are capital in nature. SARS appealed the Tax Court’s finding directly to the Supreme Court of Appeal (SCA). On 7 September 2026, the SCA handed down judgment in C:SARS v Cornucopia Trust (469/2025) [2026] ZASCA 116, finding in favour of the taxpayer.

The issue

For many years, all finance charges “related” to interest were tax deductible on the same basis as interest, the relevance of which is that, unlike most other expenses, interest is tax deductible if incurred in the production of income even if the expense is capital in nature. The legislation was amended to limit the finance charges treated as “interest” for tax purposes to only those finance charges which are “similar” to interest.

It was generally accepted that raising fees were “related” to interest, but the question arose whether they are also “similar” to interest. For taxpayers incurring raising fees on funds borrowed to acquire capital assets used in their businesses, the legislative change raised the question of whether raising fees could remain tax deductible if they are capital in nature.

The taxpayer financed, and refinanced, the acquisition of two commercial properties with finance obtained from different Sanlam entities.

The original financing agreements as well as each of several subsequent refinancing agreements attracted a raising fee of two per cent of the loan capital, payable upfront by the taxpayer as a precondition for drawing down on the facility. In its 2019 and 2020 tax returns, the taxpayer claimed deductions for the raising fees, spread on a yield-to-maturity basis, as if the raising fees were to be treated as finance charges similar to interest.

SARS disallowed the deduction of the raising fees on the basis that they did not constitute finance charges which are “similar” to interest. The Tax Court conducted an interpretive exercise considering the text, context and purpose of the amendment and concluding that the raising fees bore a sufficiently relevant resemblance to interest to be regarded as “similar” and that this interpretation did not yield “an unbusinesslike and unwieldy result“.

The SCA majority judgment (4 judges)

The SCA majority agreed with the Tax Court’s findings. Due consideration was given to the dynamic nature of tax legislation and, in particular, the 2016 legislative amendment to the definition of “interest”, in terms of which the word “related” was replaced by “similar”. The amendment resulted from the SCA’s decision in C:SARS v South African Custodial Services 2012 (1) SA 522 (SCA), where the term “related finance charges” was held to include a broad range of payments connected to a finance transaction, including legal fees and financial advisory fees, irrespective of whether they resembled interest. The SCA noted that it is accepted that the 2016 amendment was intended to narrow that interpretation, but also clarified that the purpose of amending the legislation was not to confine deductibility “to the most obscure forms of finance charges“.

The majority accepted, correctly in our view, that finance charges which are similar to “interest” must be something other than interest, but with the necessary degree of similarity. On this basis it adopted a threefold approach by –

• firstly analysing the nature of “interest” in the context of a loan for consumption,
• secondly analysing the nature of “finance charges” and the “raising fees” paid by the taxpayer in this matter, and
• finally, comparing the two charges to determine whether the raising fees were similar to interest. The court explained its function in this regard as follows, “… this Court must decide where on the scale the requisite similarity or relative relevance should raising fees be placed, having regard to the triad of language, context and purpose.“

The majority identified the essential character of interest paid in respect of a loan for consumption as not merely compensation for the time value of money, but more broadly as the functional cost of credit, including compensation to the lender for the risks involved. The judgment considered in detail the true nature of interest on loans for consumption and cited several judgments to address the incorrect notion that interest is necessarily something paid for the use of the lender’s funds. The following warrants mention (with our emphasis):

“In Commissioner for Inland Revenue v Lever Bros (Lever Bros) Watermeyer CJ described interest as follows:

… Although, colloquially, one speaks of a debt carrying interest, or interest on a debt, as though interest were a sort of growth sprouting from the debt, the language used means no more than that the borrower pays interest, if that is the agreement between the borrower and lender, as consideration for the benefits allowed to him by the lender“.”

The SCA also refers to the judgment in Cactus Investment (Pty) Ltd v Commissioner for Inland Revenue, and specifically that the SCA in that case issued a reminder that where one deals with a loan for consumption, “the interest cannot be compensation to Cactus for the use of Cactus’ money.”

The majority judgment pulls this neatly together in summarising the position in relation to interest on a loan for consumption as follows: “Thus, while interest reflects the time value of money plus the quid pro quo for the lender’s forbearance in awaiting repayment at a later date, these are not the only characteristics of interest. Interest is the functional cost of credit – what it costs the lender to provide the credit, together with a margin. Interest is not only the time value of the loan but also compensation for the risk involved. This is borne out by higher interest rates for higher risk loans. In this scenario interest is the agreed consideration to the lender for the extension of credit.”

The next discussion involved an analysis of the raising fees paid by the taxpayer in the matter under consideration, where the raising fee was a precondition for credit and was calculated with reference to the amount of credit to be obtained and the lender’s level of risk. In this context, the fee, together with interest, constituted the consideration the borrower paid to obtain credit. The raising fees were directly proportional to the loan capital, linked to the period of the facility (although payable upfront and non-refundable), and compensated the lender for the risk and cost of being deprived of its money. In these circumstances, the raising fees were not merely consideration for the administrative effort of arranging the loan; they were an indivisible part of the cost of obtaining credit and shared the same functional characteristics as interest.

The majority summarised the legal position as follows:

• Raising fees that are inextricably linked to the procurement of the loan have the same functional characteristics as interest (i.e. to compensate the lender for providing credit); and
• They are distinguishable from ancillary charges, such as legal fees, financial advisory fees, and other fees, which are not strictly speaking necessary but incidental to the loan and are compensation for the labour associated with producing the services charged for.

The majority also addressed the significance of the raising fees being a once-off, lump-sum payment. The majority judgment pointed to the definition of “interest”, which expressly contemplates interest “payable or receivable as a lump sum or in unequal instalments during the term of the financial arrangement“. The fact that a charge is paid upfront does not, of itself, disqualify it from being “similar” to interest, as interest itself can be paid as a lump sum.

A final point to note is that the majority considered the nature of the raising fees from the perspective of the borrower, to whom it did not matter whether the fees are payable to the same entity which extended the loan finance or another entity identified by the lender (being in the same group) – from the borrower’s perspective, it was a cost it had to pay to obtain the finance.

The takeaway from the majority’s reasoning is that (raising) fees that are strictly linked to the procurement of the loan, both in amount and objective, and that compensate the lender for the risk and cost of being deprived of its money, fall within the ambit of section 24J. By contrast, fees charged for the efforts associated with obtaining the loan – such as legal fees and financial advisory fees – remain outside.

The minority judgment (1 judge)

The minority accepted that “similar” does not mean “identical”, but regarded the raising fees as a once-off service fee which is not similar to “interest”, mainly because it constituted a once‑off charge which was, according to the dissenting judge, unrelated to the loan term and paid to the facility agent, which was another entity in the group of the lender. The the minority judge regarded the raising fee as the cost of obtaining the capital, which he regarded as being different to the price of retaining the capital over time.

The minority judge drew support from –

• The wording in paragraph 20(2)(a) of the Eighth Schedule to the Income Tax Act, which lists interest and raising fees separately. For the minority judge, this indicated that the legislature treats them as distinct species of borrowing costs. The majority of the SCA countered this view by stating that the separate listing of interest and raising fees to exclude both from the base cost of assets, underscores their similarity, not their difference.
• Section 8FA of the Income Tax Act, which defines “hybrid interest” to include interest not determined with reference to a specified rate or the time value of money. The minority reasoned that it would be incongruous to admit as “similar to interest” a fee unconnected to the time value of money, when the legislature excludes amounts called “interest” on precisely that basis. The majority of the SCA dismissed this view, noting that hybrid interest concerns equity instruments disguised as debt and that the raising fees in this instance were indeed linked to the period of the facility and were negotiated with reference to the time value of money.

Concluding remarks

Contrary to the view expressed by SARS in Interpretation Note 142, issued on 12 December 2025, the SCA’s majority decision, being the first SCA authority on the meaning of “similar finance charges” following the 2016 legislative amendment, endorsed a functional, business-like approach, rather than a formalistic approach, in determining whether finance charges, other than interest, are sufficiently similar to interest to be tax deductible if they are incurred in the production of interest, even if they may be capital in nature.

Important characteristics to achieve the required level of similarity include a calculation of the raising fees as a percentage of the loan capital, and with regard to the risk undertaken by the lender, which is impacted by the term of the loan.

Characteristics which are not determinative are whether raising fees are paid once-off as a lump sum, and whether they are paid to the lender directly or to another entity as part of the arrangement with the lender.

The post Are raising fees similar to interest? The Supreme Court of Appeal says yes appeared first on Werksmans Attorneys.

The discussion considers the judgment’s implications for accreditation under the NHI Act, the role of “need” in healthcare regulation and the protection of constitutional rights.

Werksmans acted for the Hospital Association of South Africa in the confirmation application before the Constitutional Court.

Watch the full webinar.

The post Webinar: Constitutional Court’s judgment on Certificate of Need provisions appeared first on Werksmans Attorneys.

What the Report Is

On 3 September 2026, the Competition Commission of South Africa (‘the Commission’) published a research report highlighting its findings on the Rural and Township Economy Project (‘the Report’). The purpose of The Report is to inform policy makers, regulators, and business leaders about the economic dynamics in South Africa’s township and rural areas, focusing on competition and economic participation. It was authored by researchers within the Commission’s Economic Research Bureau, Qhawe Mahlalela, Tessa Bleazard, and Zintle Siyo, with assistance from Dr Hariprasad Govinda, drawing on literature, enforcement experience, and two dedicated surveys: a Business Survey and a Consumer Survey. The Report is not a market inquiry, nor does it carry binding legal force. It is, however, a substantial and data-rich piece of research that the Commission plainly intends to use as a platform for future enforcement, policy engagement, and inter-agency cooperation. Its publication should be understood as a signal of the Commission’s intention to apply a more nuanced and empirically grounded approach to competition in historically underserved markets.

Why It Matters

Townships and rural settlements are home to a very large share of the South African population,  over 40% of the country’s residents live in townships alone. These areas were shaped by apartheid-era spatial policies, principally the Group Areas Act of 1950 and the Natives Land Act of 1913, which were designed to confine non-white South Africans to geographically isolated, economically marginalised settlements. The Report describes this legacy as “exclusion by design,” and traces a direct line from those historical policies to the patterns of poverty, unemployment, inequality, and business informality that persist in these areas today.

The economic significance of these communities is widely recognised. National policy frameworks, including the National Development Plan 2030 and the Medium-Term Development Plan 2024–2029, identify township and rural enterprises as critical to employment creation and inclusive growth in pursuit of economic development. The Commission’s Report adds a competition dimension to this national conversation, asking what specific market and regulatory barriers prevent businesses in these areas from entering, growing, and competing effectively, and what this means for the consumers who depend on them.

What the Report Finds

The Report’s findings are organised around three broad themes:

• market barriers;
• regulatory barriers and;
• the implications of both for how competition should be assessed in these economies.

On the market side, two problem areas stand out. The first is procurement. The Report finds that how businesses obtain their stock and inputs differs sharply depending on the type of business. National chains and franchises tend to be well-integrated into large, formalised supply networks with strong bargaining power and reliable access to goods. Independent and informal businesses, which make up the overwhelming majority of firms in township and rural areas, rely instead on smaller suppliers and intermediary channels, where they face higher costs, less reliable supply, and weaker negotiating positions. The data is stark: township national chains source roughly 65% of inputs through large formal wholesalers, whereas independents and informal businesses are far more dependent on smaller and costlier channels. Moreover, the Report finds that there are procurement difficulties across several sectors such as the agriculture, construction, hair and beauty, hospitality, medical or health services, and retail industries. It is said that businesses in those sectors are experiencing higher input or inventory costs. In light of this, independent and informal businesses are therefore inclined to  reduce their order sizes which further weakens their bargaining power, while lack of local supplier availability and stock shortages are also found to present significant issues in these sectors. These procurement asymmetries translate into higher procurement costs for township and rural businesses and narrower product ranges for the consumers who shop at smaller outlets.

The second market barrier is route to market. Most township and rural businesses sell through their own physical premises, typically small, low-footfall stores, with very limited access to major retailers, shopping centres, or online platforms. The Report finds that this is not because smaller businesses lack ambition or interest in expansion. On the contrary, the survey evidence points to significant latent demand among smaller firms for access to formal retail spaces such as malls and shopping centres. What holds them back is a combination of high rental costs, exclusivity arrangements favouring established brands, information gaps, and a general preference by mall operators for large, well-known tenants. Online channels present a similar story: registration thresholds, infrastructure weaknesses, and a lack of digital know-how keep many township and rural businesses off e-commerce platforms entirely.

On the regulatory side, the Report documents a pervasive landscape of “red tape“, complex and costly compliance requirements associated with permits, licences, zoning rules, municipal by-laws, and service disruptions. These burdens fall most heavily on smaller and less formal businesses, which have the fewest resources to navigate opaque administrative systems. The effects are not merely bureaucratic: regulatory barriers can delay market entry, prevent businesses from relocating to better premises, discourage investment, and entrench informality by making the cost of formalisation prohibitively high. Businesses that remain non-compliant find themselves locked out of funding, unable to access formal supply chains, and invisible to potential partners and customers. For consumers, the downstream consequence is fewer nearby options, less variety, and longer travel distances to reach better-stocked stores, with transport costs functioning as an additional, hidden price.

A Revised Lens for Competition Assessment

Beyond its factual findings, the Report proposes a shift in how competition authorities and practitioners should think about markets in township and rural settings.

On the question of closeness of competition, the Report warns against the assumption that businesses operating in the same area and selling similar products necessarily constrain one another. Consumer survey data shows that shoppers frequently do not view independent or informal outlets as substitutes for chain stores, they perceive meaningful differences in quality, variety, reliability, and the type of shopping occasion each serves. Two businesses may coexist in the same township, but if consumers do not regard them as interchangeable, the competitive pressure between them may be much weaker than appearances suggest.

On geographic market definition, the Report calls for an approach grounded in actual consumer behaviour and local realities rather than theoretical assumptions about how far people are willing to travel. Shopping patterns vary significantly by product category: food and pharmacy purchases tend to be relatively local, while clothing, electronics, and household goods draw consumers further afield, often to the nearest town or urban centre. Rural consumers generally travel longer distances than township consumers, but this may reflect the absence of local alternatives rather than genuine competitive integration across wider areas. Transport realities matter as well: in many categories, minibus taxis are the dominant mode of transport, and walking remains important for routine local purchases. The Report argues that practical catchment areas in rural settings are often wider than standard competition analysis would assume, and that any assessment must be sensitive to the specific product category and the real-world constraints that consumers face.

What Comes Next

The Report is explicitly forward-looking.

• First, the Commission intends to address the regulatory and administrative red tape by considering structured engagements with municipalities, South African Local Government Association (SALGA), the DTIC and Department of Small Business Development (DSBD) and other governmental organisations, with a view to identifying the regulatory burdens which can be simplified, standardised or better supported.
• The Commission further signals its intention to pursue follow-on work in several directions engaging with stakeholders across the retail, supply, distribution, and e-commerce value chains; and cooperating with other government bodies, municipalities, provincial departments, the DTIC, and the DSBD among them  to widen access to formal retail and digital channels for smaller firms .
• The Report does not shy away from the possibility of enforcement action. It identifies specific categories of conduct, exclusionary access to retail channels, discriminatory procurement conditions, and supply arrangements that disadvantage smaller or HDP-owned firms, that may form the basis for market conduct investigations.
• Moreover, the Commission has now signaled that it would be looking into prioritising procurement and upstream access and even making provision for competition conditions aimed at addressing service delivery and infrastructure,

For any organisation with a presence in or connection to township and rural markets, the Report warrants careful attention. In essence, the Report provides the Commission with a rich empirical foundation, a clear analytical framework, and an evident appetite for follow-through. Whether the practical impact will be felt primarily through enforcement, through policy reform, or through a combination of both, the direction of travel is unmistakable: the Commission intends to bring a sharper, more evidence-based focus to competition in some of South Africa’s most economically significant, and historically neglected communities.

The post The Competition Commission’s Rural and Township Economy Project – Be well advised to sit up and listen appeared first on Werksmans Attorneys.

The Information Regulator (Regulator) has put down a marker. In a media briefing held today, 31 August 2026, the Regulator delivered a comprehensive account of its enforcement activities under both the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). The briefing also marked a significant institutional milestone: 2026 is the Regulator’s 10-year anniversary, having been formally established in December 2016, and five years since the enforcement provisions of POPIA commenced.

Key Developments

Enforcement Notices Under POPIA

The Regulator has issued several enforcement notices under POPIA in this financial year, while each warrant careful attention, the following enforcement notice issued against South African Bureau of Standards (SABS) was highlighted:

• Following a significant ransomware attack in 2024 that disrupted SABS’s information systems and operations, the Regulator conducted an own-initiated assessment and found that SABS had violated multiple POPIA conditions, including processing excessive or irrelevant information, having inadequate consent mechanisms, insufficient security safeguards, and failing to inform data subjects of collection methods.
• SABS has been directed to revise its policies, conduct risk and impact assessments, and implement adequate security measures within 90 days. The Regulator emphasised that the enforcement action was not taken simply because SABS was a victim of a cyber-attack, but because of the underlying compliance failures identified during the assessment.

POPIA Fines Imposed

The Regulator disclosed the fines that have been imposed under POPIA to date. These include:

Ongoing POPIA Matters and Investigations

• Matric Results: The Regulator continues to challenge the Department of Basic Education’s publication of matriculants’ exam numbers together with their results. The Regulator has applied for leave to appeal directly with the Supreme Court of Appeal following the High Court’s refusal for leave, maintaining that the matter raises important questions about the interpretation and application of POPIA to learners’ personal information.
• The Regulator confirmed that it has various ongoing investigations and assessments underway, including TruCaller and the Gauteng Department of E-Government.
• eThekwini Metropolitan Municipality: The Madlanga Commission of Inquiry referred concerns to the Regulator in February 2026 regarding the unlawful processing of personal information by a former city manager of the eThekwini Metropolitan Municipality. The Regulator accepted the referral, initiated an own-initiative investigation, and has completed the investigation. The matter has been referred to the Enforcement Committee for appropriate action.
• On 4 August 2026, the Regulator received a further referral from the Madlanga Commission relating to, among others, Vusimuzi Matlala.

PAIA Annual Report Compliance

The compliance figures on PAIA annual reporting are, frankly, dismal:

• Between 1 April and 18 August 2026, the Regulator received PAIA annual reports from 417 out of 853 public bodies, a compliance rate of approximately 9%. This is an improvement on the 2024/25 period (358 submissions, compliance rate of approximately 42%).
• Municipal compliance remains critically low: only 91 out of 257 municipalities submitted reports, a compliance rate of roughly 35%.
• Other low-compliance categories include political parties, TVET colleges, Schedule 3A and 3C public entities, and notably the Public Protector, which has failed to submit its own section 84(b) report.

The Regulator is clearly frustrated and is seeking stronger enforcement tools.

Direct Marketing and Spam Calls

The Regulator has confirmed its position that telephone calls constitute “electronic communication” under POPIA. This remains a contentious legal question, with the direct marketing sector arguing that telephone calls fall outside the Act’s scope. The Regulator disagrees. Of the over 3,800 complaints received last year, approximately 10% related to direct marketing, demonstrating the scale of the issue. Two key matters have been referred to the Enforcement Committee and raise important questions about the interpretation and application of section 69 of POPIA (unsolicited electronic communications).

The Regulator has welcomed the recent amendment to the Consumer Protection Act (CPA) regulations establishing the opt-out/block registry for unsolicited marketing communications, and has engaged with the National Consumer Commission on collaborative awareness-raising and enforcement. The Regulator highlighted that CPA compliance does not displace POPIA compliance obligations in respect to direct marketing.

Security Compromises

The Regulator has received over 8,000 security compromise notifications since POPIA’s enforcement provisions commenced. In the current financial year (from 1 April 2026), over 1,220 notifications have been received, with a projected 3,000 by year end. The Regulator highlighted common causes include inadequate security controls, employee negligence, weak passwords, and malware/ransomware attacks. The public sector was criticised for insufficient investment in security measures.

The Auditor-General has identified severe cybersecurity weaknesses across government, including ageing infrastructure and skills deficits. The Regulator observed that organisations are treating data protection as a “tick box exercise” rather than an operational priority.

Proposed Legislative Amendments

The Regulator intends to submit proposals to Parliament for amendments to PAIA and POPIA:

• PAIA: Current enforcement provisions are considered too weak. Unlike POPIA, PAIA does not provide for administrative fines for non-compliance with enforcement notices. Instead, the Regulator must lodge a criminal complaint against the non-compliant information officer, which is a cumbersome process. The Regulator is pursuing proposed legislative amendments to PAIA to introduce enforcement mechanisms equivalent to those available under POPIA, including the ability for the Regulator to release information directly where an order has been made and not complied with within 180 days.
• POPIA: The Regulator has identified structural weaknesses, including the observation that once a responsible party complies within the grace period set in an enforcement notice, the Regulator can no longer impose a fine, which limits the deterrent effect. The Regulator acknowledged that the current fines regime may not be high enough to deter repeat offenders. Proposals under consideration include moving towards immediate fines upon a finding of non-compliance, mirroring the GDPR model, rather than the current “grace period” approach.

These amendments would significantly harden the regulatory framework.

New Digital Platforms

The Regulator has introduced new digital platforms including a POPIA online complaint/case management system, a POPIA exemption application portal, a POPIA/PAIA authorisation application system, and a centralised enquiry management system (iSupport).

Proactive Monitoring

The Regulator has begun a proactive monitoring exercise, sending letters to responsible parties requiring them to demonstrate compliance – rather than waiting for complaints. The private sector was noted to have materially higher compliance levels than the public sector.

What does this mean?

We draw the following practical conclusions from the briefing:

• Heightened enforcement activity. The Regulator is demonstrably moving beyond awareness-raising and into active enforcement. Organisations should treat compliance with POPIA and PAIA as a matter of immediate operational priority, not a project for next quarter.
• Security compromise preparedness. With over 1,220 security compromise notifications received in fewer than five months (and a projected 3,000 by year end), organisations must ensure they have robust incident response plans in place, including the ability to comply with section 22 notification obligations in a timely manner.
• Direct marketing compliance. Organisations that engage in direct marketing, particularly via telephone, should urgently review their practices against the Regulator’s stated position on consent requirements and opt-out mechanisms.
• PAIA annual report submissions. Both public and private bodies should ensure they submit PAIA annual reports as required under sections 32 and 83 of PAIA. While compliance rates have improved (to approximately 49% for public bodies), they remain unacceptably low, and the Regulator’s express intention to seek stronger enforcement powers means that non-compliance is likely to attract consequences in the near future.
• Anticipate legislative change. The proposed amendments to both POPIA and PAIA, including the move towards immediate fines, signal a shift towards a more punitive enforcement regime. Organisations should begin preparing for a stricter compliance environment now, rather than waiting for the legislation to catch up.

Conclusion

 The message from the Regulator is unambiguous: the era of soft enforcement is over.

In its first decade, the Regulator has moved from institutional establishment to active, assertive regulation, and the trajectory is clear. The combination of escalating enforcement action, proactive compliance monitoring, and proposed legislative amendments designed to introduce immediate fines signals a fundamental shift in the South African data protection landscape.

Organisations, in both the public and private sectors, can no longer afford to treat POPIA and PAIA compliance as peripheral or aspirational. The Regulator has demonstrated that it is willing to act against government departments, state-owned entities, and private sector operators alike. The SABS enforcement notice, the ongoing IEC and Department of Basic Education matters, and the growing list of entities under investigation all confirm that no sector is immune from scrutiny.

For the private sector, the takeaway is straightforward: invest in compliance now, or face the consequences later, consequences that, if the Regulator’s proposed amendments are enacted, will be materially more severe than those available under the current framework. For the public sector, the picture is even starker. Compliance rates remain alarmingly low, cybersecurity infrastructure is ageing, and the Regulator has made clear that it regards government’s performance as wholly inadequate.

Ten years in, the Information Regulator has found its voice, and its teeth. South African organisations would be well advised to listen.

The post The Regulator is Watching: New Enforcement Signals for POPIA and PAIA Compliance appeared first on Werksmans Attorneys.

Over the past decade, organisations have invested heavily in securing workplace technology. Laptops, smartphones, cloud applications and enterprise networks are now subject to a range of security controls, including device management, multi-factor authentication and acceptable use policies. Wearable technology has, however, received far less attention.  The latest generation of AI-enabled smart glasses, earbuds, watches and rings can receive confidential communications, analyse documents, authenticate users, record conversations and synchronise with cloud platforms. As these capabilities mature, organisations must decide whether wearables should still be viewed as personal accessories, or whether they have become another channel through which corporate information is accessed, processed and transmitted.

Wearables are no longer merely personal accessories

Wearables are electronic devices that can be worn on or attached to the human body. According to the IDC’s Worldwide Wearable Device Tracker, global wearable-device shipments totaled 145.7 million units in Q1 2026, an increase of 4.3% year-on-year.

Wearables, once associated mainly with fitness tracking, have become embedded in daily personal and professional life. Unlike laptops and smartphones, they are not always perceived as part of an organisation’s technology environment. Employees purchase them, wear them throughout the day, and design choices ensure they blend into ordinary clothing. Their familiarity masks their significance.

The change lies not only in what these devices do, but in how they operate. Earlier generations of wearables performed narrow, user-initiated tasks. Newer devices run continuously and with greater independence from the wearer. Interactions can occur through voice commands, gestures, visual prompts or automated sensing, without the wearer opening an application. A smartwatch connected to Outlook or Teams may provide almost immediate access to sensitive commercial information (emails, messages and calendar entries) without the employee touching a laptop. Smart glasses can capture photographs, video and audio, live stream, translate and interact with an AI assistant, all while resembling ordinary eyewear.

What matters most is the combination of capabilities these devices now contain. A device worn on the wrist or face may combine a camera, microphone, biometric sensors, location tracking, wireless connectivity, cloud synchronisation and AI-powered processing. It can collect information about the wearer, their colleagues, clients and the organisation, sometimes in the background, without any deliberate action by the wearer.

Many organisational controls still rely on familiar categories. Laptops are managed as workplace devices, smartphones fall under mobile-device controls, and cloud applications are assessed as third-party services. A watch, ring, pair of glasses or set of earbuds may not fit comfortably within any of these categories, even where their capabilities overlap with all three.

This creates a widening gap between how wearables are perceived and the role they actually play. Organisations should therefore consider whether their cybersecurity, information-governance and AI-governance frameworks adequately address the information these devices can access, capture, process, store and transmit.

Wearables may already be connected—even if the organisation has not approved them

Many organisational technology controls depend on visibility. Organisations know which laptops and smartphones they have issued, which personal devices have been authorised, and what security requirements apply. Procurement processes, minimum security standards, patch management requirements and device management controls are built around that visibility. Many organisations have detailed Bring Your Own Device (BYOD) policies governing personal smartphones, but those policies were drafted with smartphones in mind, not always-on, AI-enabled wearables that enter boardrooms and trading floors as unremarkable accessories.

A privately acquired wearable can bypass approval processes entirely. Employees may purchase and configure devices, install companion applications, connect to cloud services and synchronise with business applications, often without IT, information-security or legal involvement.

The connection does not necessarily have to be direct. A wearable may interact with corporate information through a paired smartphone, a companion application or a cloud-based account, without ever connecting to the corporate network independently. Its absence from the organisation’s inventory of devices therefore does not mean that it lacks access to workplace information.

An organisation may have secured its conventional workplace devices while inadvertently overlooking an entire layer of personally owned unmanaged wearables capable of interacting with corporate systems.

Corporate information may be exposed without anyone pressing “send”

Modern wearables can display email previews, messaging notifications, calendar appointments, authentication requests and other business communications. Sensitive information can become visible in circumstances not contemplated when those communications were sent.

A smartwatch displaying the subject line of a confidential merger within the view of a nearby passenger on a flight, or an executive’s smart glasses inadvertently recording a board meeting, illustrates the risks.

These risks do not depend on dishonesty or deliberate disclosure. They may arise from default device settings, automated functions, or a failure to appreciate how the device receives, displays and records information.

Wearables may expand the organisation’s cybersecurity attack surface

Wearables present cybersecurity risks beyond inadvertent disclosure of confidential information. Many devices communicate with smartphones, laptops, companion applications and cloud platforms, creating multiple pathways for information to flow. Depending on the device and its configuration, these connections may use Bluetooth, Wi-Fi or other wireless protocols.

The risk is not that every wearable is inherently insecure, but that each introduces additional software, credentials, connections and third-party services into the organisation’s environment. This expands the attack surface, the number of potential entry points through which systems or data could be compromised. Vulnerabilities may arise from outdated firmware, insecure device pairing, excessive application permissions, compromised cloud accounts or weaknesses in companion applications.

Physical connections create additional exposure. Where wearables or their accessories connect to laptops or desktops via USB for charging, synchronisation, firmware updates or data transfer, a compromised device could introduce malware or enable confidential information to be copied outside the organisation’s usual security controls.

Following a cybersecurity incident, regulators, insurers and litigants may ask whether the organisation’s security measures addressed all connected technologies capable of interacting with its systems.

AI-enabled wearables may fall outside existing AI governance controls

Several wearables now incorporate AI assistants that can summarise conversations, answer questions, draft messages and interact with business information through natural language. An employee might ask a wearable to summarise a confidential meeting or draft a response to a client.

The interaction feels different from opening a generative AI platform on a laptop and deliberately entering a prompt. A voice command during a meeting may seem like an ordinary interaction with a personal device, even though it could result in confidential or personal information being captured, transmitted and processed by an external AI service.

Organisations should ask whether confidential information is being processed by third-party AI providers; whether personal information is being transferred across borders; whether recordings, prompts or outputs are retained to train AI models; and whether their AI governance framework extends to wearables.

These issues are already surfacing in litigation. In the United States, AI-enabled smart glasses already the subject of lawsuits concerning data collection and processing practices. The allegations remain untested, but the dispute illustrates how the operation of AI-enabled wearables can create legal exposure extending beyond the individual wearer.

The technology may be new, but the legal duties are not

Legal obligations attach to the information processed, the conduct involved and the risks created—not the form of the device.

Where wearables collect or process personal information, the Protection of Personal Information Act, 2013 (POPIA) may apply. s19 requires responsible parties to implement appropriate, reasonable technical and organisational measures, identify reasonably foreseeable internal and external risks, and maintain appropriate safeguards. A device does not fall outside these requirements merely because it is personally owned.

The exposure, recording or external processing of business information through a wearable could breach employment confidentiality duties, NDAs, trade secret obligations or sector-specific requirements. Where communications with legal advisers are captured, organisations should consider the effect on legal professional privilege.

Directors remain bound by duties of care, skill and diligence reasonably expected of them. Although the Companies Act, 2008 does not prescribe controls for wearables, emerging technology risks may form part of the broader risk-governance matters warranting board oversight.

The organisation’s response to wearables must, however, also respect employees’ rights. Restrictions on personal devices, workplace monitoring and access to information collected by wearables should be proportionate, transparent and consistent with applicable privacy, employment and interception laws.

Governance should follow capability, not the label on the device

The appropriate response is not necessarily to ban wearables or draft a standalone wearables policy. Organisations should instead assess whether their existing cybersecurity, BYOD, acceptable use, confidentiality, AI-governance and incident-response frameworks address the capabilities of these devices and the circumstances in which they are used.

As part of that assessment, organisations should consider:

• Which wearables are being used in the workplace, and what are they capable of doing?
• May personal wearables interact, directly or indirectly, with corporate systems or display confidential communications?
• May camera- or microphone-enabled devices be used during confidential meetings or in sensitive areas?
• Do AI-governance and recording policies address functions such as live transcription, meeting summarisation, image analysis and contextual assistance?
• Do network-access and device-management controls adequately address wearable technology?
• Do recruitment and assessment protocols address candidates’ use of AI-enabled wearables?
• If information were captured, disclosed or compromised through a wearable, could the organisation’s incident-response processes identify, investigate and contain the incident?
• Is responsibility for wearable-related risks clearly allocated among IT, information security, legal, privacy and human-resources teams?

For many organisations, the answers may not be clear, not because they have chosen to accept the risks, but because their policies were written with laptops and smartphones in mind.

Any response should be proportionate to the device’s capabilities and the environment in which it is used. Some organisations may need to prohibit particular functions or devices in sensitive areas, while others may manage risks through configuration requirements, access restrictions and policy updates. Medical and accessibility needs must be accommodated.

Closing the governance blind spot

Wearables can no longer be excluded from organisational governance by default. Organisations should consider whether their existing frameworks govern the technology employees actually use, rather than only technology formally issued or approved.

The governance blind spot arises not from the device itself, but from policies and controls that fail to evolve as device capabilities do. Addressing the issue now enables proportionate safeguards and clear employee guidance before an unmanaged device becomes relevant to a confidentiality or cybersecurity incident.

The post Are your employees’ wearables creating a new governance blind spot? appeared first on Werksmans Attorneys.

Dr. Eric Levenstein recently featured on the Business Day Business Law Focus podcast, where he spoke to host Evan Pickworth about the increasing use of business rescue as a response to imminent liquidation.

The discussion considered the importance of timing, the requirement for a reasonable prospect of rescue, and how business rescue can be used more appropriately as a mechanism for early intervention rather than a last resort.

Read the article, Business rescue or last-ditch defence? When the process comes too late, and listen to the full discussion on Business Day.

The post Eric Levenstein featured on Business Day Business Law Focus podcast appeared first on Werksmans Attorneys.

Employers undertaking restructuring exercises are frequently faced with a practical dilemma: where the new organisational structure contains fewer or different positions, how should they determine which employees are placed into those positions without turning the placement exercise itself into an unfair selection process?

The Labour Court’s recent judgment in SASBO – The Finance Union on behalf of Members v Access Bank (SA) Ltd; Kau & others v Access Bank (SA) Ltd provides useful guidance – and some welcome reassurance for employers.  Access Bank embarked on a large-scale restructuring process which affected approximately 150 employees. As part of the restructuring, employees were required to interview for positions in the new organisational structure. The interviews took place while the section 189A consultation process was still underway, and this became one of the employees’ principal complaints.  The employees argued that the Bank’s approach to selection was flawed. Among other things, they contended that the criteria were applied inconsistently, that the Bank had departed from Last-In, First-Out (LIFO) and had relied on subjective performance assessments. They also objected to interviews being conducted while consultations were ongoing.

The Bank, however, drew an important distinction between selecting employees for retrenchment and attempting to place employees into positions in the restructured business.

Its proposed selection criteria included skills, qualifications, experience and business-critical competencies, with LIFO applying where candidates were equally suitable. Importantly, the Bank maintained that the interviews were not being used to identify employees for dismissal. Rather, they formed part of its efforts to avoid or mitigate retrenchments by redeploying employees and placing them into available positions.  That distinction found favour with the Court. The Court confirmed that sections 189 and 189A require an employer to be transparent and responsive during consultation. They do not, however, require the employer to secure agreement on selection criteria. The fact that employees or their representatives disagree with the employer’s proposed criteria does not mean that consultation has failed. Indeed, the Court expressly confirmed that the rejection of counter-proposals does not, without more, amount to a failure to consult.  This is an important point for employers. Consultation is a consensus-seeking exercise, not a consensus-requiring exercise.

Perhaps more significantly, the Court accepted that requiring employees to compete for positions through an interview process can be fair where the purpose of that process is to avoid retrenchment, rather than to determine who should be retrenched.  Where agreement cannot be reached, an employer may ultimately implement fair and objective selection criteria after properly considering the alternatives proposed during consultation. In this case, the combination of skills, qualifications, experience, business-critical requirements and LIFO where employees were equally suitable was not found to demonstrate a failure to consult in good faith.

There is, however, an important caution.  The Court acknowledged that conducting interviews while consultation was still underway could reasonably create the impression that the outcome had already been determined and could undermine confidence in the consultation process. Nevertheless, even if the timing of the interviews was procedurally irregular, that did not render the consultation process fundamentally defective. The critical consideration was the purpose of the interviews: on the Bank’s version, they were directed at redeployment and placement, rather than identifying employees for retrenchment.  The judgment therefore provides employers with a useful roadmap when restructuring. There is nothing inherently unfair about asking employees to compete for positions in a new structure. Employers should, however, maintain a clear distinction between the criteria used to select employees for retrenchment and an assessment or interview process used to determine whether employees can be placed or redeployed into available positions.  That distinction should not exist only on paper. The purpose of the interviews, the positions available and the criteria against which employees are assessed should be clearly communicated during consultation. Employers should also genuinely consult on proposed retrenchment selection criteria, consider counter-proposals and be able to explain why those proposals were rejected.

Ultimately, Access Bank is a welcome reminder that the LRA does not require an employer restructuring its business to abandon legitimate considerations of skills, qualifications, experience and business-critical requirements, nor does it necessarily prevent employees from being interviewed for positions in a new structure.   The key is knowing what the interview is for. An interview designed to select who leaves may form part of the retrenchment selection criteria. An interview designed to find a place for an employee in the restructured business may instead be part of the employer’s attempt to prevent that retrenchment altogether.

The post Interviewing for survival: When competitive interviews during retrenchment are fair appeared first on Werksmans Attorneys.

Reinstatement has long been recognised as the primary remedy for substantively unfair dismissal under the Labour Relations Act. Yet employers frequently raise the same practical objection when faced with an order restoring an employee to work: what happens if the employee’s job no longer exists?

The recent Labour Appeal Court judgment in Bakhresa SA (Pty) Ltd v Jaipal provides an important reminder that the disappearance of a position is not necessarily the end of the reinstatement enquiry. More significantly, it confirms that reinstatement and retrenchment are not mutually exclusive concepts. An employer may still embark on a genuine operational requirements process after reinstatement – but it cannot use redundancy as a shortcut to avoid reinstatement altogether.

The employee was dismissed following allegations that she had accused her employer of fraud in relation to Labour Court proceedings and had used inappropriate language towards management during an unprotected strike. The CCMA found the dismissal substantively unfair and ordered her reinstatement with retrospective effect. Both the Labour Court and, ultimately, the Labour Appeal Court upheld that decision.

The employer’s principal argument on appeal centred not on the fairness of the dismissal, but on remedy. It contended that reinstatement was no longer reasonably practicable because the employee’s position as Procurement Supervisor had become redundant after her dismissal. Her procurement responsibilities had been distributed among other employees and, according to the employer, there was simply no job to return to. That argument failed. The Court drew an important distinction between the disappearance of a position and the disappearance of the work. While the title of Procurement Supervisor may have fallen away, the procurement function plainly continued. The employer remained a large food manufacturing business that still required procurement services. The work had merely been spread across existing employees. That did not establish that reinstatement had become impossible or even impracticable.

More importantly, the Court emphasised that section 193(2)(c) of the LRA requires compelling evidence that reinstatement is not reasonably practicable. Bare assertions from management will not suffice. Employers seeking to rely on redundancy must demonstrate genuine operational circumstances making reinstatement futile or impossible. Unsupported claims that a position has been abolished will rarely meet that threshold. Perhaps the most commercially significant aspect of the judgment, however, lies elsewhere.

The Court expressly recognised that reinstatement does not prevent an employer from subsequently initiating a fair retrenchment process if operational requirements genuinely justify it. Once the employment contract has been revived, the employer remains entitled to consult under section 189 regarding any legitimate redundancy. What it cannot do is rely on its own unilateral decision to abolish a position during the employee’s absence as a reason to deny reinstatement in the first place. That distinction is critical. Reinstatement restores the employment relationship; it does not guarantee lifetime employment or freeze an employer’s operational structure. Businesses remain entitled to restructure where commercial realities demand it. Equally, employees whose dismissals have been found to be unfair remain subject to the same operational processes that would apply to any other employee.

The Court went even further by clarifying what reinstatement actually means. It is not necessarily a return to the identical job title previously occupied. Rather, reinstatement revives the employment contract on terms and conditions no less favourable than those that existed before dismissal. Positions evolve, reporting lines change and organisational structures shift. The law protects the contractual relationship – not necessarily the label attached to the role.

For employers, the practical lesson is an important one. If an unfair dismissal is challenged, replacing the employee, redistributing their duties or redesigning the organisational chart should never be viewed as an insurance policy against reinstatement. Courts are unlikely to permit employers to defeat the LRA’s primary remedy through changes that they themselves implemented after the dismissal. If genuine operational requirements arise, the appropriate course is to comply with the reinstatement order and then follow a procedurally and substantively fair consultation process under section 189.

The Labour Appeal Court’s judgment strikes a sensible balance. It preserves reinstatement as the primary remedy for unfair dismissal while recognising that legitimate business restructuring remains possible. Employers are not trapped by reinstatement orders – but nor can they use redundancy as a convenient escape route. In employment law, process still matters, and operational fairness cannot be achieved by bypassing the very protections the LRA was designed to provide.

The post Reinstated today, retrenched tomorrow? The limits of redundancy as a defence to reinstatement appeared first on Werksmans Attorneys.

South African labour law has long recognised that a dismissal can fail for one of two reasons. The employer may not have had a fair reason to dismiss the employee, or it may have followed an unfair procedure. While both render a dismissal unfair, they are distinct enquiries with distinct remedies.

A recent Labour Appeal Court judgment in Universal Product Network (Pty) Ltd v Commissioner Mbatsana NO and Others provides an important reminder that those two concepts should never be conflated.

The dispute arose from a protected strike at Universal Product Network (UPN), Woolworths’ logistics arm, during 2015. Following widespread misconduct during the strike, approximately 256 employees faced disciplinary action for breaching picketing rules, violating a court interdict and obstructing access to the employer’s premises. After numerous disciplinary enquiries, almost all were dismissed.

The CCMA commissioner concluded that the dismissals were substantively fair. The employees had been properly identified, had breached the picketing rules and the employer had a valid reason for dismissal. However, the disciplinary process itself was procedurally flawed, resulting in an award of one month’s remuneration to each employee as compensation.  That should, in many respects, have been the end of the matter.  Instead, the Labour Court took a different approach. It reasoned that the procedural defects were so severe that they effectively tainted the outcome of the disciplinary proceedings, converting what had been a substantively fair dismissal into one that was substantively unfair. The court ordered reinstatement.

The Labour Appeal Court emphatically disagreed.  Perhaps the most significant aspect of the judgment is not simply the outcome, but the principle it establishes. The LAC rejected the proposition that “gross procedural unfairness” can somehow mutate into substantive unfairness. The current Labour Relations Act deliberately separates these two enquiries. Section 188 requires employers to prove both a fair reason for dismissal and a fair procedure. Failing one requirement does not erase compliance with the other.

The court illustrated the point with a practical example. An employee dismissed for theft without being afforded a disciplinary hearing may have suffered a procedurally unfair dismissal. That does not mean the employer suddenly lacked a fair reason for dismissal. The misconduct remains the misconduct. The procedural defect does not rewrite the facts.

This may appear obvious, but it is an important clarification. Over the years, various judgments have referred to “gross procedural unfairness” in different contexts, particularly where arbitration proceedings themselves were fundamentally defective. The Labour Appeal Court drew an important distinction between procedural unfairness during an internal disciplinary process and a gross irregularity during arbitration that deprives parties of a fair hearing. The latter may justify setting aside an arbitration award. The former does not transform the underlying reason for dismissal into an unfair one.

Equally important was the court’s criticism of the Labour Court for deciding a case that had never been pleaded. The employees had challenged the substantive fairness of their dismissals on the basis that they were not guilty and that dismissal was an inappropriate sanction. They had not argued that procedural unfairness itself rendered the dismissals substantively unfair. A reviewing court cannot create an entirely new case for a litigant. Litigation remains governed by pleadings, and review proceedings remain confined to the grounds advanced by the parties.

For employers, the judgment should not be read as permission to relax procedural standards. Procedural fairness remains a statutory requirement, and employers who disregard it may still face compensation awards. A procedurally flawed dismissal is still unfair.

What the judgment does provide, however, is welcome certainty. Where an employer can establish a fair reason for dismissal, procedural defects—even serious ones—do not automatically erase the substantive justification for the decision. The appropriate remedy will generally be compensation for procedural unfairness rather than reinstatement.

The Labour Appeal Court has therefore reaffirmed a principle that lies at the heart of dismissal law: substance and procedure travel together, but they remain separate journeys. Employers ignore either at their peril, but neither should be mistaken for the other.

The post Bad process doesn’t make a good dismissal bad: LAC draws a clear line between procedure and substance appeared first on Werksmans Attorneys.