What are the penalties for breaching POPIA?

POPIA is sold to small businesses on fear, and the fear is usually inaccurate in a way that produces exactly the wrong behaviour. Owners buy a compliance pack, file it, and carry on, because they believe the risk is a random inspection that levies a ruinous fine.

That is not how enforcement has worked. Understanding the actual sequence tells you where the risk really is, and it is a much more manageable place than the marketing suggests.

The enforcement ladder

The Protection of Personal Information Act 4 of 2013 does not jump straight to penalties.

A complaint or an own-initiative investigation. Most matters start with a data subject complaining to the Information Regulator, or with the Regulator acting on something that has come to its attention.

An assessment. The Regulator can assess whether processing complies with the Act.

An enforcement notice. Where the Regulator is satisfied that a responsible party has interfered with the protection of personal information, it may serve an enforcement notice requiring specified steps within a stated period, or requiring that the processing stop.

An offence for ignoring the notice. Failure to comply with an enforcement notice is an offence in its own right.

Penalty. Either prosecution, or an administrative fine imposed by the Regulator instead of prosecution.

The important thing about that ladder is the step where people actually fall off it. The fines imposed since the Act came into force have overwhelmingly been for failing to comply with an enforcement notice, not for the underlying processing failure. Organisations were told what to fix, given a period to fix it, did not, and were then fined.

Which means the single most consequential decision most businesses will ever make about POPIA is what they do in the fourteen days after a letter arrives from the Regulator.

The numbers

Administrative fines. The Regulator may impose a fine of up to R10 million. It is imposed by the Regulator rather than by a court, which is why it is described as administrative, although it is subject to the procedures in the Act and can be taken on review.

In determining the amount, the Act directs attention to factors including the nature of the personal information involved, the duration and extent of the contravention, the number of data subjects affected, whether the responsible party had carried out a risk assessment, the vulnerability of the people concerned, and the likelihood of substantial damage or distress.

Serious offences. For the more serious offences under the Act, including obstructing the Regulator, unlawfully influencing it, and failing to comply with an enforcement notice, the maximum penalty is a fine or imprisonment for a period not exceeding 10 years, or both.

Less serious offences. For the remaining offences, the maximum is a fine or imprisonment not exceeding 12 months, or both.

Account numbers. The Act creates specific offences around obtaining, providing or selling an account number of a data subject, which are treated seriously precisely because of what they enable.

Those are ceilings. The fines actually imposed have been well below R10 million, and the pattern has been escalation from a notice rather than a fine out of nowhere.

The civil claim nobody mentions

For most small businesses this is the more realistic exposure, and it receives almost no attention in compliance material.

Section 99 gives a data subject a civil action for damages against a responsible party for breach of any provision of the Act, whether or not there is intent or negligence on the part of the responsible party.

Read that again, because it is unusual. An ordinary delictual claim requires the claimant to prove fault. This one does not. The defences are limited and specific, and include vis major, consent, that the damage was due to the fault of the data subject, that compliance was not reasonably practicable in the circumstances, or that the Regulator granted an exemption.

A court hearing such a claim may award damages for patrimonial and non-patrimonial loss, aggravated damages, interest and costs.

For a business holding data on a large number of people, the arithmetic of that is worth sitting with. A modest award per person, multiplied across a customer database, is a different order of risk from an administrative fine.

What actually causes trouble

In practice, complaints cluster around a small number of behaviours.

Direct marketing. Unsolicited electronic marketing to people who never opted in is the most complained-about conduct under the Act, and it is the easiest to prove because the evidence is in the recipient's inbox. Our guide on sending marketing emails and SMS under POPIA sets out what is permitted.

Security compromises. A breach is not itself automatically a penalty, but failing to notify the Regulator and the affected data subjects as the Act requires is a separate and serious failure. Our guide on what to do after a data breach sets out the notification obligations.

Ignoring a data subject request. Somebody asks what you hold about them, or asks for it to be deleted, and gets no answer. This is how most complaints begin, and it is almost always avoidable.

No registered information officer. Every responsible party has one by operation of law, and registration is required. Our guide on registering an information officer explains the process.

Sharing data with third parties without an operator agreement. Our guide on operator agreements explains the written contract requirement, and the exposure sits with you rather than with your supplier.

Keeping everything forever, with no retention policy and no deletion.

Our POPIA compliance checker works through where a small business is most exposed, and our guide on whether POPIA applies to your business deals with the threshold question.

The consequences that are not penalties

Businesses focus on the fine and are then damaged by something else entirely.

Notification is public in effect. Telling several thousand customers that their data was compromised is a reputational event regardless of what the Regulator does.

Contracts require compliance. Corporate customers increasingly require POPIA warranties and the right to audit. Losing a contract over a compliance failure costs more than most fines.

Indemnities flow downhill. If you are an operator processing on behalf of somebody else, your contract almost certainly makes their exposure yours.

Insurance may not respond. Cyber cover is not universal, and policies commonly exclude regulatory fines.

If you receive something from the Regulator

This is the part worth internalising, because the enforcement pattern makes it decisive.

Do not ignore it. Most fines so far have followed a failure to comply with an enforcement notice, although the Regulator can also issue an infringement notice directly for some offences. Ignoring correspondence converts a fixable problem into an offence carrying a ten-year maximum.

Note the deadline immediately, and diarise it backwards so that you are ready before it expires.

Answer what is actually asked. A general statement about how seriously you take privacy is not compliance with a notice specifying steps.

Do the thing, and prove you did it. Keep the evidence: the deletion log, the amended consent flow, the signed operator agreement, the dated policy.

Ask for an extension if you need one, in writing and before the deadline, with reasons. That is a very different conversation from an explanation after the fact.

Get advice early if the matter is serious. The cost of an attorney at the notice stage is trivially small compared with the cost at the penalty stage.

Worked example

This example is illustrative. A small online retailer buys a list of email addresses and sends a promotional campaign to 40 000 people. Several recipients complain to the Information Regulator that they never gave consent and that there is no working unsubscribe.

The Regulator investigates and serves an enforcement notice. It requires the business to stop sending unsolicited electronic direct marketing, to delete the purchased list, to implement an opt-out mechanism, and to report back within a stated period.

If the business complies, that is very likely the end of the regulatory story. It has cost a fright, some work and possibly a small legal fee.

If the business ignores the notice, it has committed an offence carrying a maximum of ten years, and it has exposed itself to an administrative fine of up to R10 million imposed in lieu of prosecution. On the Regulator's own criteria the number of people affected and the absence of any risk assessment both push the figure upward.

Separately, and regardless of which of those happens, each of the 40 000 people has a potential civil claim under section 99, and none of them has to prove that the business intended anything or was negligent.

The difference between the good outcome and the bad one is not the original mistake, which was the same in both branches. It is what happened after the letter arrived.