The Information Regulator of South Africa published its enforcement notice against the Central Johannesburg TVET College (responsible party) on 20 May 2026. In its finding’s, the Enforcement Committee determined that the responsible party had interfered with the protection of personal information of data subjects in that (i) it had breached the conditions for lawful processing of personal information, and (ii) it had failed to comply with its obligations under the Protection of Personal Information Act, 2013 (POPIA) to notify security compromises as required in terms of section 22.
Specifically, the findings include that:
- the responsible party has failed to register its Information Officer with the Information Regulator and designate deputy information officers and register them with the Information Regulator;
