“The EU AI Act asks a simple question of anyone building high-risk AI systems: can your organisation reliably produce safe, lawful systems, and can it prove this? A quality management system is how you answer.”

Introduction

Good outcomes stem from good processes and quality cannot be tested into a product at the end; it has to be built in from the start. This seems to be ethos behind the EU’s AI Act (the AI Act) and how we ought to consider artificial intelligence (AI) systems in future.

What does this mean for providers of high-risk AI systems? Well, the organisations that develop high-risk AI systems and place them on the market must now prioritise a quality management system (QMS). A QMS is a written set of policies, procedures and instructions showing how the organisation designs, tests, monitors and fixes its AI systems.

None of this is entirely new. Many organisations already run quality systems under ISO 9001. Privacy law also takes the same approach. The GDPR and POPIA both rest on accountability, this demands that organisations must take responsibility for compliance and be able to prove it. An AI QMS builds on these foundations rather than replacing them.

The AI Act also reaches beyond Europe. It applies to providers outside the EU whose high-risk systems are sold in the EU, or whose outputs are used there. South African developers with European clients must therefore take note and stay alert.

The EU AI Act’s QMS Requirements

The law wants organisations, not just products, to be trustworthy. One compliant AI system proves little, what matters most is whether an organisation has a dependable way of producing compliant systems every time.

The QMS duty sits in Article 17 of the AI Act. It is often confused as a duty to manage risk, but risk management is only one part of the wider system. A QMS must cover the whole life of an AI system: a plan for meeting the rules, how the system is designed and tested, how data is collected and handled, how risks are identified and reduced, and who is responsible for each step.

Through the QMS, an organisation must also show that it has satisfied the AI Act’s other core requirements. These include good-quality, representative data; clear technical records; automatic logs of how the system operates; meaningful human oversight; and accuracy, robustness and  cybersecurity. Once an AI system is in use, an organisation must constantly assess its performance (known as post-market monitoring) and report serious incidents to the relevant  authorities.

How does the AI Act align with the GDPR and POPIA? The requirements in the AI Act mirror familiar privacy principles embedded in POPIA and the GDPR. For instance, good data governance reflects purpose limitation and data minimisation, this translate to the idea that data must only be used for a defined purpose, and should not be collected unnecessarily. From a POPIA perspective, the AI Act expresses the same ideas through its conditions of processing limitation, purpose specification and information quality. Technical records and logs provides for accountability under both laws, meaning that an organisation will be able to show, not merely say, that it complied.

What a Compliant AI QMS Looks Like

A good QMS is a living cycle, not a file on a shelf.  It follows a simple loop: plan what you will do, do it, check whether it worked, and act on what you find. In this essence, the implementation of an OMS must be integrated throughout an organisation and not be treated as another compliance tick-box exercise.

ISO/IEC 42001, an international standard for managing AI across an organisation, adds an AI-specific layer and can be certified. Although certification serves as useful evidence of compliance, it does not by itself prove compliance with the AI Act.

The standard most closely tied to the AI Act is EN 18286, a European standard written specifically for the AI Act’s QMS duty. The EU published its reference in the Official Journal on 19 October 2026. Following a standard published in this way (a “harmonised standard”) creates a legal presumption that the requirements of the AI Act are fulfilled.

A third standard, ISO/IEC 27090:2026, published on 14 October 2026, addresses a different question: how to protect AI systems from attack. It gives guidance on threats such as data poisoning (corrupting training data), model theft and prompt injection (tricking a system with hidden instructions). At this stage, it merely provides guidance and also serves as a useful reference on how organisations can accede to the AI Act’s cybersecurity requirement.

The GDPR requires data protection by design: building privacy into systems from the outset. POPIA requires responsible parties to ensure its conditions are met both when they decide how processing will work and while it takes place. It therefore important to understand that a well-built AI QMS ensures compliance with the GDPR and POPIA if done correctly.

Legal and Regulatory Implications

Rules without consequences do not change behaviour. The AI Act therefore gives regulators real powers, this shifts the spotlight on organisations as they will be forced to prove that they acted responsibly should they find themselves in hot waters with regulators.

Failing to run a proper QMS can lead to fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher.

Fines are not the only risk. Regulators can require changes, restrict sales, or order a system to be withdrawn or recalled, meaning that a system cannot stay on the market if it is a commercial problem, well before it becomes a financial one.

Regulators will ask three questions. Is there a written procedure for each requirement? Is it followed? Can the records prove it? After an incident, the question will focus less on whether the system made a mistake and more on whether the organisation had a way of noticing and if it was reported to the relevant authorities.

South Africa’s Information Regulator follows a similar logic. It can issue enforcement notices and, where these are ignored, impose administrative fines of up to R10 million. Enforcement is increasing.  The Regulator has also begun asking organisations to demonstrate compliance before any complaint is made, and is considering proposals for immediate fines similar to the GDPR model. The message is the same as under the AI Act: be able to prove what you have done.

Specific Considerations

AI rules do not replace existing rules; they sit alongside them. The aim is to fit the AI QMS into the existing governance and not build a separate structure. Therefore the AI Act must be read in harmony with the GDPR and POPIA, for local businesses.

Data Privacy and Cybersecurity

The AI Act’s data and cybersecurity requirements overlap heavily with existing privacy law. Under the GDPR, organisations must assess high-risk processing in advance, build in protection by design, and protect people from decisions made solely by automated means. POPIA has a close equivalent. People may not be subject to a decision with legal or substantial effects based solely on automated profiling unless an exception applies. Where one does, they must be able to make representations and be given enough information about the logic of the processing to do so.

POPIA also requires appropriate security safeguards, notification of security compromises to the Information Regulator and affected people, and a personal information impact assessment. The EU’s NIS2 cybersecurity rules add further duties, and ISO/IEC 27090:2026 offers a shared reference for AI-specific threats. A poisoned training dataset can be a security incident, a data quality failure, and possibly a personal data breach, so one well-designed assessment can often cover all three regimes.

But what are the practical implications of this AI Act?

Organisations that cope best with new regulations tend to share three habits. They start early, they build on what they already have, and they keep the evidence to maintain a record. Fortunately, the AI Act caters for all three habits.

Any programme must begin with the correct timetable. The Digital Omnibus on AI moved the QMS deadlines, which will apply from 2 December 2027 for stand-alone high-risk systems and from 2 August 2028 for high-risk AI built into regulated products. These dates are fixed and do not depend on standards being ready. It is equally important to remember what has not moved: the bans on prohibited AI practices, these have applied since February 2025, and the penalty rules have been enforce since August 2025.

With the timetable settled, the first practical question is : what does an organisation actually have. Very few organisations keep a complete list of the AI systems they develop or use, and fewer still have assessed which are high-risk. This exercise matters as it informs the an organisation’s obligations. A provider carries the QMS duty while a user of someone else’s system carries lighter obligations. However, the line can shift as an organisation undergoes significant changes or rebranding, a system can turn its user into its provider. An inventory that records both risk classification and role is therefore the foundation on which everything else rests.

The next step is to measure existing governance against the Act’s requirements, rather than starting afresh. Most regulated organisations already run quality, risk and privacy frameworks, and the gap is often narrower than it first appears. EN 18286 provides the natural benchmark because it was written for the Act’s QMS duty, and any decision to depart from it should be recorded with reasons that are well-substantiated. ISO/IEC 27090:2026 can serve as a reference point for AI-specific security controls, however, its role as guideline should not be understood as a route to presumed compliance. Privacy compliance belongs in the same exercise and AI assessments can often be combined with GDPR data protection impact assessments and POPIA personal information impact assessments. Moreover involving data protection officers or POPIA information officers from the outset avoids parallel processes that reach inconsistent conclusions.

A system is only as strong as the people accountable for it. Senior management should hold clear responsibility for the QMS, with named owners for each part, so regulators and notified bodies can see who answers for what.

The final consideration is to look outward, to incidents and to suppliers. Monitoring and incident-reporting plans are of little value if they are first tested during a real incident, so organisations should rehearse them in advance, including the timelines for notifying regulators under both the AI Act and POPIA. Much AI is also bought rather than built, which means compliance depends on the supply chain. Contracts should therefore pass obligations down to suppliers through warranties, audit rights and access to documentation. An organisation cannot evidence a QMS for a system it cannot see inside.

Conclusion

The AI Act asks an organisational question before a technical one: can this organisation reliably produce trustworthy AI output, and can it prove this? The QMS is where that question is answered. The underlying ideas will be familiar to anyone who works with the GDPR or POPIA: take responsibility, design a compliance system and keep the records to prove it.

What this means for South African companies

The AI Act is not South African law, but it will most certainly shape South African practice Three groups will be most affected. The first is South African developers that sell or license high-risk AI to customers in the EU. The second is companies whose AI outputs are used in the EU, even where the system itself never leaves South Africa. The third is local subsidiaries of multinational groups, who are usually expected to follow group-wide AI governance built to EU requirements.

The central lesson here is that AI governance has become an organisational discipline, not  just a technical add-on.  The QMS model requires written procedures, named owners, and records that prove compliances with the model. Standards give that discipline its shape and provide guidance on how to incorporate AI governance within an organisation. EN 18286 is a European instrument, but ISO/IEC 42001 and ISO/IEC 27090:2026 are international and can be adopted anywhere.

South Africa is not starting from nothing. POPIA already requires accountability, purpose specification, information quality and security safeguards, and restricts decisions based solely on automated profiling. The Information Regulator is enforcing it with growing confidence. Banks, insurers and energy operators also work within established governance and risk regimes. The gap is one of scope. However, POPIA protects personal information; it does not regulate AI’s safety, robustness, or human oversight.

Nonetheless, for local businesses with European clientele, early alignment is a commercial advantage for those businesses. European customers will expect suppliers to evidence an AI QMS, and procurement contracts are likely to demand it well before any South African law does. Companies that can show alignment will find it easier to win and keep attracting business from that part of the world. They will also be better placed when domestic policy arrives, since it is likely to draw on the same international standards that are already established.

The post AI Quality Management under the EU AI Act: Principles, Obligations and the Links to GDPR and POPIA appeared first on Werksmans Attorneys.

In Part 1, “Confidence Is Not Capability (Part 1): What the Data Shows, and Why POPIA Is the Foundation of Cyber Resilience”, we reviewed the findings of the Data Confidence & AI Readiness in Africa Report 2026, published by Veeam Software together with ITWeb. We argued that POPIA’s security safeguard, data minimisation, breach notification and operator provisions already amount to a cyber-resilience framework, and that data visibility is the foundation on which all of them rest.

This article addresses the technology that will test that foundation most. Only 29% of organisations consider themselves advanced or fully ready to adopt, govern and scale AI using trusted data. [1] Yet AI is already embedded in core operations and autonomous workflows at 14% of them. [2]

The role of AI in cybersecurity: force multiplier and new attack surface

AI as a defender

AI is well suited to the problems the survey identifies. Detection based on machine learning can establish baselines of normal user, system and data behaviour and flag anomalies far faster than human analysts working through alerts. Typical anomalies include unusual access to sensitive datasets, mass encryption activity and abnormal data egress. Automated tools can scan backups for indicators of compromise, verify that restore points are clean, and run recovery tests routinely rather than annually. That directly addresses the gap between recovery confidence and proof of recovery. [3] The report itself highlights automated backup and recovery verification as a means of maintaining audit-ready evidence of resilience, though that passage describes the vendor’s own platform. [4]

AI can also serve as a compliance tool. Automated data discovery and classification can locate personal and special personal information across sprawling areas in the business. That tackles the classification (28%) and visibility (26%) weaknesses respondents report. [5] It also supports the data mapping on which section 19 risk assessments, section 14 retention schedules and section 22 incident scoping depend. Only 15% of respondents identify privacy automation as an investment priority. [6] Yet it can help enforce retention rules, manage data subject requests, monitor cross-border flows and generate the documentation a regulator would expect. For organisations constrained by skills shortages, the single largest barrier at 32%, [7] well-governed AI tooling can extend the reach of small security and privacy teams.

AI as a risk: shadow AI and data leakage

 The same technology creates new exposure. The 11% of organisations reporting informal or employee-led use of public AI tools with limited oversight, [8] and the 17% citing shadow IT or shadow AI as a barrier to data confidence, [9] show the risk of personal and confidential information entering tools outside the organisation’s control. That may amount to processing without a lawful basis, further processing incompatible with the original purpose, an unauthorised cross-border transfer under section 72, or a failure of section 19 safeguards. Where AI systems are used to make decisions about individuals, section 71’s restrictions on decisions based solely on automated processing may also apply. AI also strengthens attackers, enabling more convincing phishing, deepfake-enabled fraud and faster reconnaissance.

The rogue AI agent threat

The most significant emerging risk is agentic AI: systems that do more than generate text and can retrieve enterprise data and trigger actions in business systems with limited human intervention. The survey shows that 14% of organisations have already embedded AI into core operations or autonomous workflows. [10]

An AI agent becomes “rogue” when it acts outside its intended mandate. That may happen because it has been manipulated through prompt injection or poisoned data, because it has been granted excessive permissions, because its credentials have been hijacked, or because it has misread its instructions. Unlike a human insider, an agent acts at machine speed and scale. It may extract and transmit large volumes of personal information, alter or delete records, or spread errors through connected systems before anyone notices. An agent typically operates under its own service identity. Organisations with weak identity controls and incomplete audit trails, which describes the majority of respondents, [11] may be unable to reconstruct what it did.

The technology is novel, but the POPIA analysis is not. Processing by an AI agent that a responsible party deploys is processing by that responsible party, and accountability cannot be delegated to the software. If an agent accesses or discloses personal information outside its authorised purpose, that may constitute unauthorised access triggering section 22 notification obligations. The lack of controls to prevent it may be measured against the section 19 standard.

Agents should therefore be governed as privileged identities:

• give them least-privilege, purpose-bound access;
• log and monitor every action they take;
• require human approval for high-impact actions;
• make sure they can be suspended immediately; and
• back them with tested recovery capability, so that data an agent alters or destroys can be restored to a known clean state.

The market is beginning to recognise this: 41% of organisations are prioritising identity and access controls and 42% AI governance. [12] Readiness of only 29% [13] shows how far there is still to go.

Practical recommendations for clients

The first priority is to stop assuming resilience and start proving it. Organisations should run regular, documented end-to-end recovery tests of their critical data, applications and supporting environments against agreed recovery targets, and fix whatever those tests expose. The evidence those tests produce belongs in the section 19 compliance record, because it is the clearest available proof that safeguards have been verified rather than merely adopted. Recovery testing is only as meaningful as the organisation’s knowledge of what it is recovering. An accurate inventory of the personal and business-critical information held, where it resides and why, should therefore follow. That inventory must extend to backups, SaaS platforms and third parties, and it should be paired with retention schedules that are actually enforced, so that information no longer needed is deleted before it can be stolen.

Knowing where data sits is of limited value without knowing who, or what, has touched it. Clients should be able to produce reliable audit trails of access to their most sensitive datasets across all critical systems. This capability does double duty: it detects misuse, and it makes it possible to establish the facts that a section 22 notification requires. The same discipline must be applied to AI before its use is scaled. That means an acceptable-use policy, a register of approved tools and a personal information impact assessment process for each AI use case. Shadow AI is better addressed through sanctioned alternatives, training and technical controls than through prohibition alone, which tends to drive use out of sight. Where AI systems are given the ability to act, they should be governed as privileged identities. That requires:

• least-privilege, purpose-bound access;
• comprehensive logging;
• human approval for high-impact actions;
• an immediate means of suspension;
• rogue-agent scenarios built into incident response and recovery testing.

These controls lose much of their force if they stop at the organisation’s boundary. Operator agreements should be reviewed to secure section 21-compliant security and breach-notification obligations, meaningful audit rights and a clear allocation of liability. This should be done with particular care for cloud and AI providers and for any processing that engages the cross-border restrictions in section 72. Even well-constructed contracts will not prevent every incident. A tested response plan that brings legal, privacy, communications and technical teams together, with section 22 notification templates and agreed decision-making protocols, is what allows an organisation to meet its obligations under pressure rather than improvise them.

Progress should be measured by recovery test results and by the organisation’s demonstrable ability to explain and control how its data is used. That measurement belongs before the board. Cyber resilience, privacy compliance and AI governance are interdependent board-level risks. Directors are entitled to, and should insist on, regular evidence-based reporting rather than statements of confidence that the survey shows are too often unsupported by results.

Conclusion

The Data Confidence & AI Readiness in Africa Report 2026 is clear: optimism is high, but proven capability lags. For South African organisations, POPIA already provides the framework to close that gap. Its requirements to identify risks, implement and verify safeguards, minimise data, control operators and notify compromises are the building blocks of cyber resilience. AI will be indispensable in meeting those obligations at scale, but only if it is governed with the same discipline. Organisations that run data privacy compliance, resilience and AI governance as one programme will be best placed to withstand the next incident, and to show afterwards that they did.

[1] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[2] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[3] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability – Recovery Confidence is Outpacing Recovery Proof’, pp. 3–4.

[4] Data Confidence & AI Readiness in Africa Report 2026, ‘From Confidence to Capability – Veeam Data Platform: Closing the Gaps in Recovery, Visibility, and Governance’, p. 14.

[5] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[6] Data Confidence & AI Readiness in Africa Report 2026, ‘Investment Plans’, pp. 10–11.

[7] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[8] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[9] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[10] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[11] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges’, pp. 7–9.

[12] Data Confidence & AI Readiness in Africa Report 2026, ‘Investment Plans’, pp. 10–11.

[13] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

The post Confidence is not capability (Part 2): Governing AI in the age of the rogue agent appeared first on Werksmans Attorneys.

A two-part series drawing on the Data Confidence & AI Readiness in Africa Report 2026

Introduction

Ransomware is no longer an IT outage. Today’s attacks target backups first, exfiltrate personal information before encrypting it and use the threat of publication to extract payment. Running alongside that threat, artificial intelligence has moved from pilot projects into daily use in most large organisations, usually ahead of the controls meant to govern it. In South Africa, all of this takes place under a data protection regime that has been fully enforceable since 1 July 2021. The Protection of Personal Information Act 4 of 2013 (POPIA) is administered by an Information Regulator that has shown it will act when security safeguards fail.

Boards are now asked a narrower, harder question than whether an incident will occur: can the organisation show, with evidence, that it can withstand one? The Data Confidence & AI Readiness in Africa Report 2026, published by Veeam Software together with ITWeb, suggests that many cannot. Its central finding is that confidence is running well ahead of capability. [1]

This is the first of two articles on the report. Part 1 sets out the key survey findings. It then explains why POPIA compliance operates as a cyber-resilience framework in its own right, and why data visibility is where legal exposure and operational risk meet. Part 2 turns to artificial intelligence, both as a defensive tool and as a source of new risk, including the emerging threat of rogue AI agents, and closes with practical recommendations.

Key findings from the survey

About the survey

The survey was conducted online via the ITWeb and ITWeb Africa platforms during June and July 2026. It drew responses from 140 senior IT, data and cybersecurity leaders at medium and large organisations across 14 African countries, with just under 70% of respondents based in South Africa. [8] Respondents spanned financial services, retail, mining, telecommunications, media and the public sector, and included CIOs, CISOs, CTOs and data and AI leaders. [9] The survey findings are a strong directional indicator, not a statistically definitive picture of the market.

Finding 1: recovery confidence is outpacing recovery proof

More than half (52%) of executives are very or extremely confident that they could recover clean, usable data after a ransomware attack, and a further 33% are moderately confident, so 85% express at least moderate confidence. [10] Yet 32% have never performed a full technical recovery test, have not tested in over a year, or do not know when testing last occurred. [11] Even among organisations that completed an end-to-end recovery test, 45% reported only partial success, significant gaps or outright failure. [12]

The report concludes that some organisations are relying on backup policies or assumptions rather than validated recovery performance. It warns that, without regular end-to-end testing, a ransomware incident could result in extended downtime, data-integrity problems, regulatory exposure and reputational damage. [13]

In legal terms, this is the difference between having a safeguard on paper and being able to demonstrate that it works.

Finding 2: AI adoption is outpacing organisational controls

Only 29% of organisations consider themselves advanced or fully ready to adopt, govern and scale AI using trusted data. [14] At the same time, 36% use approved AI tools in selected business functions, 27% are running pilots or experiments, and 14% have embedded AI into core business operations or autonomous workflows. [15] A further 11% report informal or employee-led use of public AI tools with limited oversight. [16]

Around half of respondents use AI in business functions, core processes, or automated workflows, yet fewer than a third consider themselves ready to govern it. The report treats the presence of “shadow AI” as evidence that employee demand is moving faster than organisational controls. [17]

Without stronger data governance, access controls and oversight, organisations risk exposing sensitive information, creating compliance issues and undermining trust in AI-generated outputs. [18]

Finding 3: organisations cannot fully see or account for their data

The biggest barriers to maintaining data confidence are skills shortages (32%), incomplete or inconsistent data classification (28%), budget constraints (27%), lack of visibility into sensitive or critical data (26%) and legacy systems (25%). [19] Respondents also cite data sprawl across cloud, SaaS, endpoints, backups and third parties (23%), reliance on manual inventories or spreadsheets (19%) and shadow IT or shadow AI use (17%). [20]

The accountability gap is stark. Only 37% say they can produce an accurate audit trail showing who accessed their most sensitive datasets across most or all critical systems in the past seven days; 55% can do so only partially or for selected systems, and 8% cannot or do not know. [21] The report observes that fragmented visibility makes it difficult to demonstrate compliance, detect misuse or respond quickly to security incidents. It adds that organisations without accurate data inventories and access monitoring will struggle as regulatory scrutiny intensifies. [22]

Finding 4: investment is accelerating in the right places

Nearly 70% of organisations expect to increase spending on data protection, cyber resilience and AI governance over the next 12 months, with 30% anticipating a significant increase. [23] Investment priorities are backup and recovery (54%), AI governance (42%), identity and access controls (41%), data discovery and classification (36%) and cloud and SaaS data protection (30%). [24] Privacy automation (15%) and data security posture management (6%) remain lower priorities. [25] The report notes that organisations are beginning to treat cyber resilience and AI as two outcomes of the same foundation, trusted data, rather than as separate initiatives. [26]

Finding 5: geography and size shape maturity, but not always as expected

Multi-country organisations are markedly more mature. They are more likely to have AI embedded in core operations (22% against 5%) and to be advanced or fully AI-ready (39% against 18%); they report higher ransomware recovery confidence (60% against 45%) and fewer unsuccessful recovery tests (4% against 11%). [27] The report attributes this to the greater regulatory and operational complexity of cross-border operations, which drives earlier investment in AI governance, data visibility and cyber resilience, although multi-country organisations struggle more with data sprawl, classification and cross-border compliance. [28] Single-country organisations are more constrained by skills shortages (40% against 24%) and budgets, and focus on backup and recovery (67% against 42%). [29]

Size, by contrast, does not guarantee maturity. Smaller organisations (under 500 employees) are more likely to be very confident that they know where sensitive data resides (47% against 30%) and rate their data-management capability more positively (56% against 38%); no smaller respondent rated its capabilities as poor, compared with 11% of large organisations. [30] Larger organisations place greater emphasis on identity and access controls (45% against 33%), while smaller organisations invest more heavily in AI governance (51% against 38%) and skills development (37% against 17%). [31]

The lesson for South African clients is that regulatory complexity, properly managed, appears to drive maturity. Organisations that have seriously dealt with cross-border data protection obligations are better prepared to recover from attack and scale AI safely.

The imperative of data privacy compliance: POPIA as a cyber-defence framework

Privacy compliance and cybersecurity are still often treated as separate disciplines, one owned by legal and the other by IT. The survey shows why that division no longer holds. Almost every weakness it identifies corresponds directly to an existing obligation under POPIA: untested recovery, poor data visibility, inadequate audit trails, uncontrolled AI use and data sprawl across third parties. Properly implemented, compliance is not an overhead added to security. It is a structured security programme that the law already requires.

Section 19: security safeguards are a continuous, risk-based obligation

Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control. It must do so by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of it. The section also requires the responsible party to identify all reasonably foreseeable internal and external risks, to establish and maintain appropriate safeguards against them, to regularly verify that those safeguards are effectively implemented, and to ensure that they are continually updated in response to new risks or deficiencies. It also requires due regard to generally accepted information security practices.

The duty to verify is where the law and the survey meet. An organisation that has never conducted an end-to-end recovery test, or whose last test failed, will find it difficult to show that it has regularly verified the effectiveness of its safeguards. That applies to the 32% of respondents who have not recently tested, or do not know when they last did, [32] and to the 45% of testers who reported partial success, significant gaps or failure. [33] These organisations are not only operationally exposed; they may also face a finding that they have not met the section 19 standard. Ransomware that destroys or encrypts personal information without a reliable route to restoration is exactly the “loss” and “damage” the section is designed to prevent.

Know your data: the processing conditions shrink the attack surface

Several of POPIA’s conditions for lawful processing operate, in practice, as attack-surface reduction measures. The minimality principle (section 10) limits processing to what is adequate, relevant and not excessive. The retention and restriction provisions (section 14) require records to be kept no longer than necessary and then destroyed, deleted or de-identified. Information that has been lawfully deleted cannot be stolen, encrypted or published. Organisations struggling with data sprawl across cloud, SaaS, endpoints, backups and third parties (23%) and with inconsistent classification (28%) [34] are carrying breach liability they do not need to carry.

Compliance with POPIA also presupposes that an organisation knows what personal information it holds, where it is and why it is processed. Two sets of requirements force exactly the data mapping and classification that the survey identifies as weak. The first is the Information Officer’s duties under section 55. The second is regulation 4 of the POPIA Regulations, which requires a compliance framework, personal information impact assessments and related measures. The report’s own recommendation is to know what data is held, where it sits, how it is used and which privacy requirements apply, including where it moves across borders. [35] In substance, that describes a mature POPIA compliance programme.

Section 22: you cannot notify what you cannot see

Section 22 applies where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. The responsible party must then notify the Information Regulator and, subject to limited exceptions, the affected data subjects as soon as reasonably possible after discovery. The notification must give data subjects enough information to take protective measures, including a description of the possible consequences, the measures taken or intended, and, where known, the identity of the unauthorised person.

That obligation cannot be met without evidence. Most respondents cannot produce an accurate audit trail showing who accessed their most sensitive datasets across most or all critical systems. That is the position of 63%: 55% can do so only partially or for selected systems, and 8% cannot or do not know. [36] Organisations in that position will struggle to determine whether a compromise has occurred, how far it extends and whom to notify. The result is either delayed notification or over-notification, and both carry regulatory and reputational cost. Access logging and monitoring are therefore more than security controls; they are the evidence on which lawful incident response depends.

Operators, third parties and cross-border flows

Sections 20 and 21 govern operators, the service providers that process personal information on a responsible party’s behalf. An operator may process the information only with the responsible party’s knowledge or authorisation and must treat it as confidential. It must also be bound by a written contract requiring it to establish and maintain section 19 security measures and to notify the responsible party immediately of any suspected compromise. Cloud, SaaS and outsourced services are now the norm, and the survey finds that data sprawl extends to third parties. [37] Supply-chain contracting and oversight are therefore among the most effective cyber-risk controls available. Section 72 restricts transfers of personal information outside South Africa unless prescribed safeguards are met. It applies to multi-country organisations, which report greater difficulty with cross-border compliance, [38] and to employees who paste personal information into public AI tools hosted offshore.

Enforcement and accountability raise the stakes

POPIA’s accountability condition (section 8) places responsibility squarely on the responsible party. The Information Regulator may issue enforcement notices and infringement notices, and administrative fines of up to R10 million may be imposed. The Regulator has already taken enforcement action against a national government department following a ransomware attack, citing failures in basic security safeguards. Sector-specific regimes add further obligations; financial institutions, for example, are subject to the Prudential Authority and FSCA Joint Standard on cybersecurity and cyber resilience. Across these regimes, regulators expect evidence that safeguards work, not assurances that they exist.

POPIA compliance reduces exposure to data breaches, ransomware and other cyber threats in four concrete ways. It forces organisations to identify and minimise the data at risk. It requires risk-based safeguards that are regularly verified. It extends security obligations contractually into the supply chain. It also builds the visibility and governance needed to detect, contain and report incidents quickly.

Part 1 in summary

The survey describes a market that is confident but not yet able to prove that confidence. Recovery is assumed more often than it is tested, and when it is tested, it often fails. [39] Fewer than four in ten organisations can account for who has accessed their most sensitive data across most or all critical systems. [40] Investment is rising, and it is increasingly directed at governance and visibility rather than backup alone.

POPIA does not create these gaps, but it turns them into legal exposure. Sections 19 and 22, the processing conditions and the operator regime already require what resilient organisations do anyway: they know their data, verify their safeguards, control their suppliers and can explain an incident when it occurs.

Data visibility is the common thread. It determines whether an organisation can minimise what it holds, verify what it protects and notify what it loses. It will also determine whether an organisation can safely deploy the AI tools now entering its systems.

In Part 2, we examine the role of artificial intelligence in cybersecurity. We consider how it can strengthen detection, recovery and compliance, how shadow AI creates new exposure under POPIA, and why autonomous AI agents acting outside their mandate are the next governance problem for boards. We close with practical recommendations for clients.

[1] Data Confidence & AI Readiness in Africa Report 2026, ‘From Confidence to Capability’, p. 14.

[2] Data Confidence & AI Readiness in Africa Report 2026, ‘Overview of Survey Methodology’, p. 2.

[3] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability’, p. 3.

[4] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability – Recovery Confidence is Outpacing Recovery Proof’, pp. 3–4.

[5] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[6] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges’, pp. 7–9.

[7] Data Confidence & AI Readiness in Africa Report 2026, ‘Investment Plans’, pp. 10–11.

[8] ‘Overview of Survey Methodology’, p. 2.

[9] ‘Overview of Survey Methodology – Respondent Profile’, p. 2.

[10] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability’, p. 3.

[11] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability’, p. 3.

[12] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability – Recovery Confidence is Outpacing Recovery Proof’, pp. 3–4.

[13] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability – Recovery Confidence is Outpacing Recovery Proof’, pp. 3–4.

[14] Data Confidence & AI Readiness in Africa Report 2026 ‘AI Adoption Outpaces Readiness’, p. 5.

[15] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[16] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness’, p. 5.

[17] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness – Employee Use of AI is Outpacing Organisational Controls’, pp. 5–6.

[18] Data Confidence & AI Readiness in Africa Report 2026, ‘AI Adoption Outpaces Readiness – Employee Use of AI is Outpacing Organisational Controls’, pp. 5–6.

[19] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[20] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[21] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges’, pp. 7–9.

[22] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Limited Visibility and Access Monitoring Undermine Data Protection, Governance and Trust’, p. 9.

[23] Data Confidence & AI Readiness in Africa Report 2026, ‘Investment Plans’, pp. 10–11.

[24] Data Confidence & AI Readiness in Africa Report 2026, ‘Investment Plans’, pp. 10–11.

[25] Data Confidence & AI Readiness in Africa Report 2026,  ‘Investment Plans’, pp. 10–11.

[26] Data Confidence & AI Readiness in Africa Report 2026, ‘Investment Plans – Spending Plans Suggest that Trusted Data is Becoming a Strategic Business Priority’, p. 11.

[27] Data Confidence & AI Readiness in Africa Report 2026, ‘Geography Shapes AI and Resilience Maturity’, p. 12.

[28] Data Confidence & AI Readiness in Africa Report 2026, ‘Geography Shapes AI and Resilience Maturity’, p. 12.

[29] Data Confidence & AI Readiness in Africa Report 2026, ‘Geography Shapes AI and Resilience Maturity’, p. 12.

[30] Data Confidence & AI Readiness in Africa Report 2026, ‘Organisational Size Does Not Equal Maturity’, p. 13.

[31] Data Confidence & AI Readiness in Africa Report 2026, ‘Organisational Size Does Not Equal Maturity’, p. 13.

[32] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability’, p. 3.

[33] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability – Recovery Confidence is Outpacing Recovery Proof’, pp. 3–4.

[34] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[35] Data Confidence & AI Readiness in Africa Report 2026, ‘From Confidence to Capability’, p. 14.

[36] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges’, pp. 7–9.

[37] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges – Biggest Challenges in Maintaining Confidence in Data’, pp. 7–8.

[38] Data Confidence & AI Readiness in Africa Report 2026, ‘Geography Shapes AI and Resilience Maturity’, p. 12.

[39] Data Confidence & AI Readiness in Africa Report 2026, ‘Confidence vs. Capability – Recovery Confidence is Outpacing Recovery Proof’, pp. 3–4.

[40] Data Confidence & AI Readiness in Africa Report 2026, ‘Data Visibility and Audit Challenges’, pp. 7–9.

The post Confidence is not capability (Part 1): What the data shows, and why POPIA is the foundation of cyber resilience appeared first on Werksmans Attorneys.

No one defends the spam caller. According to the National Consumer Commission (“NCC”), South Africans received 17.47 billion spam calls between January and June 2026, a 25.2% increase in the same period during 2025. It therefore comes as no surprise that consumers are frustrated by spam calls from unwanted callers. Nonetheless, it is equally important that a regulatory response must be measured against the harm it targets and the harm it causes. Judged that way, the NCC’s draft Guidelines for Compliance with the Opt-Out Registry Regulations (“the draft Guidelines”) are materially flawed.

Gazetted on 2 October 2026, the draft Guidelines provided interested parties with 15 days to provide their comments for the NCC’s consideration. One could argue that this is insufficient time for interested parties to consider the implication of the guidelines on their businesses and to provide meaningful input. From a simple reading, one finds that these guidelines punish compliant marketers, overlap awkwardly with existing privacy laws, and create new privacy risks of their own with many unanswered questions lingering in the air.

Commercial paralysis

The draft Guidelines require every direct marketer to register before doing any direct marketing, and to renew that registration every year. The net is cast very wide. It covers retailers, insurers, financial institutions, estate agencies, vehicle dealerships and digital marketers, in every industry.

The most disruptive rule concerns consent. The draft Guidelines state that historical or existing consent becomes invalid once a consumer registers a pre-emptive block, and that fresh consent does not override that block unless the consumer first removes it. Practically speaking, this implies that a customer who actively asks a bank or insurer about a new product may not be contacted until that customer has gone back to a state registry and changed their registration. That does not protect consumer choice, but rather overrides it. This could cause a strain on existing customer relationships and how businesses engage with their customers, ultimately creating a barrier to commercial activity between businesses and their customers. Businesses whose growth depends on relationships with existing customers lose their most legitimate marketing channel. Thus, what seems to be a plausible move from the NCC may inadvertently have negative consequences on business, in particular, small and medium sized businesses who rely heavily on direct marketing to gain more customers and generate sales.

A disproportionate burden

The compliance cycle is relentless. Each month, a direct marketer must submit a list of consumers which it intends to contact, pay 12 cents for every name that matches a block, and remove those names. The cleansed list is valid for only 30 days only. For the time being, The NCC has offered free cleansing only from January 2027 to April 2027.

However, for a small business running regular campaigns, this means a recurring cost, an administrative routine to maintain, and the risk of acting on an expired list. The draft Guidelines also “encourages” direct marketers to appoint compliance officers, run training and conduct audits, resulting in businesses accruing more operational expenses. The penalties include administrative fine (either R1 million or 10% of a direct marketer’s annual gross turnover preceding financial year, whichever is great) and, in serious cases, criminal prosecution with imprisonment of up to 12 months.

More uncertainty looms considering that the draft Guidelines set out that they are not binding on the Commission, the National Consumer Tribunal or the Courts, but that anyone applying the Act must take them into account. Businesses are therefore expected to follow rules that the Regulator itself need not necessarily follow nor give much consideration to, creating further legal precariousness and a compliance conundrum. But one has to assume that the Commission would follow the protocol detailed in these Draft Guidelines!

The privacy paradox

The most troubling feature of the draft Guidelines is its approach to data privacy. To protect privacy, it requires direct marketers to upload their customer databases onto a state-run platform every month. POPIA defines an “information matching programme” as the comparison of documents that contain personal information about ten or more data subjects. A national registry that matches millions of records every month fits that description exactly.

Concentrating that much data in one place creates an obvious target for cyberattacks and opens the door for data breaches. It would seem that the NCC has not given much consideration to this issue in light of the fact that the draft Guidelines makes no mention of security safeguards, retention periods, limits on secondary use or what happens after a breach. The Constitutional Court in AmaBhungane Centre for Investigative Journalism NPC and Another v Minister of Justice and Correctional Services and Others struck down legislation in part because it failed to prescribe procedures for how data was to be examined, shared, stored and destroyed. State-held consumer data deserves the same attention. In preparing these draft Guidelines, the NCC somehow overlooked this crucial bit.

Legal and constitutional tensions

The NCC and Information Regulator (“IR“) will seemingly be addressing this issue on a bilateral basis. What does this mean? In essence, the Consumer Protection Act will not operate on its own in curbing unwanted spam calls. Section 69 of POPIA already prohibits electronic direct marketing unless the person has consented or is an existing customer. The IR has said that POPIA compliance remains mandatory whether or not a consumer is on the registry. Direct marketers therefore face two regimes with different consent rules.

POPIA defines consent as a “voluntary, specific and informed expression of will”. The draft Guidelines’ position is that fresh consent cannot override a block contradicts that definition. Section 3(2) of POPIA provides that POPIA applies to the exclusion of other legislation regulating personal information that is materially inconsistent with it. That potentially gives businesses a real argument that the draft Guidelines goes beyond what the law permits.

Importantly, the draft Guidelines present a broader constitutional concern. Section 22 of the Constitution allows the practice of a trade to be regulated, but that regulation must be rational. Courts have set a high bar for striking down economic regulation and will not do so simply because better options exist. Even so, a rule that ignores a consumer’s express, current consent is hard to connect rationally to the stated aim of protecting consumers from unwanted direct marketing.

Lessons from abroad

National do-not-call registries elsewhere, such as those in the United States and the United Kingdom, have shown a consistent pattern. Legitimate businesses comply, while offshore and fraudulent callers ignore the registry altogether. These schemes have generally worked best when they recognise existing-customer relationships and consumer consent, and when enforcement agencies target bad actors rather than imposing a uniform administrative burden on everyone. Our regulators should therefore take note: the scammers generating billions of calls will not register, cleanse lists or pay 12 cents a name nor will the registry inhibit them from calling customers.

A call to action

Time for comment is now. Considering the impact of the Draft Guidelines on marketing activities, requires evaluating the impact thereof on various business units within an organisation. This should be critically evaluated for practicality, failing which business might just be sterilised in terms of marketing activities.

At a minimum, consideration should be given to:

• Recognition of express, current consent and genuine customer relationships, in line with POPIA;
• replace monthly database uploads with a privacy-preserving model in which marketers download suppression lists, supported by published security standards;
• proportionate rules and fees for SMEs; and
• allowing a robust consultation period well beyond 15 days.

Protecting consumers and allowing legitimate commerce are not opposing goals. It would seem as if the current draft Guidelines treats them as such, and both businesses and consumers will pay the price.

What is the saying again about the baby and the bathwater….

Click here to view the draft regulations.

The post Blocking growth? Why the NCC’s Draft Opt-Out Registry Guidelines need revisiting | You were only given 15 days to comment – what are you doing? appeared first on Werksmans Attorneys.

For decades, the detection of cartels has been heavily reliant on a familiar trinity: the leniency applicant who breaks ranks, the disgruntled employee who blows the whistle, and the dawn raid that turns up the incriminating notebook. That model is changing. Competition authorities around the world are now deploying artificial intelligence (AI)  tools to sift through procurement data to detect statistical fingerprints of collusion. This follows a global trend of competition agencies across the world making use of AI tools to detect bid-rigging. It was only a matter of time until South Africa followed in these footsteps.

The South African development

It is reported that the South African Competition Commission is in the process of developing an AI tool to help identify suspected bid-rigging in the local public procurement industry. Commissioner Doris Tshepe told Parliament’s Select Committee on Economic Development and Trade on 30 September 2026 that the tool would assist the Commission in identifying potential cartel conduct in electronic public procurement. The tool is reportedly being developed with the assistance of the Competition and Consumer Commission of Singapore and AI specialists at the University of Pretoria.

This is a logical step considering that countries such as Singapore, Pakistan and Brazil have experienced much success with tools of a same kind, this is according to the Stanford Computational Antitrust’s Fifty Cross-Agency Report which was published in September 2026.

Collusive tendering is one of the forms of horizontal conduct prohibited outright under section 4(1)(b)(iii) of the Competition Act 89 of 1998, and public procurement has long been a priority enforcement area for the Commission. Importantly, the raw material for such a tool already exists: National Treasury publishes procurement data captured through the eTender portal, covering procurement plans, tenders, awards and contracts, in open, reusable formats.

What the rest of the world is doing

The Commission’s initiative places South Africa within a clear and accelerating international trend.

• United Kingdom. The CMA launched an algorithm-based “Screening for Cartels” tool for public procurers in December 2017, designed to flag unusual bidder behaviour and pricing patterns. That downloadable tool was withdrawn in 2020, and the CMA has since built an in-house capability, the Bid Rigging Intelligence Tool (BRIT), which it describes as offering cutting-edge capabilities to analyse public-sector data at scale. In September 2026 the CMA’s Chief Executive estimated that bid-rigging could be costing UK taxpayers between £1 billion and £3.5 billion a year, and the CMA’s Annual Plan 2026 to 2027 commits to using AI and other data science tools to scan bidding data and identify illegal activity at scale. Notably, the deterrent stakes have risen: under the Procurement Act 2023 debarment regime, cartelists face inclusion on a central debarment register and exclusion from public tenders for up to five years.
• Spain. The Spanish competition authority (CNMC) has built its own procurement database and screening tool, BRAVA (Bid Rigging Algorithm for Vigilance in Antitrust), drawing on data that includes losing bids. The CMA reports that the CNMC claims a classification success rate of at least 90%, and that the CNMC has begun developing ATENEA, an agentic reasoning system to analyse and interpret data flagged by BRAVA.
• Brazil and others. According to the CMA, the Brazilian competition authority receives procurement data directly from public bodies, allowing it to apply AI screens to detect cartels. The CMA has also pointed to Portugal and Korea as jurisdictions using data screening tools to find suspicious patterns at scale, and the 2022 compendium referred to similar initiatives in Australia, Canada and the United States.
• European Union. In its 2021 Notice on tools to fight collusion in public procurement (2021/C 91/01), the European Commission encouraged Member States to collect and analyse large volumes of electronic procurement data, “possibly using algorithms, artificial intelligence algorithms or machine learning”, and to give competition authorities access to procurement databases. At the enforcement level, the Commission’s DG Competition has invested in data analysis capability for its ex officio cartel detection work, run machine-learning proofs of concept to support investigations, and leads AI literacy initiatives to ensure that AI is applied safely and effectively in enforcement.

The lesson from abroad: data is everything

The single clearest message from the international experience is that an AI tool is only as good as the data it is fed. The CMA has been candid that BRIT cannot reach its true potential because, unlike in many other countries, losing-bid data is not routinely collected in the UK or made available in a consistent, machine-readable format. Spain’s success, by contrast, rests on a legal requirement to collect specified information about all participating tenderers.

For South Africa, the success of the Commission’s tool will therefore depend less on the sophistication of the algorithm and more on the completeness and quality of the procurement data, including bids by unsuccessful tenderers, pricing detail and bidder ownership information, and on the degree of cooperation between the Commission, National Treasury and organs of state at national, provincial and municipal level.

Questions of fairness and governance

The use of AI by a regulator also raises legitimate questions. An algorithmic flag is a screening signal, not evidence of contravention. Firms may legitimately ask how a tool was trained, what thresholds it applies, and whether its outputs are being treated as a basis for initiating complaints, conducting searches or applying for information. Internationally, regulators are mindful of these concerns: the Commission’s 2021 Notice repeatedly emphasises compliance with data protection law, and the EU AI Act (Regulation (EU) 2024/1689) now imposes a governance framework on certain uses of AI, including by public authorities. In South Africa, the Protection of Personal Information Act 4 of 2013 will be relevant where personal information is processed, and the constitutional requirements of lawful, reasonable and procedurally fair administrative action continue to apply. We would expect the Commission to keep a human investigator firmly in the loop, and to be transparent about the role played by the tool in any proceedings.

What this means for business

Companies that tender for public contracts, and their advisers, should take note:

• Detection risk is rising. Cartel members can no longer assume that conduct will only come to light if a co-conspirator applies for leniency. By way of example, the Swiss Competition Authority has shared that the use of Al tools to detect big rigging has reduced its reliance on whistleblower information to investigate alleged cartel.  Patterns such as bid rotation, cover pricing, consistent price gaps and geographic allocation are exactly what screening tools are designed to detect.
• The leniency calculus changes. As the probability of independent detection increases, the value of being first through the door under the Commission’s Corporate Leniency Policy increases with it. Firms that discover historic misconduct should obtain advice promptly.
• Compliance must be data-aware. Compliance programmes should include periodic reviews of a firm’s own tendering history, careful control of contacts with competitors (including in joint ventures, subcontracting and consortium bids), and documentation of independent bid determination.
• Consequences go beyond fines. Beyond administrative penalties of up to 10% of turnover, bid-rigging can expose firms to procurement exclusions, civil damages claims and, for directors and managers, criminal liability under section 73A of the Competition Act.

Conclusion

The Commission’s AI initiative, developed with international and academic partners, reflects a global shift from reactive to proactive cartel enforcement. If properly resourced, supported by good-quality procurement data and applied with appropriate safeguards, it has the potential to change the risk profile of public procurement in South Africa significantly. For firms that participate in public tenders, the time to review competition compliance is now, before the algorithm does it for them. In our view, this signals the beginning of new era for competition compliance in South Africa, mainly that Al tools will have a meaningful impact on the enforcement of competition law against anti-competitive practices. What lies ahead however…remains to be seen.

The post The algorithm will see you now: Competition Regulators turn to AI to catch bid-riggers appeared first on Werksmans Attorneys.

Introduction

The civil litigation process demands disclosure: Parties are expected to lay their cards on the table by producing relevant documents and allowing the court to adjudicate on the full evidentiary record. This principle, deeply embedded in the rules of court, sits in tension with an equally fundamental imperative: the protection of personal information.

Since the Protection of Personal Information Act No 4 of 2013 (“POPIA“) became fully operational on 1 July 2021, litigants have been called upon to confront a question their European counterparts have grappled with for over a decade: how does one reconcile the breadth of discovery obligations with the discipline of data protection?

The answer is not that one regime displaces the other: POPIA does not create a blanket bar to civil discovery; nor do the Rules of Court displace data protection. Rather, data privacy law constrains how discovery is conducted, requiring proportionality in every step of personal data processing. This article discusses how litigants can conduct lawful discovery while still ensuring their POPIA obligations are met. It provides practical steps for common discovery pitfalls.

Discovery and POPIA in a Nutshell: the Balance Between Disclosure and Data Protection

Discovery is a process in the High Court and Magistrates’ Court (rules 35 and 23 respectively) requiring parties to disclose relevant documents by sworn affidavit. Parties may request the production of specific documents; and access to discovered documents. Non-compliance can result in the court mandating compliance, adverse costs, or exclusion of undisclosed documents at trial.

POPIA regulates how organisations process personal information. Although courts are exempt in respect of their judicial functions, litigants are not. Discovery invariably involves processing personal information, including by recording, sharing, and storing discovery materials.  POPIA’s conditions for lawful processing therefore apply.

This tension is not unique to South Africa. In Norra Stockholm Bygg AB v Per Nycander AB, [1] the Court of Justice of the European Union (“CJEU“) held that courts must balance civil disclosure obligations with data protection under the GDPR (POPIA’s European equivalent). In Brillen Rottler, [2] the Court held that the right to data protection “is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality“.

Section 39 of the Bill of Rights requires courts to consider international law when interpreting the Bill of Rights, [3] and the Preamble to POPIA requires processing to be “in harmony with international standards.” The EU experience is therefore not merely comparative; it forms part of the interpretive framework South African courts are constitutionally mandated to engage with.

Common Pitfalls and How to Prevent Them

 We turn to discuss common data-related errors we have identified in practice; and how to prevent them.

(1)   Failing to Identify and Document a Lawful Basis

A common error is failing to identify and record the lawful basis relied on for discovery-related processing of personal information. If later challenged, the responsible party may be unable to demonstrate lawful processing.

For purposes of discovery, the most appropriate basis is usually compliance with a legal obligation: in Divine Inspiration Trading 205 (Pty) Ltd v Katherine Gordon, [4] the High Court recognised the rules of court as delegated legislation sufficient to ground lawful processing. For special personal information – such as health, biometric or criminal data – POPIA permits processing where it is necessary “for the establishment, exercise or defence of a right or obligation in law“. In De Jager v Netcare Limited, [5] the court confirmed that surveillance evidence constituting special personal information was lawfully obtained under this provision.

Legitimate interests may serve as an alternative basis but cannot be used for processing  special personal information. Consent is generally ill-suited to discovery given its strict validity requirements and the risk of withdrawal.

(2)   Overbroad Discovery Requests and the Failure to Define a Litigation Purpose

POPIA requires that personal information may only be processed for a specific, explicitly defined and lawful purpose; and that processing is adequate, relevant and not excessive given its purpose. Accordingly, without a defined litigation purpose, a discovery request cannot satisfy this minimality threshold. [6]

A common mistake is requesting “all documents” without adequate limitation. Where a request cannot be linked to a defined purpose, it is vulnerable to objections of excessiveness. Requests should be framed with reference to the facta probanda or essential facts; and the litigation purpose articulated with sufficient precision to satisfy the aforementioned POPIA requirements.

Where personal information originally collected for other purposes is sought for discovery, further processing must be addressed. POPIA provides that further processing is not incompatible where “necessary for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated.” [7] A bare assertion that information is needed “for litigation” will not suffice: data minimisation and purpose limitation must still be applied.

(3)   Collecting Personal Information from Third-Party Sources Without a Valid Exception

POPIA restricts collection from sources other than the data subject. An exception is where collection is “necessary for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated.” [8] A common error is assuming that litigation automatically authorises collection from any source. Litigants should document the basis on which the exception applies and limit collection to what is necessary for the proceedings.

(4)   Neglecting the Duty to Notify Data Subjects

POPIA requires that data subjects be notified of processing. A common pitfall is the failure to account for litigation-related processing in existing or additional privacy notices. This is especially problematic for high-risk processing related to discovery. Although notification exemptions exist, these must be interpreted narrowly.

(5)   Inadequate Security Safeguards and Data Minimisation Measures

POPIA requires responsible parties to safeguard the integrity and confidentiality of personal information. Parties often fail to implement proportionate safeguards regarding discovery information. POPIA’s security requirements should be applied, including  applying anonymisation and pseudonymisation where possible.

(6)   Non-Compliance with Cross-Border Transfer Requirements

Discovery may involve the transfer of personal information outside South Africa; for example, where e-discovery platforms are located abroad. Litigants should assess this at the outset and ensure they have a lawful basis to transfer the personal information in terms of section 72 of POPIA, such as by way of appropriate contractual safeguards.

(7)   Indefinite Retention of Discovery Material

POPIA requires that personal information not be retained longer than necessary. It is a mistake to indefinitely retain discovery material after proceedings conclude. Litigants should establish retention and deletion policies and processes.

Proportionality as an Overarching Discipline

The lesson we should take from the EU is that proportionality should guide the entire discovery process. Disclosure must satisfy procedural obligations whilst safeguards minimise unnecessary intrusion into privacy. POPIA’s Preamble acknowledges the “fine balance” between privacy and the free flow of information. [9] Practitioners should treat proportionality as an overarching discipline informing every decision in the course of discovery.

Conclusion

POPIA compliance during discovery requires measured judgement, documented policies, proportionate safeguards, and a careful balancing of legal obligations with privacy rights.

As POPIA matures and the Information Regulator becomes more active, the consequences of non-compliance will become increasingly significant. Litigants who develop robust frameworks for discovery will be better positioned to process personal information lawfully, comply with the court of court, and avoid regulatory enforcement.

[1] (Case C‑268/21) EU:C:2022:755.

[2] (Case C‑526/24).

[3] Burns and Burger-Smidt (2023) 113, 158.

[4] [2021] JOL 49822 (WCC).

[5] (2025) JDR 0793 (GP).

[6] POPIA sections 10 and 13.

[7] POPIA section 15(3)(c)(iii).

[8] POPIA section 12(2)(d)(iii); Burns and Burger-Smidt (2023) 234.

[9] POPIA preamble.

The post When discovery meets data privacy: Navigating the tension between litigation obligations and data protection appeared first on Werksmans Attorneys.

More than seven million pairs of Meta’s Ray-Ban smart glasses were sold worldwide in 2025. That figure alone should make any compliance officer focus. Apple’s AirPods Pro 3, launched in September 2025, now monitor heart rate and translate live conversations using artificial intelligence. [1] A next-generation Apple AirPod with an embedded camera is in advanced testing. These are not consumer curiosities, they are data collection instruments that walk through office doors, and POPIA has something to say about every byte they capture.

The global regulatory response has been swift. France’s CNIL warned in May 2026 that smart glasses risk normalising surveillance that is “almost invisible and omnipresent.” [2] Germany’s Hamburg data protection commissioner concluded that covert filming with these devices violates data protection law, and a sales ban is under active review. [3] The UK’s ICO has formally written to Meta demanding compliance information, [4] and a US class action alleges the glasses are a “surveillance nightmare disguised as fashion.” [5] In East Africa, a Russian vlogger was identified in early 2026 recording intimate encounters with women in Kenya and Ghana using Meta smart glasses and posting the footage online for profit. [6]

South Africa is not insulated from any of this. POPIA’s framework for special personal information, its transparency obligations, and its transborder transfer restrictions are all directly engaged.

The POPIA Exposure: Five Critical Risk Areas

Biometric and Health Data as Special Personal Information

Biometric information occupies a privileged category under POPIA. It is classified as “special personal information,” and processing it is generally prohibited unless a specific statutory exception applies, most commonly, explicit consent or a substantial public interest justification. The practical implications are significant. Meta’s smart glasses capture facial features, voiceprints, and video footage of identifiable individuals. Apple’s AirPods Pro 3 collect heart rate, motion, and calorie data via an in-ear optical sensor, transmitting this to Apple’s Health ecosystem and, with user permission, to third-party fitness applications. [7]

Bystander and Third-Party Rights

Every data subject has the right to know when personal information about them is being collected. That right is effectively annihilated by a device designed to record people covertly. Smart glasses are, by their nature, silent observers. The sole notification mechanism on Meta’s Ray-Ban glasses is a small LED light, which a peer-reviewed CHI 2026 study concluded is “inadequate” as a bystander safeguard. [8] Regulators across France, Germany, and the Netherlands have reached the same conclusion. The legal difficulty is plain: section 11 of POPIA requires a responsible party to demonstrate a lawful basis for processing which becomes a near-impossibility when the data subject has no knowledge that processing is occurring at all.

Transparency and Notice Failures

Section 18 of POPIA requires reasonably practicable steps to ensure data subjects know what information is being collected, why it is being collected, and who is responsible. What the major technology companies have been doing sits uncomfortably with that obligation. Meta’s April 2025 privacy policy update removed the option for users to disable voice recording storage and enabled AI features by default. [9] A Swedish investigation in early 2026 revealed that intimate footage, including nudity and financial information, was reviewed by human contractors in Kenya without adequate disclosure to users. [10] That kind of murkiness can be said to be fundamentally inconsistent with POPIA’s transparency mandate.

Transborder Data Transfers

Personal information may only leave South Africa where the recipient country provides an adequate level of protection, or where binding corporate rules or consent apply. This is not an abstract concern. Meta’s routing of footage captured by South African users to contractor facilities in Nairobi for AI training annotation raises serious questions about compliance with section 72. [11] Apple’s transmission of aggregated health and activity data to its US-based servers engages the same provision.

Security of Processing

Responsible parties must secure the integrity and confidentiality of personal information through appropriate technical and organisational measures. Section 19 demands nothing less. The revelation that Meta’s AI training pipeline could not distinguish between mundane footage and deeply sensitive content, and that no adequate filtering existed, represents a failure that would be difficult to defend under any reasonable reading of the provision.

What Does This Mean for Organisations

The Information Regulator’s 2025/26 Annual Performance Plan signals a firmer enforcement posture, [12] including a new compliance monitoring programme, a Code of Conduct for data collection at controlled entry points (covering biometric systems and surveillance technologies at business premises), and mandatory e-portal breach reporting since April 2025. Against this backdrop, South African organisations should consider, amongst others, the following:

• Consider whether to restrict smart glasses and AI-enabled earbuds in offices, boardrooms, client-facing areas, and controlled environments. Also, review workplace policies on wearable devices.
• Update privacy notices to address the possibility that employees, visitors, or clients may be recorded by wearable devices, and specify the organisation’s position on such recording.
• Conduct Personal Information Impact Assessments (PIIAs) as required by Regulation 4(b) of the POPIA Regulations, specifically for any deployment of wearable technology that captures biometric or health data.

Looking Ahead

South Africa has both the constitutional foundation and the legislative architecture through POPIA to shape the regulatory response to wearable AI across the continent. The Information Regulator has not yet issued specific guidance on smart wearables, but the trajectory is unmistakable: the draft Code of Conduct on controlled-entry-point data collection, the compliance monitoring programme, and the Regulator’s enforcement action against WhatsApp for applying weaker privacy terms to South African users than to Europeans [13] all signal a regulator that will not tolerate a two-tier approach to data protection.

Specific AI legislation is not imminent in 2026, but POPIA already provides a comprehensive framework for regulating wearable AI.

Are these devices already in your building? The question is whether your compliance framework has kept pace.

[1] Apple Newsroom ‘Introducing AirPods Pro 3, the ultimate audio experience’ https://www.apple.com/newsroom/2025/09/introducing-airpods-pro-3-the-ultimate-audio-experience/ (accessed 09-09-2026).

[2] PetaPixel ‘Meta Smart Glasses Face Calls for Bans Across Europe Over Privacy Concerns’ https://petapixel.com/2026/08/04/meta-smart-glasses-face-calls-for-bans-across-europe-over-privacy-concerns/ (accessed 09-09-2026). France’s CNIL issued its warning on 11 May 2026.

[3] 5thscape Blog ‘Meta Smart Glasses Privacy Test Expands to Germany’ https://5thscape.com/blog/meta-smart-glasses-germany-privacy/ (accessed 09-09-2026).

[4] ALM Corp ‘Meta Ray-Ban AI Smart Glasses: UK Investigation & US Lawsuit’ https://almcorp.com/blog/meta-ray-ban-ai-smart-glasses-privacy-investigation-uk-us/ (accessed 09-09-2026).

[5] Bartone v Meta Platforms Inc Case 3:26-cv-01897 (ND Cal, filed March 2026).

[6] A Juma ‘How smart glasses are rewriting the rules of consent in South Africa’ https://www.intelligentcio.com/africa/2026/05/26/how-smart-glasses-are-rewriting-the-rules-of-consent-in-south-africa/ (accessed 09-09-2026).

[7] Apple Support ‘Track your heart rate during workouts with AirPods Pro 3’ https://support.apple.com/guide/airpods/track-heart-rate-workouts-airpods-pro-3-dev1b40fb47d/web (accessed 09-09-2026).

[8] The study was presented at CHI 2026 by researchers at Tsinghua University and the University of Utah, concluding that notification mechanisms in camera glasses ‘prove inadequate’ as bystander safeguards. See TechTimes ‘Germany Invokes Cayla Spy-Device Law Against Meta Smart Glasses’ https://www.techtimes.com/articles/324064/20260812/germany-invokes-cayla-spy-device-law-against-meta-smart-glasses-owners-face-destruction-risk.htm (accessed 09-09-2026).

[9] The Verge ‘Meta tightens privacy policy around Ray-Ban glasses to boost AI training’ https://www.theverge.com/news/658602/meta-ray-ban-privacy-policy-ai-training-voice-recordings (accessed 09-09-2026).

[10] Popular Mechanics ‘Meta’s Smart Glasses Have Even Bigger Privacy Issues Than We Thought’ https://www.popularmechanics.com/technology/gear/a70782916/meta-smart-glasses-privacy-report-spring-2026/ (accessed 09-09-2026). See also ALM Corp (note 5 above).

[11] EU Perspectives ‘Meta smart glasses: MEPs question regulator on privacy protection’ https://euperspectives.eu/2026/03/meta-smart-glasses-meps-question-regulator-on-privacy-protection/ (accessed 09-09-2026).

[12] A Burger-Smidt ‘Information Regulator signals tougher POPIA and PAIA enforcement’ https://www.moonstone.co.za/information-regulator-signals-tougher-popia-and-paia-enforcement/ (accessed 09-09-2026).

[13] Information Regulator Enforcement Notice against WhatsApp (16 April 2025).

The post Invisible data collection through a privacy lens appeared first on Werksmans Attorneys.

In Part one of this series, we detailed the disparity amongst the African countries in mainly Southern Africa and the various approaches to cybersecurity. Unfortunately, this creates a uncertainty for many multi-jurisdictional entities operating across the African continent on how to best approach the issue of cybersecurity when there are discrepancies in the promulgation of legislation targeted at addressing this very issue.

In the second and final part of this series, we focus specifically on East and West Africans countries. At first glance, it seems strides are being made particularly in East Africa to enact  viable cybercrime laws which combat and adequately address the issue of cybersecurity, however, numerous constitutional challenges have impeded on this aspiration. With civil society organisations in some countries arguing that certain provisions in these laws infringe on the right to freedom of expression and the right of privacy. In essence, it seems some African countries have merely pledged to enacting laws addressing and aimed at curbing cybercrime but no progressive measures have been taken thereafter.

East Africa: Constitutional Volatility amid Evolving Frameworks

• Kenya: A Moving Target

Kenya’s Computer Misuse and Cybercrimes Act of 2018 ^[1] reaches a broad range of conduct: unauthorised interference with computer systems, interception, publication of false information, cyber harassment, cybersquatting and fraudulent use of electronic data. It also establishes the National Computer and Cybercrimes Co-ordination Committee. For basic offences, penalties can reach KES 200,000 or two years’ imprisonment; for aiding and abetting, they rise to KES 7 million or four years.

Several provisions of the Act have faced constitutional challenge after its enactment including concerns that the provisions may possibly infringe on the right to freedom of expression which can have a dire impact on also the freedom of media. Nonetheless, the core Act has been upheld. The 2025 amendments, which sought higher penalties and broader content-takedown powers, now face a fresh constitutional challenge, with conservatory orders in place. ^[2] Kenya captures a pattern increasingly visible across the continent: cybercrime laws are enacted, challenged, partly struck down, re-enacted and challenged again, leaving compliance teams to work against a moving legal target.

• Tanzania: Broad Powers, Narrow Oversight

Tanzania’s Cybercrimes Act of 2015 ^[3] criminalises illegal access, interception, data interference, data espionage and computer-related forgery and fraud. It has nevertheless drawn criticism for giving law enforcement extensive search-and-seizure powers with limited judicial oversight and that the enactment fails to provide procedural safeguards for human rights protection which would uphold the right to freedom of expression and the right to privacy, ^[4] prompting concerns about misuse familiar from the wider African cybercrime debate.

• Uganda: Constitutional Volatility

Uganda offers perhaps the clearest example of constitutional volatility in this field. The Computer Misuse Act of 2011 was amended in 2022 ^[5] to broaden the unauthorised-access offence and introduce new provisions on the unauthorised sharing of children’s information and social media abuse. In March 2026, however, Uganda’s Constitutional Court declared the 2022 amendment “null and void” because Parliament had not met the constitutionally required quorum when it was passed. ^[6] The Court also struck down the criminal defamation provisions. As a result, the pre-2022 principal Act currently governs, pending re-enactment.

• Rwanda: A Proactive Framework

Rwanda’s Law on Prevention and Punishment of Cybercrimes, enacted in 2018, ^[7] places the country among East Africa’s more proactive states in this field. Rwanda is both a Budapest Convention signatory and a Malabo Convention ratifier, reflecting a deliberate effort to align its domestic framework with international standards. That dual alignment remains relatively unusual on the continent and fits Rwanda’s broader ambition to position itself as a technology and innovation hub.

West Africa: Diversity, Ambition and Contested Levies

• Nigeria: Scale and Contested Reform

Nigeria’s Cybercrimes (Prohibition, Prevention, Etc) Act of 2015, significantly amended in 2024, ^[8] is West Africa’s most consequential cybercrime statute, given the scale of the Nigerian financial services sector. It criminalises unauthorised and fraudulent access to computer systems to obtain data vital to national security and requires incidents to be reported to the National Computer Emergency Response Team within 72 hours; non-compliance is punishable by denial of internet services and be liable for paying a mandatory fine of N2,000,000 into the National Cyber Security Fund. ^[9]

The 2024 amendment matters for several reasons. It revised section 24 of the 2015 Act, a provision the ECOWAS Community Court of Justice condemned for its use against journalists. ^[10] It also broadened the coverage of payment-technology fraud. Most controversially, it introduced a 0.5 per cent National Cybersecurity Levy on banks and payment service providers, a provision that prompted significant industry opposition and was subsequently suspended by the House of Representatives. ^[11] The Central Bank of Nigeria regulates financial institutions’ compliance, and the data protection regulator has sanctioned at least one bank for breach. Nigeria’s framework is therefore both ambitious and contested, and it demands close monitoring.

• Ghana: Institutional Regulation

Ghana’s Cybersecurity Act of 2020 ^[12] takes an institutional and regulatory approach. It makes the Cyber Security Authority the primary regulator, with power to license cybersecurity service providers and to designate and audit critical information infrastructure, a category that expressly includes banking and financial services. The Act also creates a National Computer Emergency Response Team and a Cybersecurity Fund financed by levies on Bank of Ghana-licensed entities. ^[13] Alongside the Data Protection Act and the Electronic Transactions Act, it forms a layered regulatory architecture that must navigate carefully.

• Francophone West Africa: A Distinctive Tradition

Francophone West Africa has its own legislative character. The region often draws on French civil-law models and reflects the influence of regional harmonisation efforts.

Côte d’Ivoire enacted its cybercrime law in 2013 and amended it in 2023, ^[14] covering ICT-specific offences, online intellectual-property infringements and offences committed over electronic communications networks. The amendment revised several key provisions, showing a willingness to update the framework as threats evolve. A companion personal data protection law and an electronic transactions law complete the regulatory architecture.

Senegal’s 2008 cybercrime law, ^[15] modelled on the Budapest Convention, ranks among the earliest francophone African cybercrime statutes. Senegal’s accession to the Budapest Convention in December 2016 strengthened that alignment with the European standard and was followed by the creation of a dedicated cybercrime police division.

Benin may have the region’s most ambitious approach. Its Code du numérique, adopted in 2017 and amended in 2021, ^[16] is a consolidated 647-article digital code; its sixth book is devoted to “Cybercriminalité et cybersécurité The Code creates a national information systems security agency and a central office for the repression of cybercrime. What is even more impressive is that the Code places an obligation on network operators and trust-service services providers to prioritise cybersecurity within their respective organisations. Comprehensive, if complex, it reflects a civil-law preference for codification.

Togo enacted its cybersecurity and cybercrime law in 2018, ^[17] establishing a Computer Emergency Response Team, a Security Operating Centre and a National Cybersecurity Agency. It has ratified the Malabo Convention and hosted the Lomé Cybersecurity Summit, presenting itself as a continental advocate for cybersecurity governance.

Burkina Faso is an instructive transitional case. It has no standalone modern cybercrime act and instead relies on its Penal Code and institutional cybersecurity structures, including a Central Brigade for Combating Cybercrime, a national Computer Incident Response Team and the Agence Nationale de Sécurité des Systèmes d’Information. It adopted a National Cybersecurity Strategy from 2019 to 2023, and legislative revision is under way to align domestic law with both the Council of Europe’s Convention 108 ^[18] and the Malabo Convention.

Looking Forward: Harmonisation, Vigilance and Proactive Compliance

The adoption of the UN Convention Against Cybercrime in December 2024 ^[19] could mark a turning point in the global governance of cybercrime. If the Convention secures broad ratification and, crucially, ratifying states enact robust, consistent domestic implementing legislation, it could provide the harmonising force the patchwork continental landscape so urgently needs.

Africa’s digital transformation is accelerating, and the cybercrime threat is moving with it. The legislative response remains uneven, but momentum is building.

The organisations best placed to navigate this landscape will be those that treat cybercrime compliance not as a box-ticking exercise but rather as a strategic governance imperative, one demanding rigour, resources and board-level attention.

[1] Computer Misuse and Cybercrimes Act No 5 of 2018 (Kenya), assented 16 May 2018.

[2] The Computer Misuse and Cybercrimes (Amendment) Bill, 2025, which sought to expand penalties and introduce broader content takedown powers, was subject to conservatory orders by the High Court of Kenya as at mid-2025.

[3] Cybercrimes Act, 2015 (Tanzania), passed 1 April 2015.

[4] See, eg, Article 19 “Tanzania: Cybercrimes Act 2015 Undermines Free Expression” (2015).

[5] Computer Misuse Act, 2011 (Uganda), as amended by the Computer Misuse (Amendment) Act, 2022.

[6] The Constitutional Court of Uganda declared the Computer Misuse (Amendment) Act 2022 null and void in March 2026 on the ground that Parliament had lacked the constitutionally required quorum at the time of passage.

[7] Law No 60/2018 of 25 September 2018 on Prevention and Punishment of Cybercrimes (Rwanda).

[8] Cybercrimes (Prohibition, Prevention, Etc) Act, 2015 (Nigeria), as amended by the Cybercrime (Prohibition, Prevention, Etc) (Amendment) Act, 2024, signed 28 February 2024.

[9] Section 21(3) of the Cybercrimes (Prohibition, Prevention, Etc) Act 2015 (as amended 2024).

[10] Section 24 of the 2015 Act was condemned by the ECOWAS Community Court of Justice for its deployment against journalists. The 2024 amendment revised the provision.

[11] The contested 0.5% National Cybersecurity Levy on banks and payment service providers was introduced by the 2024 amendment but subsequently suspended by the House of Representatives following industry opposition.

[12] Cybersecurity Act, 2020 (Act 1038) (Ghana).

[13] Ibid.

[14] Loi n° 2013-451 du 19 juin 2013 relative à la lutte contre la cybercriminalité (Côte d’Ivoire), as amended by Loi n° 2023-593 of 7 June 2023.

[15] Loi n° 2008-11 du 25 janvier 2008 portant sur la Cybercriminalité (Senegal). Senegal acceded to the Budapest Convention in December 2016.

[16] Code du numérique, Loi n° 2017-20 (Benin), adopted 13 June 2017, as amended by Loi n° 2020-35 of 6 January 2021.

[17]Loi n° 2018-026 du 7 décembre 2018 relative à la cybersécurité et à la lutte contre la cybercriminalité (Togo).

[18] Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), opened for signature 28 January 1981.

[19] United Nations Convention Against Cybercrime (n 3). The Convention enters into force 90 days after the fortieth ratification.

The post Cybercrime across borders: Navigating Africa’s fragmented legislative landscape – Part 2 appeared first on Werksmans Attorneys.

The Compliance Imperative

By the time you reach the end of this sentence, a cyberattack will have been launched somewhere on the African continent. That is not an exaggeration, but rather what has become the new reality on the African continent. Across Africa, financial services are digitising at speed, through mobile banking, cross-border insurance platforms and digital payment ecosystems, creating an attack surface of remarkable breadth and complexity. The laws meant to combat cybercrime and protect the institutions and people who rely on those services, however, remain patchy at best.

Multinational organisations, and specifically financial services and insurance groups operating across Africa do not experience this fragmentation as an academic curiosity. This is a live compliance risk with material consequences. Some jurisdictions have enacted sophisticated, modern cybercrime frameworks with mandatory reporting obligations, dedicated regulators and meaningful penalties. While others have no dedicated cybercrime legislation at all. Interestingly, there are several countries where, enacted cybercrime laws are facing constitutional challenges, adding another layer of uncertainty to the pandemonium. The result? A single multi-jurisdictional entity may face criminal liability for failing to report an incident in one jurisdiction, even as the law of the neighbouring country where the same incident began does not define “cybercrime” at all.

In this two part series, we scrutinised this issue further on what some may describe as a legislative quandary amongst the African countries.

The International Treaty Architecture in Practice

Understanding how the international treaties fit together is crucial for compliance, helping one grasp the global and continental response to cybercrime.

• The Budapest Convention: A Global Baseline

Adopted in Budapest in 2001 and later enforced from 2004 onwards, ^[1] the Council of Europe’s Convention on Cybercrime remains the most influential instrument. It has provided the template, or at least the guiding reference point, for domestic cybercrime legislation. Its influence in Africa is expanding: with countries such Senegal acceding to the convention  in 2016, and with Rwanda  acceding to the convention in 2024. The Convention’s real strength lies in its detail on substantive offences, procedural powers, and international cooperation, areas where many African domestic frameworks remain underdeveloped. In essence, the convention has become a yardstick for legislatures across the world on how to draft legislation aimed at adequately addressing cybersecurity issues in their respective countries.

• The Malabo Convention: A Continental Framework

The African Union Convention on Cyber Security and Personal Data Protection, adopted in Malabo in 2014, ^[2] is unique globally: it brings cybersecurity, cybercrime, electronic transactions and personal data protection together in a single instrument. It came into effect on 8 June 2023, after Mauritania’s ratification. Yet,  as at early 2026, only 20 of the 55 AU member states have ratified it ^[3], a level of uptake that materially limits its practical harmonising effect.

• The UN Convention Against Cybercrime: A New Global Layer

The most important recent development is the United Nations Convention Against Cybercrime, adopted by the UN General Assembly on 24 December 2024 and opened for signature on 25 October 2025 in Hanoi, Vietnam. ^[4] It is the first comprehensive global treaty devoted exclusively to cybercrime. Its nine chapters cover prevention, criminalisation, procedural measures, international cooperation and capacity building. For African countries reluctant to join the Budapest Convention because it is seen as a “European” instrument, the UN Convention offers a multilateral alternative that may carry greater legitimacy. However, its success will depend on the pace of ratification and the quality of domestic implementing legislation.

The harder and more interesting  question is whether the political will may one day translate into more sophisticated legislation focused on combating cybercrime across Africa, encouraging optimism for future developments.

Southern Africa: Uneven Progress at the Continent’s Economic Hub

• South Africa: The Leading Framework

South Africa’s Cybercrimes Act ^[5] is the most comprehensive cybercrime framework in sub-Saharan Africa. Signed on 26 May 2021 and brought into operation in key respects on 1 December 2021, ^[6] it criminalises unlawful access to data and computer systems, the unlawful acquisition or use of passwords and access codes, and the dissemination of harmful data messages. It repealed and consolidated the earlier cyber-offence provisions in sections 85 to 88 of the Electronic Communications and Transactions Act. ^[7]

For companies, the Act’s dual reporting architecture is the point that matters most. Section 54 requires electronic communications service providers and financial institutions to report cyber offences to the South African Police Service within 72 hours of becoming aware of them; non-compliance is a criminal offence carrying fines of up to R50,000. ^[8] That duty sits alongside, and does not replace, the separate mandatory data-breach notification regime under section 22 of the Protection of Personal Information Act [9]. One cyber incident can therefore trigger parallel reports to different authorities, under different statutes, with different timelines and thresholds. Compliance teams need to be alert to that reality. ^[10]

• Namibia: A Legislative Gap

Namibia may present the Southern African Development Community’s most significant legislative gap. No dedicated cybercrime act is currently in force. The Electronic Transactions Act of 2019 ^[11] deals with electronic commerce but does not create cybercrime-specific offences. Draft Cybercrime and Data Protection Bills were circulated as early as 2013 and remain unpromulgated. Before the Electronic Transactions Act, the principal instrument was the Computer Evidence Act of 1985 ^[12], a statute drafted long before the internet had any meaningful commercial presence in the world. Namibia has ratified the Malabo Convention and began a Commonwealth-assisted process in 2020 to develop cybersecurity strategy components, but progress has been slow. The gap means that cybercrime prosecutions must rely on general criminal-law principles, far from a satisfactory position.

• Botswana, Zimbabwe, Zambia and Eswatini

By continental standards, Botswana moved early, enacting its Cybercrime and Computer Related Crimes Act in 2007 ^[13].  In 2018 a further development was made in Botswana, with the country’s legislature promulgating a new piece of legislation which repealed the 2007 enactment. Though plausible, the 2018 enactment does not adequately address concerns regarding cybersecurity at the level it should given the limited number of new provisions which were introduced in the amendment Act, the Act therefore takes a reactive stance rather than proactive posture when it comes to the subject of cybersecurity.

Zimbabwe’s Cyber Security and Data Protection Act of 2021 ^[14] is distinctive in bringing cybersecurity, cybercrime and data protection under one statute which is regulated by the Postal and Telecommunications Regulatory Authority. Civil society organisations, however, have strongly condemned provisions said to permit government interference with private communications without adequate judicial oversight. ^[15] The tension is familiar across the continent: cybercrime laws can be deployed, or be perceived as deployable, as instruments of surveillance and political control.

Zambia’s Cyber Security and Cyber Crimes Act is currently before the  High Court in a pending constitutional challenge. Akin to the situation in Zimbabwe, civil society organisations have raised a number of concerns on provisions, which apparently threaten the constitutional right to freedom of expression for Zambians. ^[16] Until the challenge is resolved, the Act remains in force, but legal uncertainty hangs over it, a difficult position for compliance teams seeking a clear regulatory baseline.

Eswatini enacted the Computer Crime and Cybercrime Act which came into effect on 4 March 2022. At a high level, the Act criminalises various cyber offences and makes provision for the establishment of a National Cybersecurity Incident Response Team and National Cybersecurity Advisory Council. Moreover, the Eswatini Government has also adopted a five year National Cybersecurity Strategy with the aim of protecting key national infrastructure and to mitigate any risks of cybercrime within the Eswatini cyberspace [17]. This Act coupled with the country’s own Data Protection Act, displays Eswatini’s strong commitment to addressing and combating cybersecurity, a country riddled by growing threats of cybercrimes as reported by Eswatini Communications Commission [18]

• Mozambique, Lesotho, Malawi and Mauritius

Mozambique has no distinct national cybercrime framework and instead relies on partial measures. It has ratified the Malabo Convention but has not enacted dedicated implementing legislation. Lesotho presents a confirmed legislative gap: no cybercrime statute has been identified. While a Computer Crime and Cybersecurity Bill was tabled before the National Assembly in 2024, it has not yet been enacted into law amidst significant scrutiny and opposition from media and civil society [19]. In 2024, Malawi enacted cybercrimes legislation replacing the data-protection provisions of the country’s Electronic Transactions and Cyber Security Act. Impressively, the Act is inspired by the GDPR introducing amongst others : data-subject rights, mandatory breach notification; this signals that Malawi is indeed headed towards the right direction in its commitment to improving the country’s cybersecurity laws. .

Mauritius, by contrast, offers a regional model. Its Cybersecurity and Cybercrime Act of 2021, ^[20] enacted on 19 November 2021, replaced the earlier Computer Misuse and Cybercrime Act of 2003. It establishes a National Cybersecurity Committee and the Computer Emergency Response Team of Mauritius, and aligns with both the Budapest Convention and the Malabo Convention. Mauritius shows what a small island state can achieve when political will exists: a framework that meets international standards.

Conclusion

It is clear that there are disparities amongst the African countries discussed above in relation to the approach to cybersecurity. Certain countries can be seen to take proactive measures to address an issue which is becoming more prevalent as societies become more digitised and make use of emerging technologies. While in countries such as Malawi, the importance of cybersecurity is simply not prioritised. In the end, multi-jurisdictional entities are confronted with a compliance dilemma insofar as it concerns how to deal with cyberattacks in various jurisdictions in light of the fragmentation and lack of uniformity of cybercrime legislation across the African continent.

In part two, we delve into this issue further – where shockingly we find that cybercrime legislation in some African countries is potentially being used as a means for censorship rather than for its intended purpose – curbing cybercrime!

[1] Convention on Cybercrime, opened for signature 23 November 2001, Budapest; entered into force 1 July 2004. ETS No 185.

[2] African Union Convention on Cyber Security and Personal Data Protection, adopted 27 June 2014 in Malabo, Equatorial Guinea; entered into force 8 June 2023.

[3] See African Union Commission Status List of the OAU/AU Treaties, Conventions, Protocols and Charters (2025).

[4] United Nations Convention Against Cybercrime, adopted by UN General Assembly Resolution 79/243 on 24 December 2024; opened for signature 25 October 2025 in Hanoi, Vietnam.

[5] Cybercrimes Act 19 of 2020.

[6] The key operative sections of the Cybercrimes Act commenced on 1 December 2021 following Presidential signature on 26 May 2021.

[7] Sections 85–88 of the Electronic Communications and Transactions Act 25 of 2002 (ECTA), repealed by the Cybercrimes Act.

[8] Section 54 of the Cybercrimes Act 19 of 2020.

[9] Section 22 of the Protection of Personal Information Act 4 of 2013.

[10] Burns Y and Burger-Smidt A Protection of Personal Information: Law and Practice 2nd ed (2023) LexisNexis ch 1.

[11] Electronic Transactions Act 4 of 2019 (Namibia). A draft Cybercrime Bill and Data Protection Bill were circulated in 2013 but remain unpromulgated.

[12] Computer Evidence Act 32 of 1985 (Namibia).

[13] Cybercrime and Computer Related Crimes Act (Botswana), enacted 2007.

[14] Cyber Security and Data Protection Act (Zimbabwe), 2021.

[15] See, eg, Zimbabwe Human Rights NGO Forum “Analysis of the Cyber Security and Data Protection Act” (2021) noting provisions enabling state interception of private communications without adequate judicial oversight.

[16] Cyber Security and Cyber Crimes Act (Zambia). At the time of writing, the constitutional challenge remains pending before the High Court of Zambia.

[17] Cybersecurity law & regulation in eSwatini (2026) by Anurag Verma.

[18] Eswatini Faces Rising Cybercrime Threats: ESCCOM Warns of Facata Scams and Online Fraud by Eswatini Observer (2025).

[19] Repressive cybercrime law poses grave threat to Lesotho’s fragile democracy by Daily Maverick (2024).

[20] Cybersecurity and Cybercrime Act 2021 (Mauritius), enacted 19 November 2021, superseding the Computer Misuse and Cybercrime Act 2003.

The post Cybercrime across borders: Navigating Africa’s fragmented legislative landscape – Part 1 appeared first on Werksmans Attorneys.

Picture this…

A retailer with operations spanning southern and eastern Africa discovers on a Friday evening that a threat actor has exfiltrated customer records from a compromised cloud environment. The breach touches individuals in Kenya, Zambia, Zimbabwe, and South Africa. In Zambia and Zimbabwe, the clock gives them just 24 hours to notify the regulator. [1] In Kenya, they have 72 hours, unless their systems qualify as critical information infrastructure, in which case the window shrinks to a mere 24 hours. [2] South Africa’s POPIA, by contrast, imposes no fixed-hour deadline at all, requiring notification only “as soon as reasonably possible”. [3]

And the regulatory bodies receiving those notifications? Entirely different institutions, with different forms, different portals, and different expectations.

Welcome to the reality of cross-border breach response in 2026.

 The Myth of the Universal Playbook

Too many organisations still treat data breach response as a single procedure, a single plan, a single template, a single timeline. That approach was always fragile. Today, it is genuinely dangerous.

Across sub-Saharan Africa alone, the legislative landscape has shifted dramatically in the past three years. Botswana replaced its 2018 Act with substantially enhanced breach-notification obligations in 2024, introducing a 72-hour reporting window and prison terms of up to nine years for certain violations. Malawi’s Data Protection Act came into force in June 2024, with its own 72-hour reporting requirement and a novel public notification mechanism via newspapers when direct notice requires disproportionate effort or expense. Tanzania enacted comprehensive data protection legislation in 2022, backed by administrative fines up to TZS 100 million and criminal imprisonment of up to ten years. These are not legacy frameworks gathering dust, they are recent, actively enforced, and strikingly divergent from one another.

The Devil Lives in the Differences

What makes cross-border compliance genuinely difficult is not the existence of notification obligations, most sophisticated organisations expect those. The difficulty lies in the granular inconsistencies.

Firstly, timelines pull in different directions. Rwanda requires notification to the NCSA within 48 hours. Nigeria mirrors the GDPR’s 72-hour notification standard for the NDPC. Uganda requires notification “immediately” upon discovery. Ghana offers no fixed hour count at all, relying instead on a “reasonably practicable” standard. When a single incident spans four of these jurisdictions, the compliance team must operationalise the shortest deadline as the effective floor, while still satisfying the specific procedural requirements of each.

Secondly, notification thresholds diverge significantly. South Africa and several other countries require reporting of all security compromises irrespective of assessed risk level. Kenya and Nigeria, echoing GDPR principles, trigger individual notification only where there is a “likely high risk” to rights and freedoms. Botswana requires reporting unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject. Morocco doesn’t impose a mandatory notification regime at all, merely a strong expectation of responsible incident management from the CNDP. [4] For a single breach affecting data subjects across these territories, the compliance team faces a zero-threshold obligation, divergent risk-based obligations, and a soft-law expectation simultaneously.

Thirdly, the level of detail required in data breach notifications differs significantly across jurisdictions. At one end of the spectrum, Zambia does not prescribe what must be included in a notification. Ghana adopts a general standard, requiring only “sufficient information” to allow the data subject to take protective measures. Botswana, Kenya, Malawi and Nigeria prescribe detailed content requirements closely aligned with the GDPR. South Africa goes further, requiring additional elements including the identity of the intruder (if known). Kenya imposes more onerous requirements: a chronological account of steps taken, details of how the breach occurred, and prescribed document uploads including the incident response policy, internal incident logs, and copies of reports sent to other regulators.

Fourthly, penalties vary widely. Kenya’s administrative fines cap at KES 5 million or 1% of annual turnover. [5] Rwanda imposes fines of RWF 2–5 million or 1% of prior-year global turnover. [6] Botswana has adopted what observers describe as a “GDPR-plus enforcement posture,” with potential prison terms of up to nine years. [7] Criminal sanctions, including imprisonment, feature across Nigeria, Tanzania, and Uganda. [8]

Building a Jurisdiction-Aware Response Framework

So, what does good practice look like? A few principles stand out.

1. Map your exposure before the breach happens. In-house teams should maintain a living matrix that documents the notification obligations, timelines, thresholds, and designated authorities for every jurisdiction in which they process personal data. This is not a once-off exercise, but must be reviewed and updated whenever there are legislative or other developments in a country’s data protection regulatory framework. Botswana, Malawi, and Tanzania all overhauled their frameworks within the past two years. [9]
2. Design for the tightest deadline. If your operations affect Zambia or Zimbabwe, your internal escalation and triage processes must be able to produce a regulatory notification within 24 hours. That becomes the design constraint for your entire incident response architecture.
3. Appoint jurisdiction leads, not a single breach coordinator. Each relevant jurisdiction requires someone who understands the local regulator’s expectations, prescribed forms, portal requirements, and the practical nuances of engagement.
4. Invest in threshold analysis upfront. Because jurisdictions apply different tests, from South Africa’s all-in approach to Kenya’s risk-based trigger, a rapid, defensible methodology for assessing severity across multiple frameworks is essential. You cannot afford to work this out on the night of discovery.

The Direction of Travel

The trajectory is unmistakable. Namibia remains the conspicuous outlier, lacking a comprehensive data protection statute, but political pressure following the 2025 NSFAF data breach has intensified calls to finalise its draft Bill. [10] Elsewhere, the pattern is one of convergence toward mandatory, time-bound notification regimes, with increasingly severe penalties for non-compliance.

For organisations operating across multiple African jurisdictions and, indeed, globally, the message is straightforward. The window for treating breach response as a reactive, ad hoc exercise has closed. What is needed now is infrastructure: legal mapping, operational readiness, jurisdictional expertise, and the institutional muscle to execute across borders under intense time pressure.

The breach will come.

The only question is whether your response architecture was built for the world as it actually is, fragmented, fast-moving, and unforgiving of those who failed to prepare.

[1] Data Protection Act 3 of 2021 (Zambia) s 24; Cyber and Data Protection Act [Chapter 12:07] of 2021 (Zimbabwe) s 29.

[2] Data Protection Act 24 of 2019 (Kenya) s 43. The Data Protection (General) Regulations, 2021 (Kenya) prescribe a 72-hour notification period, reduced to 24 hours for operators of designated critical information infrastructure.

[3] Protection of Personal Information Act 4 of 2013 (POPIA) s 22(1). From April 2025, the Information Regulator introduced a mandatory e-Services Portal for reporting security compromises.

[4] Law No 09-08 of 18 February 2009 on the Protection of Individuals with regard to the Processing of Personal Data (Morocco), with implementing Decree 2-09-165. No general GDPR-style mandatory breach notification regime with fixed timelines exists; the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) expects “prompt and responsible incident management.”

[5] Data Protection Act 24 of 2019 (Kenya) s 62. Administrative fines up to KES 5 million or 1% of annual turnover (whichever is lower) for controllers; KES 3 million or 0.5% of turnover for processors.

[6] Law No 058/2021 (Rwanda) art 68. Administrative fines of RWF 2–5 million or 1% of prior-year global turnover for misconducts including failure to notify or report a breach.

[7] Data Protection Act 18 of 2024 (Botswana). Described as among the strictest breach-related penalty regimes in the region, adopting a notably GDPR-plus enforcement posture.

[8] Nigeria Data Protection Act, 2023 (n 8 above) s 48 (up to one year’s imprisonment for non-compliance with NDPC orders); Personal Data Protection Act 11 of 2022 (Tanzania) s 62 (criminal fines and imprisonment up to 10 years); Data Protection and Privacy Act 9 of 2019 (Uganda) ss 39–40 (administrative penalties and compliance orders).

[9] Data Protection Act 18 of 2024 (Botswana); Data Protection Act 3 of 2024 (Malawi); Personal Data Protection Act 11 of 2022.

[10] Draft Data Protection Bill, 2021 (Namibia). No comprehensive data protection statute is currently in force; only the constitutional right to privacy under article 13 of the Constitution of the Republic of Namibia, 1990 applies.

The post When the clock starts ticking…… Why cross-border data breach response demands more than good intentions appeared first on Werksmans Attorneys.