Picture this.

A retailer with operations spanning southern and eastern Africa discovers on a Friday evening that a threat actor has exfiltrated customer records from a compromised cloud environment. The breach touches individuals in Kenya, Zambia, Zimbabwe, and South Africa. In Zambia and Zimbabwe, the clock gives them just 24 hours to notify the regulator. [1] In Kenya, they have 72 hours, unless their systems qualify as critical information infrastructure, in which case the window shrinks to a mere 24 hours. [2] South Africa’s POPIA, by contrast, imposes no fixed-hour deadline at all, requiring notification only “as soon as reasonably possible”. [3]

And the regulatory bodies receiving those notifications? Entirely different institutions, with different forms, different portals, and different expectations.

Welcome to the reality of cross-border breach response in 2026.

 The Myth of the Universal Playbook

Too many organisations still treat data breach response as a single procedure, a single plan, a single template, a single timeline. That approach was always fragile. Today, it is genuinely dangerous.

Across sub-Saharan Africa alone, the legislative landscape has shifted dramatically in the past three years. Botswana replaced its 2018 Act with substantially enhanced breach-notification obligations in 2024, introducing a 72-hour reporting window and prison terms of up to nine years for certain violations. Malawi’s Data Protection Act came into force in June 2024, with its own 72-hour reporting requirement and a novel public notification mechanism via newspapers when direct notice requires disproportionate effort or expense. Tanzania enacted comprehensive data protection legislation in 2022, backed by administrative fines up to TZS 100 million and criminal imprisonment of up to ten years. These are not legacy frameworks gathering dust, they are recent, actively enforced, and strikingly divergent from one another.

The Devil Lives in the Differences

What makes cross-border compliance genuinely difficult is not the existence of notification obligations, most sophisticated organisations expect those. The difficulty lies in the granular inconsistencies.

Firstly, timelines pull in different directions. Rwanda requires notification to the NCSA within 48 hours. Nigeria mirrors the GDPR’s 72-hour notification standard for the NDPC. Uganda requires notification “immediately” upon discovery. Ghana offers no fixed hour count at all, relying instead on a “reasonably practicable” standard. When a single incident spans four of these jurisdictions, the compliance team must operationalise the shortest deadline as the effective floor, while still satisfying the specific procedural requirements of each.

Secondly, notification thresholds diverge significantly. South Africa and several other countries require reporting of all security compromises irrespective of assessed risk level. Kenya and Nigeria, echoing GDPR principles, trigger individual notification only where there is a “likely high risk” to rights and freedoms. Botswana requires reporting unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject. Morocco doesn’t impose a mandatory notification regime at all, merely a strong expectation of responsible incident management from the CNDP. [4] For a single breach affecting data subjects across these territories, the compliance team faces a zero-threshold obligation, divergent risk-based obligations, and a soft-law expectation simultaneously.

Thirdly, the level of detail required in data breach notifications differs significantly across jurisdictions. At one end of the spectrum, Zambia does not prescribe what must be included in a notification. Ghana adopts a general standard, requiring only “sufficient information” to allow the data subject to take protective measures. Botswana, Kenya, Malawi and Nigeria prescribe detailed content requirements closely aligned with the GDPR. South Africa goes further, requiring additional elements including the identity of the intruder (if known). Kenya imposes more onerous requirements: a chronological account of steps taken, details of how the breach occurred, and prescribed document uploads including the incident response policy, internal incident logs, and copies of reports sent to other regulators.

Fourthly, penalties vary widely. Kenya’s administrative fines cap at KES 5 million or 1% of annual turnover. [5] Rwanda imposes fines of RWF 2–5 million or 1% of prior-year global turnover. [6] Botswana has adopted what observers describe as a “GDPR-plus enforcement posture,” with potential prison terms of up to nine years. [7] Criminal sanctions, including imprisonment, feature across Nigeria, Tanzania, and Uganda. [8]

Building a Jurisdiction-Aware Response Framework

So, what does good practice look like? A few principles stand out.

1. Map your exposure before the breach happens. In-house teams should maintain a living matrix that documents the notification obligations, timelines, thresholds, and designated authorities for every jurisdiction in which they process personal data. This is not a once-off exercise, but must be reviewed and updated whenever there are legislative or other developments in a country’s data protection regulatory framework. Botswana, Malawi, and Tanzania all overhauled their frameworks within the past two years. [9]
2. Design for the tightest deadline. If your operations affect Zambia or Zimbabwe, your internal escalation and triage processes must be able to produce a regulatory notification within 24 hours. That becomes the design constraint for your entire incident response architecture.
3. Appoint jurisdiction leads, not a single breach coordinator. Each relevant jurisdiction requires someone who understands the local regulator’s expectations, prescribed forms, portal requirements, and the practical nuances of engagement.
4. Invest in threshold analysis upfront. Because jurisdictions apply different tests, from South Africa’s all-in approach to Kenya’s risk-based trigger, a rapid, defensible methodology for assessing severity across multiple frameworks is essential. You cannot afford to work this out on the night of discovery.

The Direction of Travel

The trajectory is unmistakable. Namibia remains the conspicuous outlier, lacking a comprehensive data protection statute, but political pressure following the 2025 NSFAF data breach has intensified calls to finalise its draft Bill. [10] Elsewhere, the pattern is one of convergence toward mandatory, time-bound notification regimes, with increasingly severe penalties for non-compliance.

For organisations operating across multiple African jurisdictions and, indeed, globally, the message is straightforward. The window for treating breach response as a reactive, ad hoc exercise has closed. What is needed now is infrastructure: legal mapping, operational readiness, jurisdictional expertise, and the institutional muscle to execute across borders under intense time pressure.

The breach will come.

The only question is whether your response architecture was built for the world as it actually is, fragmented, fast-moving, and unforgiving of those who failed to prepare.

[1] Data Protection Act 3 of 2021 (Zambia) s 24; Cyber and Data Protection Act [Chapter 12:07] of 2021 (Zimbabwe) s 29.

[2] Data Protection Act 24 of 2019 (Kenya) s 43. The Data Protection (General) Regulations, 2021 (Kenya) prescribe a 72-hour notification period, reduced to 24 hours for operators of designated critical information infrastructure.

[3] Protection of Personal Information Act 4 of 2013 (POPIA) s 22(1). From April 2025, the Information Regulator introduced a mandatory e-Services Portal for reporting security compromises.

[4] Law No 09-08 of 18 February 2009 on the Protection of Individuals with regard to the Processing of Personal Data (Morocco), with implementing Decree 2-09-165. No general GDPR-style mandatory breach notification regime with fixed timelines exists; the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) expects “prompt and responsible incident management.”

[5] Data Protection Act 24 of 2019 (Kenya) s 62. Administrative fines up to KES 5 million or 1% of annual turnover (whichever is lower) for controllers; KES 3 million or 0.5% of turnover for processors.

[6] Law No 058/2021 (Rwanda) art 68. Administrative fines of RWF 2–5 million or 1% of prior-year global turnover for misconducts including failure to notify or report a breach.

[7] Data Protection Act 18 of 2024 (Botswana). Described as among the strictest breach-related penalty regimes in the region, adopting a notably GDPR-plus enforcement posture.

[8] Nigeria Data Protection Act, 2023 (n 8 above) s 48 (up to one year’s imprisonment for non-compliance with NDPC orders); Personal Data Protection Act 11 of 2022 (Tanzania) s 62 (criminal fines and imprisonment up to 10 years); Data Protection and Privacy Act 9 of 2019 (Uganda) ss 39–40 (administrative penalties and compliance orders).

[9] Data Protection Act 18 of 2024 (Botswana); Data Protection Act 3 of 2024 (Malawi); Personal Data Protection Act 11 of 2022.

[10] Draft Data Protection Bill, 2021 (Namibia). No comprehensive data protection statute is currently in force; only the constitutional right to privacy under article 13 of the Constitution of the Republic of Namibia, 1990 applies.

The post When the clock starts ticking…… Why cross-border data breach response demands more than good intentions appeared first on Werksmans Attorneys.

The Information Regulator (Regulator) has put down a marker. In a media briefing held today, 31 August 2026, the Regulator delivered a comprehensive account of its enforcement activities under both the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). The briefing also marked a significant institutional milestone: 2026 is the Regulator’s 10-year anniversary, having been formally established in December 2016, and five years since the enforcement provisions of POPIA commenced.

Key Developments

Enforcement Notices Under POPIA

The Regulator has issued several enforcement notices under POPIA in this financial year, while each warrant careful attention, the following enforcement notice issued against South African Bureau of Standards (SABS) was highlighted:

• Following a significant ransomware attack in 2024 that disrupted SABS’s information systems and operations, the Regulator conducted an own-initiated assessment and found that SABS had violated multiple POPIA conditions, including processing excessive or irrelevant information, having inadequate consent mechanisms, insufficient security safeguards, and failing to inform data subjects of collection methods.
• SABS has been directed to revise its policies, conduct risk and impact assessments, and implement adequate security measures within 90 days. The Regulator emphasised that the enforcement action was not taken simply because SABS was a victim of a cyber-attack, but because of the underlying compliance failures identified during the assessment.

POPIA Fines Imposed

The Regulator disclosed the fines that have been imposed under POPIA to date. These include:

Ongoing POPIA Matters and Investigations

• Matric Results: The Regulator continues to challenge the Department of Basic Education’s publication of matriculants’ exam numbers together with their results. The Regulator has applied for leave to appeal directly with the Supreme Court of Appeal following the High Court’s refusal for leave, maintaining that the matter raises important questions about the interpretation and application of POPIA to learners’ personal information.
• The Regulator confirmed that it has various ongoing investigations and assessments underway, including TruCaller and the Gauteng Department of E-Government.
• eThekwini Metropolitan Municipality: The Madlanga Commission of Inquiry referred concerns to the Regulator in February 2026 regarding the unlawful processing of personal information by a former city manager of the eThekwini Metropolitan Municipality. The Regulator accepted the referral, initiated an own-initiative investigation, and has completed the investigation. The matter has been referred to the Enforcement Committee for appropriate action.
• On 4 August 2026, the Regulator received a further referral from the Madlanga Commission relating to, among others, Vusimuzi Matlala.

PAIA Annual Report Compliance

The compliance figures on PAIA annual reporting are, frankly, dismal:

• Between 1 April and 18 August 2026, the Regulator received PAIA annual reports from 417 out of 853 public bodies, a compliance rate of approximately 9%. This is an improvement on the 2024/25 period (358 submissions, compliance rate of approximately 42%).
• Municipal compliance remains critically low: only 91 out of 257 municipalities submitted reports, a compliance rate of roughly 35%.
• Other low-compliance categories include political parties, TVET colleges, Schedule 3A and 3C public entities, and notably the Public Protector, which has failed to submit its own section 84(b) report.

The Regulator is clearly frustrated and is seeking stronger enforcement tools.

Direct Marketing and Spam Calls

The Regulator has confirmed its position that telephone calls constitute “electronic communication” under POPIA. This remains a contentious legal question, with the direct marketing sector arguing that telephone calls fall outside the Act’s scope. The Regulator disagrees. Of the over 3,800 complaints received last year, approximately 10% related to direct marketing, demonstrating the scale of the issue. Two key matters have been referred to the Enforcement Committee and raise important questions about the interpretation and application of section 69 of POPIA (unsolicited electronic communications).

The Regulator has welcomed the recent amendment to the Consumer Protection Act (CPA) regulations establishing the opt-out/block registry for unsolicited marketing communications, and has engaged with the National Consumer Commission on collaborative awareness-raising and enforcement. The Regulator highlighted that CPA compliance does not displace POPIA compliance obligations in respect to direct marketing.

Security Compromises

The Regulator has received over 8,000 security compromise notifications since POPIA’s enforcement provisions commenced. In the current financial year (from 1 April 2026), over 1,220 notifications have been received, with a projected 3,000 by year end. The Regulator highlighted common causes include inadequate security controls, employee negligence, weak passwords, and malware/ransomware attacks. The public sector was criticised for insufficient investment in security measures.

The Auditor-General has identified severe cybersecurity weaknesses across government, including ageing infrastructure and skills deficits. The Regulator observed that organisations are treating data protection as a “tick box exercise” rather than an operational priority.

Proposed Legislative Amendments

The Regulator intends to submit proposals to Parliament for amendments to PAIA and POPIA:

• PAIA: Current enforcement provisions are considered too weak. Unlike POPIA, PAIA does not provide for administrative fines for non-compliance with enforcement notices. Instead, the Regulator must lodge a criminal complaint against the non-compliant information officer, which is a cumbersome process. The Regulator is pursuing proposed legislative amendments to PAIA to introduce enforcement mechanisms equivalent to those available under POPIA, including the ability for the Regulator to release information directly where an order has been made and not complied with within 180 days.
• POPIA: The Regulator has identified structural weaknesses, including the observation that once a responsible party complies within the grace period set in an enforcement notice, the Regulator can no longer impose a fine, which limits the deterrent effect. The Regulator acknowledged that the current fines regime may not be high enough to deter repeat offenders. Proposals under consideration include moving towards immediate fines upon a finding of non-compliance, mirroring the GDPR model, rather than the current “grace period” approach.

These amendments would significantly harden the regulatory framework.

New Digital Platforms

The Regulator has introduced new digital platforms including a POPIA online complaint/case management system, a POPIA exemption application portal, a POPIA/PAIA authorisation application system, and a centralised enquiry management system (iSupport).

Proactive Monitoring

The Regulator has begun a proactive monitoring exercise, sending letters to responsible parties requiring them to demonstrate compliance – rather than waiting for complaints. The private sector was noted to have materially higher compliance levels than the public sector.

What does this mean?

We draw the following practical conclusions from the briefing:

• Heightened enforcement activity. The Regulator is demonstrably moving beyond awareness-raising and into active enforcement. Organisations should treat compliance with POPIA and PAIA as a matter of immediate operational priority, not a project for next quarter.
• Security compromise preparedness. With over 1,220 security compromise notifications received in fewer than five months (and a projected 3,000 by year end), organisations must ensure they have robust incident response plans in place, including the ability to comply with section 22 notification obligations in a timely manner.
• Direct marketing compliance. Organisations that engage in direct marketing, particularly via telephone, should urgently review their practices against the Regulator’s stated position on consent requirements and opt-out mechanisms.
• PAIA annual report submissions. Both public and private bodies should ensure they submit PAIA annual reports as required under sections 32 and 83 of PAIA. While compliance rates have improved (to approximately 49% for public bodies), they remain unacceptably low, and the Regulator’s express intention to seek stronger enforcement powers means that non-compliance is likely to attract consequences in the near future.
• Anticipate legislative change. The proposed amendments to both POPIA and PAIA, including the move towards immediate fines, signal a shift towards a more punitive enforcement regime. Organisations should begin preparing for a stricter compliance environment now, rather than waiting for the legislation to catch up.

Conclusion

 The message from the Regulator is unambiguous: the era of soft enforcement is over.

In its first decade, the Regulator has moved from institutional establishment to active, assertive regulation, and the trajectory is clear. The combination of escalating enforcement action, proactive compliance monitoring, and proposed legislative amendments designed to introduce immediate fines signals a fundamental shift in the South African data protection landscape.

Organisations, in both the public and private sectors, can no longer afford to treat POPIA and PAIA compliance as peripheral or aspirational. The Regulator has demonstrated that it is willing to act against government departments, state-owned entities, and private sector operators alike. The SABS enforcement notice, the ongoing IEC and Department of Basic Education matters, and the growing list of entities under investigation all confirm that no sector is immune from scrutiny.

For the private sector, the takeaway is straightforward: invest in compliance now, or face the consequences later, consequences that, if the Regulator’s proposed amendments are enacted, will be materially more severe than those available under the current framework. For the public sector, the picture is even starker. Compliance rates remain alarmingly low, cybersecurity infrastructure is ageing, and the Regulator has made clear that it regards government’s performance as wholly inadequate.

Ten years in, the Information Regulator has found its voice, and its teeth. South African organisations would be well advised to listen.

The post The Regulator is Watching: New Enforcement Signals for POPIA and PAIA Compliance appeared first on Werksmans Attorneys.

The South African Reserve Bank (“SARB“) and National Treasury published the draft Crypto Asset Manual for Cross-Border Activities for public comment on 3 August 2026 which marks a watershed moment for South Africa’s crypto asset holders and South African Authorised Crypto Asset Service Providers (“Authorised CASPs“). For the first time, cross-border crypto transactions will be subject to a comprehensive regulatory framework with the force of law, issued under the Currency and Exchanges Act, 1933 and Exchange Control Regulations, 1961.

Purpose and scope

The draft Manual establishes the operational rules for all cross-border crypto asset activities conducted through Authorised CASPs and introduces a three-tiered authorisation system –

• Category One: Remittance transactions capped at R5,000 per transaction per day and R25,000 per month.
• Category Two: Broader cross-border crypto asset transactions via South African custodial wallets.
• Category Three: Combined Category One and Category Two operations.

Key obligations and restrictions

The Manual imposes significant requirements, including –

• Only natural persons may engage in cross-border crypto transactions. Resident entities such as companies and trusts are expressly prohibited from doing so;
• Individual allowances apply: R2 million per calendar year (Single Discretionary Allowance) and R10 million (Foreign Capital Allowance);
• Transfers between a domestic Authorised CASP and an offshore CASP, or to non-custodial wallets, are classified as cross-border;
• Transfers from non-custodial wallets to domestic Authorised CASPs are prohibited;
• Authorised CASPs must hold minimum unimpaired capital of R5 million (or 15% of average positive gross income over three years, whichever is higher), maintain CIPC registration with physical presence in South Africa, and ring-fence their operations;
• Full CDD compliance under the Financial Intelligence Centre Act, FinSurv Reporting System certification, and record-keeping for a minimum of five years; and
• Non-compliance may result in official warnings, suspension, permanent withdrawal of authorisation, or criminal prosecution.

Draft Capital Flow Management Regulations, 2026

Stakeholders should note that the draft Capital Flow Management Regulations, 2026 published by National Treasury remain under consideration and have not yet been finalised. The draft Regulations propose a comprehensive amendment of the Exchange Control Regulations, 1961 and would, among other things –

• Explicitly define “capital” to include crypto assets;
• Introduce compelled disclosure of private keys upon forfeiture;
• Establish search and seizure powers for crypto assets; and
• Impose criminal penalties of up to R1,000,000 or five years’ imprisonment (or fines equal to the asset value where this exceeds R1,000,000).

The draft Regulations and draft Manual are designed to work in tandem: the Regulations provide the overarching legislative framework, whilst the Manual sets out the operational implementation requirements for cross-border crypto asset activities. Should the draft Regulations be finalised in their current form, the regulatory landscape for crypto assets in South Africa will fundamentally transform.

What you need to do

The draft Manual has been published for public comment by close of business on 30 September 2026. All stakeholders, including Authorised CASPs, fintech companies, institutional investors, and individual crypto holders, are encouraged to submit written representations to SARB’s Financial Surveillance Department during the comment period.

Given the far-reaching implications of both the draft Manual and the draft Capital Flow Management Regulations, affected parties should –

• Review the draft Manual in full and assess the impact on current and planned operations;
• Prepare and submit written comments within the prescribed consultation period;
• Engage specialist legal counsel to navigate the compliance requirements; and
• Monitor developments regarding the Capital Flow Management Regulations, which will shape the broader regulatory environment.

Werksmans is available to assist with submissions, compliance assessments, and strategic advice in relation to the draft Manual and the evolving regulatory framework for crypto assets in South Africa.

The post South Africa’s crypto crackdown: Draft Manual brings cross-border crypto asset transactions under exchange control appeared first on Werksmans Attorneys.

Introduction

In this article series, we take a deep dive into the South African Conduct of Financial Institutions (COFI) Bill – a major financial sector regulatory reform – one theme at a time.

COFI was drafted in conjunction with the Financial Sector Regulation Act (FSRA), the two pillars of the Twin Peaks regulatory reform. The Twin Peaks regulatory reform is a response to financial system weaknesses identified by the 2008 Global Financial Crisis, such as the systemic risks of large insurers and inappropriate market conduct practices.

The FSRA has already been implemented. The FSRA introduced the Twin Peaks regulatory framework, bringing into existence two regulators for the industry. The first regulator is the Prudential Authority (PA) responsible for the prudential regulation of financial institutions, while the second is the Financial Sector Conduct Authority (FSCA) responsible for regulating market conduct.

COFI represents a major overhaul of how financial institutions will be regulated in South Africa. Currently, different financial institutions are regulated by different legislation. COFI will involve shifting to a harmonised, principles-based conduct regime focused on customer outcomes, transparency and inclusion. COFI also provides for a single licensing and supervision framework and stronger enforcement and standards across the financial sector. Its implementation will unfold over several years and reshape regulatory expectations for financial institutions and consumers alike.

National Treasury has indicated that COFI will be finalised in 2026. COFI has recently been adop­ted by Cab­inet for sub­mis­sion to Par­lia­ment.

COFI – What Really Changes?: Part 6

In our previous articles, we examined the Purpose and Application of COFI, the Licensing Framework, Consumer Protection and Transparency, the Principles and Conduct Requirements and the Governance and Accountability under COFI. In this article, we look at COFI versus the current regime, with a focus on FAIS, and consider what the shift to COFI will mean in practice. That is, what really changes?

From sectoral to unified, activity-based regulation and licencing

The current regime is not governed by a single statute, but rather by a combination of laws, including FAIS, the Long-term and Short-term Insurance Acts, the Collective Investment Schemes Control Act (“CISCA”) and elements of the FSRA. While these frameworks have developed over time, they have resulted in a fragmented and sector specific approach to conduct regulation in the sense that under the current framework, financial institutions are regulated based on their legal form and sector. Different rules apply to financial advisors and managers, insurers, collective investment scheme administrators and other market participants, often resulting in overlapping or inconsistent requirements.

COFI introduces a single conduct framework that applies across the financial sector. Rather than regulating specific categories of institutions, COFI regulates financial activities, regardless of who performs them. This also means that entities that previously have fallen outside specific sectoral regimes are now to be brought within the regulatory net owing to the activities they perform (for example, “corporate advisory services”).

This shift permeates into the licencing framework. Under the current regime, licensing is largely entity based and sector-specific. Financial advisors and investment managers are licensed as FSPs under FAIS, insurers are licensed as such under insurance legislation, collective investment scheme managers are authorised under CISCA and so on. This means that one entity may require multiple licences in terms of multiple legislation.

In line with international trends, COFI replaces this with an activity-based licensing model, under which a financial institution holds a single licence with multiple activity authorisations linked to the activity/ies performed, the financial product involved and the category of customer served.

In short, it is not what you are, but what you do that counts.

From indirect to direct accountability

A defining feature of the current framework, particularly under FAIS, is its reliance on the concept of representatives, including both natural persons and juristic representatives, who act under the licence of an FSP.

COFI represents a shift towards increased accountability. This is seen by increasing transparency requirements through imposing greater disclosure requirements (such as, in some cases, making financial statements available to the public) but also in shifting the focus away from representatives and towards the person who actually performs the regulated activity.

This has potentially significant implications: First, certain entities that currently operate as juristic representatives may be required to obtain their own licences, particularly in areas such as discretionary investment management. Second, the continued role of juristic representatives in other contexts, such as the provision of financial advice, remains uncertain under the current draft, including in light of transitional provisions.

This represents a move towards increased accountability as well as direct accountability at the level at which the activity is performed, rather than reliance on layered licensing structures.

Ultimately, COFI signals a shift towards a regulatory regime in which it is not only what you do that counts, but how you behave while doing it.

From rules-based to outcomes-based conduct

The current regulatory framework is largely rules-based, supported by detailed subordinate legislation, codes of conduct and sector-specific requirements. Compliance is often demonstrated through adherence to prescribed rules and processes.

COFI introduces a principles- and outcomes-based framework, centred on the delivery of fair customer outcomes. Financial institutions must consider whether conduct has resulted in appropriate outcomes for customers. While this allows for greater flexibility, it also introduces interpretive uncertainty, particularly in the absence of detailed conduct standards at the outset.

It is not only what you do and how you behave while doing it, but also how it lands with consumers that counts.

From protective rules to increased governance and culture expectations

Under the current framework, governance requirements vary across sectors and are often indirect or embedded within broader prudential or operational requirements.

COFI places greater emphasis on governance, conduct culture and accountability. COFI requires that the governing body takes responsibility for conduct, institutions embed a conduct-oriented culture and that senior management actively oversees conduct risk.

This elevates conduct from a compliance issue “managed” by a compliance team to a core governance function across all financial institutions for which leadership is responsible. Conduct consideration is expected to be an integral part of the culture of every financial institution.

It is not only what a financial institution does that counts, but what its leadership does and what its culture is.

From reactive to proactive enforcement

Under the current regime, supervision is often focused on compliance with sector-specific rules and licensing conditions, with different regulators historically overseeing different parts of the market.

COFI empowers the FSCA to adopt a more proactive and judgement-based supervisory approach. The FSCA is empowered to issue binding conduct standards and monitor customer outcomes. Notably, the FSCA is empowered to intervene where there is a risk of harm, even in the absence of clear rule breaches.

This represents a shift towards more intrusive and risk-based (as opposed to breach-based) supervision.

What does this mean for financial institutions?

The existing legislative framework will not fall away immediately upon the introduction of COFI. Instead, there will be a phased transition, during which existing licences and authorisations will remain valid and institutions will be migrated to the COFI licensing framework over time.

Financial institutions should begin to align their businesses with the new regulatory philosophy encompassed by COFI.

In anticipation of COFI’s implementation, financial institutions should begin –

• mapping their activities against the proposed licensing categories;
• assessing whether any group entities or service providers may require separate licences;
• reviewing governance and operational structures to align with an activity-based regulatory framework;
• reviewing their financial reporting and audit processes and considering the potentially public positioning of their financial information;
• reviewing their product governance frameworks, assessing how customer outcomes are currently measured and monitored, strengthening conduct risk management processes and embedding conduct considerations into decision-making at all levels of the organisation;
• clarifying the roles and responsibilities of boards and senior management; and
• strengthening conduct risk governance frameworks, reviewing remuneration and incentive structures and ensuring that appropriate management information is available to monitor customer outcomes.

Early engagement and preparation will be key to navigating the transition to COFI.

The post Mind the Conduct: A Guide to COFI – Part 6: COFI – What Really Changes? appeared first on Werksmans Attorneys.

Introduction

In this article series, we take a deep dive into the South African Conduct of Financial Institutions (COFI) Bill – a major financial sector regulatory reform – one theme at a time.

COFI was drafted in conjunction with the Financial Sector Regulation Act (FSRA), the two pillars of the Twin Peaks regulatory reform. The Twin Peaks regulatory reform is a response to financial system weaknesses identified by the 2008 Global Financial Crisis, such as the systemic risks of large insurers and inappropriate market conduct practices.

The FSRA has already been implemented. The FSRA introduced the Twin Peaks regulatory framework, bringing into existence two regulators for the industry. The first regulator is the Prudential Authority (PA) responsible for the prudential regulation of financial institutions, while the second is the Financial Sector Conduct Authority (FSCA) responsible for regulating market conduct.

COFI represents a major overhaul of how financial institutions will be regulated in South Africa. Currently, different financial institutions are regulated by different legislation. COFI will involve shifting to a harmonised, principles-based conduct regime focused on customer outcomes, transparency and inclusion. COFI also provides for a single licensing and supervision framework and stronger enforcement and standards across the financial sector. Its implementation will unfold over several years and reshape regulatory expectations for financial institutions and consumers alike.

National Treasury has indicated that COFI will be finalised in 2026. COFI has recently been adop­ted by Cab­inet for sub­mis­sion to Par­lia­ment.

Governance and Accountability: Part 5

In our previous articles, we examined the Purpose and Application of COFI, the Licensing Framework, Consumer Protection and Transparency and the Principles and Conduct Requirements under COFI. In this article, we consider COFI’s approach to governance and accountability and the extent to which COFI seeks to influence not only what financial institutions do, but how they are run.

Conduct as a governance issue
A defining feature of COFI is that it elevates market conduct from a compliance function to a governance responsibility.

Under the current regime, conduct risk is often managed within legal or compliance teams. COFI, however, makes it clear that responsibility for delivering fair customer outcomes rests with the leadership of the institution itself.

This reflects a broader international regulatory trend: poor conduct is increasingly seen not as a failure of rules, but as a failure of governance, oversight and culture.

The role of the “governing body”

COFI places primary responsibility for conduct on an institution’s “governing body”. The governing body is expected to ensure that the institution conducts its business in a manner that delivers fair customer outcomes, oversee the effectiveness of conduct risk management frameworks and embed appropriate policies, processes and controls across the organisation.

This represents a shift from oversight of compliance to active accountability for conduct outcomes.

Conduct culture

COFI introduces a focus on “conduct culture”, being the values, behaviours and incentives that shape how an institution interacts with its customers. Financial institutions will be expected to demonstrate that their culture supports fair treatment of customers, responsible product design and distribution and ethical decision-making at all levels of the organisation.

This will impact expectations pervasively. For example, remuneration structures will need to be reevaluated to ensure that they do not incentivise poor customer outcomes.

Senior management accountability

While COFI does not introduce a formal individual accountability regime equivalent to those seen in some international jurisdictions (such as the United Kingdom’s Senior Managers and Certification Regime), it nonetheless places heightened expectations on senior management.

In practice, this is likely to lead to a more structured allocation of responsibilities within institutions, even if not formally prescribed in the legislation.

Key challenges

While the governance framework under COFI is conceptually aligned with international best practice, it
raises several practical and conceptual challenges.

Concepts such as “conduct culture” and “fair outcomes” are inherently difficult to define, much less measure and evidence. These concepts require institutions to make qualitative judgments about behaviours and outcomes. The reliance on broad, principles-based obligations introduces interpretive uncertainty, (particularly, before any conduct standards are issued – see our article: Principles and Conduct Requirements). In addition, it is unclear how the FSCA and PA will distinguish between genuine conduct failures and reasonable differences in business judgment. This begs the question: Will the emphasis on governing bodies, senior management and conduct culture lead to better customer outcomes on the ground? Without clear guidance on quantifiable outcomes and how they should be assessed and evidenced, there is a possibility that institutions will prioritise regulatory defensibility over substance.

Smaller institutions may face disproportionate challenges in implementing governance frameworks that are sufficiently robust to meet regulatory expectations. Concepts such as a “governing body”, formal conduct risk frameworks and sophisticated monitoring systems may not align neatly with the structures of smaller firms (see our comments about proportionality in our previous article: Purpose and Application). This, in turn, may serve as a disincentive for market entrants, scuppering objectives of inclusivity in the financial services sector.

Practical implications

COFI’s governance requirements will require financial institutions to reassess not only their policies and procedures, but also their decision-making structures and organisational culture.

In preparation, institutions should consider –

• clarifying the roles and responsibilities of boards and senior management;
• strengthening conduct risk governance frameworks;
• reviewing remuneration and incentive structures; and
• ensuring that appropriate management information is available to monitor customer outcomes.

COFI represents a ramping up in accountability. It is not only what a financial institution does that counts, but what its leadership does and what its culture is.

The post Mind the Conduct: A Guide to COFI – Part 5: Governance and Accountability appeared first on Werksmans Attorneys.

On 22 May 2026, South Africa’s Information Regulator served an enforcement notice on the Central Johannesburg TVET College after employees’ personal credential verification reports were accidentally emailed to unauthorised staff. The enforcement notice sets a significant precedent: even accidental, purely internal disclosures of personal information to unauthorised parties constitute a “security compromise” under the Protection of Personal Information Act 4 of 2013 (“POPIA“), triggering formal breach notification obligations. This article examines the enforcement notice, analyses its implications under POPIA, compares the position to the GDPR, and offers practical guidance for businesses.

Background

The Central Johannesburg TVET College (the “College“) had been placed under administration to address governance failures, including undisclosed criminal records and conflicts of interest among staff. As part of this process, employees’ personal information was collected to verify their academic qualifications and criminal records. This was done by a service provider preparing Personal Credential Verification Reports (“Verification Reports“). The Acting Chief Financial Officer erroneously included the complainants’ Verification Reports in a folder of finance policies, which was then emailed to unauthorised employees.

The email was recalled and a follow-up was sent alerting staff to the error. An investigation was launched and corrective action was taken against staff who forwarded the document.

The Information Regulator (the “Regulator”) identified three categories of POPIA violation. First, the College had failed to register an information officer or designate deputy information officers, breaching POPIA’s accountability condition (section 8). Second, distribution of the Verification Reports to staff uninvolved in the governance restoration exercise constituted further processing incompatible with the original collection purpose (section 15). Third, the College’s failure to maintain separate files for Verification Reports and finance policies, coupled with its failure to register an information officer, evidenced an absence of organisational controls to prevent unlawful access or processing (section 19). The Regulator found that the accidental internal disclosure triggered POPIA’s security compromise notification obligations under section 22, which the College had failed to discharge.

The Regulator directed the College to: (i) register an information officer and deputy information officers; (ii) formally notify the Regulator and affected data subjects of the compromise; (iii) issue a written apology to the complainants, to be circulated to all staff; (iv) take disciplinary action against the responsible employee; (v) develop and submit a POPIA Compliance Framework; and (vi) conduct staff awareness and training programmes. Failure to comply with an enforcement notice is a criminal offence punishable by a fine of up to R10 million, imprisonment of up to ten years, or both (section 103).

Accidental and Internal Breaches are Security Compromises

The most significant aspect of this enforcement notice is the Regulator’s confirmation that both accidental breaches and internal disclosures fall within the meaning of a “security compromise” for POPIA purposes. Section 22(1) requires a responsible party to notify the Regulator and affected data subjects “where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person”. The provision does not distinguish between external attackers and internal employees, nor between deliberate and inadvertent disclosures. Any access by a person not authorised to receive the information is sufficient to trigger the obligation.

In the College’s case, the breach was entirely accidental: an employee attached the wrong file to an email, and the recipients were internal staff members, not external third parties. Nevertheless, the Regulator held that this constituted a security compromise triggering POPIA’s notification obligations in full. The College had attempted to mitigate the error by recalling the email, launching an investigation, and alerting employees that the information was not for staff use. However, the Regulator held that these good-faith remedial steps did not absolve the College of its statutory duty to formally notify the Regulator and affected data subjects. The message is clear: informal internal remediation, however swift, is no substitute for formal compliance with POPIA’s security compromise notification requirements.

This interpretation is grounded in the broad language of section 19(1), which requires responsible parties to take “appropriate, reasonable technical and organisational measures” to prevent, among other things, “unlawful access to or processing of personal information”. Read together with section 22, the statutory framework imposes a duty to safeguard personal information against all forms of unauthorised access, whether originating externally or internally, and whether intentional or accidental.

Key Takeaways for Businesses

Organisations must implement robust security measures to protect against both internal and external breaches. This requires both: (i) technological measures, such as access controls and data loss prevention technology; and (ii) organisational measures, such as policies, clear processes, and employee training. As the College’s case demonstrates, something as simple as storing personal information in a separate, access-controlled folder could have prevented the breach entirely.

Businesses should implement appropriate access controls to limit internal exposure to personal information. Personal information should be accessible only to those who require it for the specific purpose for which it was collected. Role-based access controls, file segregation, and clear protocols for handling sensitive documents are essential.

Every organisation should develop and maintain a comprehensive data breach response plan. The College’s experience illustrates that good-faith remedial steps – such as recalling an email and investigating internally – do not satisfy statutory breach notification obligations. A proper response plan should include: clear procedures for identifying and escalating potential security compromises; templates for notification to the Regulator and affected data subjects; designated personnel responsible for managing the response; and defined timelines to ensure notification is made “as soon as reasonably possible” as required by POPIA.

Most importantly, businesses must recognise the obligation to report all breaches to both the Regulator and affected data subjects. Unlike the GDPR, POPIA contains no materiality threshold. Every security compromise, no matter how minor, must be formally notified. Organisations should ensure that staff at all levels understand this obligation and that internal reporting channels are in place to escalate potential breaches promptly to those responsible for regulatory notification.

Conclusion

Although other jurisdictions, such as the EU and UK, also require reporting of internal and accidental breaches, they apply a materiality threshold and only high-risk breaches have to be reported. POPIA contains no such exception. The practical consequence is that private and public bodies under POPIA must report every security compromise, however minor, even a misdirected internal email. This places a considerable administrative burden on responsible parties, and it stretches the Regulator’s finite resources. In the absence of a materiality threshold, there is a real risk that regulatory attention is diverted from serious incidents to trivial ones. Until the legislature revisits this position, however, organisations must comply with the law as it stands.

Responsible parties must treat their data security obligations with the seriousness they demand or face the risk of a simple mistake inviting the full scrutiny of the Regulator, as was unfortunately the case for the College.

The post When a misdirected email becomes a data breach: The Information Regulator issues an enforcement notice on internal and accidental security compromises appeared first on Werksmans Attorneys.

In the judgment of Els v Venter and Another (449/2024) [2025] ZASCA 163 (27 October 2025), the Supreme Court of Appeal (“SCA“) clarified the application of the Consumer Protection Act No 68 of 2008 (“CPA“) to residential leases. In this article we discuss the judgment and our key takeaways.

Background

After emigrating to Australia, the respondents, Mr and Mrs Venter (the “Venters“), leased their Stellenbosch property at De Zalze Winelands Golf Estate, to the appellant, Mr Els, for a period of three years ending on 31 December 2023 (the “first lease“). After the first lease expired, the parties concluded a second lease agreement (the “second lease“) on 4 August 2023 for a further three-year period, commencing on 1 January 2024. The second lease permitted the Venters to terminate the agreement by providing three months’ written notice.

The property was subsequently sold on 19 December 2023, and the Venters issued a termination notice on 21 December 2023 requiring Mr Els to vacate the property by 31 March 2024. Mr Els challenged the termination on the basis that the second lease constituted a fixed-term agreement under the CPA, which could only be terminated by the Venters in the event of his material failure to comply with the lease agreement.

The parties failed to resolve the dispute, and the Venters launched an urgent application in the Cape Town High Court, seeking an order that the second lease was validly terminated and that Mr Els must vacate the property. The High Court agreed with the Venters that the CPA did not apply and ordered Mr Els to vacate by 31 March 2024. Mr Els subsequently took the matter on appeal to the SCA.

Key CPA Terms and Concepts

Before addressing its substantive reasoning, the court considered several key terms and concepts under the CPA. The CPA applies to every “transaction” occurring in South Africa, unless specifically excluded. A “transaction” is defined as a “person acting in the ordinary course of business“, as including, amongst others, (i) an agreement for the supply or potential supply of any goods or services in exchange for consideration, or (ii) the performance of services for or at the direction of a consumer for consideration.

“Service” is in turn defined as including, amongst others, access to or use of any premises or property in terms of a “rental“; whereas a “rental” means an agreement for consideration in the ordinary course of business in terms of which temporary possession of any premises or property is delivered to the consumer; or the right to use any premises or property is granted to the consumer.

The CPA does not define “ordinary course of business“. It does however define “business” as “the continual marketing of any goods or services” and “market” as to “promote or supply any goods or services“.

The Test for the CPA to Apply to a Residential second lease

The SCA held that for the CPA to apply to a residential lease, two requirements must be satisfied. First, the lessor must be in the business of letting or hiring. Second, the lease must be within the lessor’s ordinary course of business, being their normal, routine, or day-to-day business activities, rather than a once-off transaction. Only if both requirements are met will a residential lease constitute a “rental” for CPA purposes, and only then will the lessee be a “consumer“, namely a person to whom “services are marketed in the ordinary course of the supplier’s business“.

Whether a lease is in the lessor’s ordinary course of business is an objective test that depends on the circumstances of each case.

Application to the Facts

The court held that the letting of the property was not in the course of the Venters’ business or trade, let alone in the ordinary course of business. The Venters were not in the business of letting property for consideration: each of them was engaged in their own occupation, and they rented out their family home in South Africa after emigrating. The second lease was therefore an agreement between private individuals and not a commercial letting arrangement.

It followed that, for the purposes of the CPA, the Venters were not “suppliers” as they did not promote or supply any goods or services to consumers. Nor was Mr Els a “consumer” to whom services were marketed in the ordinary course of business.

The court further observed that the second lease was not a fixed-term agreement in terms of the CPA as it exceeded the maximum period of 24 months prescribed in Regulation 5(1) of the Consumer Protection Regulations (the second lease was for 36 months). This meant that Mr Els’s reliance on section 14(2)(b)(ii) of the CPA was misplaced. The section provides that a supplier may only cancel a fixed-term agreement after giving 20 business days’ written notice to the consumer of a material failure to comply with the agreement, and only if the consumer has not rectified the failure within that time. It should be noted, however, that this aspect of the SCA’s reasoning is questionable: if an agreement qualified as a fixed-term agreement but was for a period exceeding 24 months, the more logical conclusion would be that the supplier had contravened the CPA with regard to the length of the agreement, rather than that the agreement ceased to be a fixed-term agreement altogether.

The SCA also bolstered its interpretation by reference to the CPA’s underlying purpose, which it held was to protect the rights of historically disadvantaged persons who are vulnerable to exploitation. The court noted that Mr Els – the Chief Group Economist of Old Mutual – was not a vulnerable, low-income consumer. He had freely concluded the second lease on an equal bargaining footing with the Venters and was fully apprised of the circumstances, including that the second lease would be terminated once the property was sold.

The PIE Issue

Although the SCA dismissed Mr Els’s appeal in the main, it found that the High Court erred in ordering Mr Els to vacate the property by 31 March 2024. This order effectively amounted to an eviction order, which was incompetent because Mr Els was not yet an unlawful occupier under the Prevention of Illegal Eviction from and Unlawful Occupation of Land Act No 19 of 1998 (the “PIE Act“).

More fundamentally, the order cut across the powers conferred upon a court under section 4(7) of the PIE Act, which requires a court to consider whether it is just and equitable to grant an eviction, having regard to all relevant circumstances. The SCA accordingly set aside the High Court’s order in this regard.

Conclusion and Key Takeaways

Save for the setting aside of the High Court’s vacation order, Mr Els’s appeal was dismissed, with costs on the scale as between attorney and own client.

This judgment provides important clarity regarding the application of the CPA to residential leases. The CPA applies only to residential leases that are entered into in the ordinary course of the lessor’s business. Private individuals who let their own property on an occasional basis are unlikely to fall within the Act’s ambit.

Following an objective test, a court will consider not whether the transaction itself is ordinary, but whether it is carried out in the ordinary course of the supplier’s business. The SCA’s interpretation is both practical and sensible: a person in the business of letting property will be required to comply with the CPA (and ensure a lessee is provided with the protections contained in the Act); whereas someone renting out their home is unlikely to the CPA’s stringent obligations.

The SCA also relied on the CPA’s purpose to protect vulnerable and historically disadvantaged consumers and took into account Mr Els’s bargaining power when reaching its decision. We hope that the courts continue to take such a purposive and pragmatic approach to the interpretation of the CPA.

The post Renting out your home? The Consumer Protection Act does not apply to you says Supreme Court of Appeal appeared first on Werksmans Attorneys.

Introduction

In this article series, we take a deep dive into the South African Conduct of Financial Institutions (COFI) Bill – a major financial sector regulatory reform – one theme at a time.

COFI was drafted in conjunction with the Financial Sector Regulation Act (FSRA), the two pillars of the Twin Peaks regulatory reform. The Twin Peaks regulatory reform is a response to financial system weaknesses identified by the 2008 Global Financial Crisis, such as the systemic risks of large insurers and inappropriate market conduct practices.

The FSRA has already been implemented. The FSRA introduced the Twin Peaks regulatory framework, bringing into existence two regulators for the industry. The first regulator is the Prudential Authority (PA) responsible for the prudential regulation of financial institutions, while the second is the Financial Sector Conduct Authority (FSCA) responsible for regulating market conduct.

COFI represents a major overhaul of how financial institutions will be regulated in South Africa. Currently, different financial institutions are regulated by different legislation. COFI will involve shifting to a harmonised, principles-based conduct regime focused on customer outcomes, transparency and inclusion. COFI also provides for a single licensing and supervision framework and stronger enforcement and standards across the financial sector. Its implementation will unfold over several years and reshape regulatory expectations for financial institutions and consumers alike.

National Treasury has indicated that COFI will be finalised in 2026. COFI has recently been adop­ted by Cab­inet for sub­mis­sion to Par­lia­ment.

Principles and Conduct Requirements: Part 4

In our previous articles, we examined the Purpose and Application of COFI, the Licensing Framework and Consumer Protection and Transparency under COFI. In this article, we consider the conduct requirements introduced by COFI, which form the core of the new market conduct regime.

A shift to outcomes-based regulation

COFI represents a decisive move away from detailed, rules-based regulation towards a principles-and outcomes-based framework. Rather than prescribing exhaustive requirements for each sector, COFI establishes overarching conduct principles that apply across all financial institutions.

At the centre of this framework is the expectation that financial institutions must deliver fair outcomes for financial customers. This reflects the long-standing “Treating Customers Fairly” (TCF) approach, embedded into primary legislation.

Financial institutions will be required not only to comply with specific rules, but to demonstrate that their business models, products and distribution practices consistently result in fair customer outcomes.

While the conduct framework under COFI is conceptually coherent, it raises a number of practical challenges. The concern most commonly raised is that the shift to an outcomes-based model introduces interpretive uncertainty. Unlike a rules-based framework, which provides prescriptive requirements and clearer compliance benchmarks, an outcomes-based approach requires financial institutions to exercise judgment in determining what constitutes “fair outcomes” in a wide range of contexts. This creates challenges in both designing compliant processes and evidencing compliance to the regulator. Institutions may struggle to assess whether their product design, distribution strategies, pricing models and customer communications meet the required standard, particularly where customer outcomes may vary across different segments.

Conduct standards and regulatory flexibility

A key feature of COFI is the expanded role of the FSCA in issuing conduct standards. These standards will provide more detailed, activity-specific requirements that sit beneath the primary legislation.

This approach allows the regulatory framework to evolve over time, enabling the FSCA to respond more quickly to emerging risks, new products and market developments without requiring legislative amendment.

However, this flexibility also introduces a degree of regulatory uncertainty, particularly in the early stages of implementation, as much of the practical detail will be contained in future conduct standards rather than in COFI. In addition, the lack of early guidance increases the risk of inconsistent interpretation across the industry, potentially leading to uneven application of the law and retrospective regulatory scrutiny once conduct standards and supervisory expectations become more clearly defined.

Core conduct principles

COFI introduces a set of high-level conduct principles that apply across the financial sector, including acting honestly, fairly, and with due skill, care and diligence; avoiding conflicts of interest; ensuring that customers are provided with clear, appropriate and timely information; and design and distribution of financial products in a manner that is appropriate for the target market. These principles are deliberately broad and are intended to apply across a wide range of business models and activities.

Product life cycle

COFI places significant emphasis on product governance and oversight. Financial institutions will be required to ensure that (a) products are designed with a clearly identified target market; (b) distribution strategies are aligned to that target market; and (c) products continue to perform as expected over their lifecycle.

This represents a shift from a disclosure-based regime to one that scrutinises the entire product lifecycle, from design through to post-sale monitoring.

Conduct culture

COFI is focused on conduct culture within institutions. Boards and senior management will be expected to take responsibility for embedding a culture that prioritises fair customer outcomes.

This reflects a broader regulatory trend towards holding senior individuals accountable for the conduct of the institutions they manage.

Practical implications

COFI’s conduct requirements will require financial institutions to move beyond a tick-box compliance approach and towards a more holistic, outcomes-focused model.

In preparation, institutions should consider reviewing their product governance frameworks, assessing how customer outcomes are currently measured and monitored, strengthening conduct risk management processes and embedding conduct considerations into decision-making at all levels of the organisation.

Ultimately, COFI signals a shift towards a regulatory regime in which it is not only what you do that counts, but how you behave while doing it and how it lands with consumers.

The post Mind the Conduct: A Guide to COFI – Part 4: Principles and Conduct Requirements appeared first on Werksmans Attorneys.

On 3 June 2026, the Gauteng High Court refused the Information Regulator’s application for leave to appeal to the Supreme Court of Appeal against the order of 12 December 2025, in which a full bench held that the Department of Basic Education may lawfully publish matric results using examination numbers. The court concluded that the Regulator has no reasonable prospects of success. The practical upshot: matric results will continue to be published in newspapers using examination numbers without names or surnames. However, many questions remain.

This article examines the decision and analyses what it means for the interpretation of “personal information” under the Protection of Personal Information Act 4 of 2013 (“POPIA“) and the Act’s application as a whole. Was the court’s refusal of leave a missed opportunity to secure authoritative guidance on questions of public importance?

History of the Matter

The dispute began when POPIA came fully into effect on 1 July 2021, prompting the Department to halt its long-standing practice of publishing matric results in newspapers. In January 2022, a matriculant, Ms Anle Spies, together with other parties, brought urgent proceedings against the Department. The Regulator was cited as a respondent. The matter was settled by a consent order, which the Regulator confirmed: results would be published using examination numbers only, without student names or surnames. Results have been published in this manner since then.

The Regulator subsequently conducted an own-initiative assessment, and in November 2024, it issued an enforcement notice ordering the Department to cease publication of the 2024 matric results in newspapers and obtain consent before any future publication. The Department did not comply. The Regulator then brought urgent enforcement proceedings, which were struck from the roll on 8 January 2025 for lack of urgency. On 12 December 2025, a full bench upheld the Department’s appeal, set aside both the enforcement and infringement notices, and ordered the Regulator to pay the costs of the appeal. The latest development is that the Regulator’s application for leave to appeal was refused on 3 June 2026.

In our view, it is unfortunate that leave was not granted. The underlying questions discussed below are of considerable significance.

Arguments in the High Court

In the High Court matter which resulted in the December 2025 judgment, the Department argued that examination numbers, published without names or surnames, do not relate to an “identifiable” person and therefore do not constitute “personal information” for purposes of POPIA. The Regulator, on the other hand, contended that because examination numbers are issued sequentially, a learner could memorise where their classmates sat and identify one another’s results by cross-referencing published numbers. Judge Mooki dismissed this as “fanciful”, akin to “a poorly constructed thought experiment” unsupported by empirical evidence.

The judgment turned on a single dispositive question: whether the manner of publication constitutes “personally identifiable information” for purposes of POPIA. The court answered in the negative, and it upheld the appeal against the enforcement notice on that basis, declining to address the remaining arguments of the parties.

In refusing the application for leave to appeal the December 2025 judgment, Judge Mooki stated: “I am not persuaded that the expression ‘personally identifiable information’ offends against the POPIA, or that it constitutes legislation by a court,” adding that the expression “goes no further than a description of essential facts in the dispute between the parties”.

Practical Implications of the Dismissal

The December 2025 judgment establishes that information published in a form that does not permit the identification of a specific individual without more does not constitute “personal information” under POPIA.

The court’s reasoning invites comparison with the EU General Data Protection Regulation (“GDPR“) and the UK GDPR. Those frameworks draw a critical distinction between anonymisation (which requires that re-identification be irreversible and effectively impossible) and pseudonymisation (which merely replaces direct identifiers with codes whilst keeping information allowing re-identification separately). Crucially, pseudonymised data remains personal data under both regimes, subject to the full suite of data protection obligations. Examination numbers assigned to learners would, on a conventional European analysis, constitute pseudonymised data rather than anonymised data.

The High Court, by contrast, applied a narrower test, asking whether a person could, “without any particular diligence” and “without more”, identify a learner. Because the answer was no from the general public’s perspective, the court concluded that POPIA did not apply at all.

Did the Court Get It Right?

The court’s reasoning is defensible on its own terms: no learner had complained, and no harm had been demonstrated across the consecutive years of publication. The court specifically referred to no privacy infringement being demonstrated, and Judge Mooki stated that he considered all the other issues as “incidental”. This counted against the Regulator’s case.

That said, tensions remain. The court’s binary approach – data being either personally identifiable or not – did not engage with the intermediate category of pseudonymised data recognised under EU and UK frameworks. Additionally, the expression “personally identifiable information” is not a term used in POPIA itself. The Regulator’s Chairperson, Advocate Pansy Tlakula, has maintained that the examination numbers are “not de-identified” because they remain “linked to a student”, a position that carries considerable force under European norms.

If pseudonymous data is effectively excluded from POPIA’s protective ambit, the consequences for data subjects could be significant. Responsible parties would be able to process, disseminate, and share coded personal data without: a lawful basis (like consent); providing notice to data subjects; conducting impact assessments for high-risk processing; or responding to data subject access requests. In other words, a responsible party would not be required to comply with POPIA at all. This is simply because the recipients of the data cannot, without more, independently identify the individuals concerned. Data that remains personal in the responsible party’s hands would be treated as non-personal once disclosed to third parties. This appears to be in direct tension with POPIA, which excludes from the Act’s application only information “that has been de-identified to the extent that it cannot be re-identified again”, i.e. truly anonymous data, not pseudonymous data where re-identification remains possible (POPIA, section 6(1)(b)).

The court also declined to address whether a lawful basis for processing existed. Had it treated examination numbers as personal information, the question would have shifted to justification. A legitimate interests analysis, balancing the substantial public interest in educational transparency against the minimal privacy intrusion of publishing a learner’s examination number, could have still found that publication is proportionate and justified. The court could also have considered whether the Department’s constitutional mandate in relation to education, and its legislative obligations regarding the dissemination of examination results, supported a public law duty justifying the publication of results using examination numbers under POPIA (section 11(1)(e)).

Conclusion

In refusing leave, Judge Mooki stated: “I am also not persuaded that the application raises compelling reasons that warrant granting leave to appeal”. The Regulator raised legitimate questions about the interpretation of POPIA, and the primary concern now is that the High Court judgment results in an unjustified narrowing of the definition of personal information. Whether the Regulator chooses to petition the SCA directly remains to be seen. If it does, the SCA will have the opportunity to consider whether the High Court’s binary approach to what constitutes personal information is consistent with POPIA’s broader purposes, or whether a more nuanced assessment – one that acknowledges pseudonymised data as a recognised intermediate category – better serves the statute’s protective aims whilst accommodating justified processing in the public interest.

The post Leave to Appeal Refused, but Questions Remain: The Matric Results Privacy Dispute and the Meaning of Personal Information under POPIA appeared first on Werksmans Attorneys.

Introduction

In this article series, we take a deep dive into the South African Conduct of Financial Institutions (COFI) Bill – a major financial sector regulatory reform – one theme at a time.

COFI was drafted in conjunction with the Financial Sector Regulation Act (FSRA), the two pillars of the Twin Peaks regulatory reform. The Twin Peaks regulatory reform is a response to financial system weaknesses identified by the 2008 Global Financial Crisis, such as the systemic risks of large insurers and inappropriate market conduct practices.

The FSRA has already been implemented. The FSRA introduced the Twin Peaks regulatory framework, bringing into existence two regulators for the industry. The first regulator is the Prudential Authority (PA) responsible for the prudential regulation of financial institutions, while the second is the Financial Sector Conduct Authority (FSCA) responsible for regulating market conduct.

COFI represents a major overhaul of how financial institutions will be regulated in South Africa. Currently, different financial institutions are regulated by different legislation. COFI will involve shifting to a harmonised, principles-based conduct regime focused on customer outcomes, transparency and inclusion. COFI also provides for a single licensing and supervision framework and stronger enforcement and standards across the financial sector. Its implementation will unfold over several years and reshape regulatory expectations for financial institutions and consumers alike.

National Treasury has indicated that COFI will be finalised in 2026. COFI has recently been adop­ted by Cab­inet for sub­mis­sion to Par­lia­ment.

Consumer Protection and Transparency: Part 3

In our previous articles in this series, we examined the Purpose and Application of COFI and the Licensing Framework under COFI. In this article, we consider COFI’s approach to consumer protection and transparency, with a particular focus on the obligation imposed on financial institutions to publish their audited annual financial statements (AFS).

Transparency as a regulatory pillar

A central objective of COFI is to promote transparency in the financial sector as a mechanism for enhancing consumer protection and market discipline.

COFI seeks to ensure that financial customers are placed in a position to make informed decisions and that financial institutions operate in a manner that is open and accountable. This is reflected in disclosure requirements at a product level, such that institutions must ensure that fees, terms, risks and benefits of financial products are transparent and understandable. In addition, this is reflected at an institutional-level via transparency obligations.

Publication of audited financial statements

COFI requires that institutions prepare audited AFS and submit those statements to the FSCA. One of the more notable, and vociferously debated, features of COFI is the requirement that certain financial institutions must make those statements publicly available within a prescribed period after the end of their financial year.

This represents a shift from existing frameworks, where financial reporting obligations are typically directed at regulators, shareholders and/or specific stakeholders — but not typically the general public.

The publication requirement reflects an intention to enhance market-wide transparency, enabling customers, counterparties and other stakeholders to better assess the financial position and conduct of financial institutions.

From a regulatory perspective, the publication requirement appears to be grounded in three key objectives: Enhanced accountability, improved comparability and consumer empowerment.

Notwithstanding these objectives, the requirement has attracted meaningful criticism from industry participants and legal commentators.

• Lack of clarity: It is not entirely clear to which institutions the publication requirement applies. COFI states that the publication requirement applies broadly to “financial institutions” required to prepare AFSs in terms of COFI or applicable conduct standards. The detail (i.e. who must be audited) is not exhaustively set out. Rather, it is expected to be specified in conduct standards, or determined by reference to other applicable legislation (such as the Companies Act). Based on the current drafting and regulatory intent, the following categories are likely to be caught: (a) licensed financial institutions carrying on regulated activities at scale, including insurers, CIS managers, discretionary investment managers, large FSPs and retirement fund administrators as well as certain credit providers / payment providers (depending on classification); (b) any other regulated entity where audit requirements are imposed owing to other applicable legislation. That being said, this is mere conjecture.
• Limited utility for consumers: AFSs are unlikely to be meaningful or accessible to most retail customers. AFSs are technical documents, rendering it questionable whether their publication materially advances consumer protection, in practice.
• Confidentiality and competitiveness: Financial institutions, particularly those that are not publicly listed, have understandably raised concerns about the commercial sensitivity of their financial information. Requiring the public disclosure of detailed financial statements may expose proprietary or commercially sensitive information, place firms at a competitive disadvantage and deter market entry, particularly for smaller or niche providers. Against the backdrop of the limited utility for consumers (and high utility for competitors), this seems intrinsically unfair.

The requirement to publish AFS highlights a broader tension within COFI: the need to balance enhanced transparency and consumer protection against practical, proportionate regulation. While the objective of improving transparency is widely supported, stakeholders have emphasised that disclosure measures should be targeted, meaningful and proportionate to the risks being addressed.

Practical implications

If implemented in its current form, the publication requirement will require financial institutions to –

• review their financial reporting and audit processes;
• consider the public positioning of their financial information; and
• implement processes to ensure timely publication within prescribed deadlines.

Institutions should also assess whether any group-level or subsidiary structures may be affected, particularly where entities have not historically been subject to public disclosure requirements.

Ultimately, COFI signals a shift towards a regulatory regime in which it is not only what you do that counts, but how you behave while doing it.

The post Mind the Conduct: A Guide to COFI – Part 3: Consumer Protection and Transparency appeared first on Werksmans Attorneys.