An internal data breach – even only an accidental one – can trigger formal breach notification obligations under POPIA. The Information Regulator’s decision to fine Central Johannesburg TVET College R500,000 for failing to comply with an enforcement notice shows that organisations must also follow through on the corrective action required of them.
In a statement dated 26 October 2026, the Regulator said the College’s failures included not reporting the security compromise in the prescribed manner, not developing a POPIA Compliance Framework, issuing an apology late and failing to meet stipulated timeframes.
Background
The Central Johannesburg TVET College (the College) was placed under administration to address governance failures, including undisclosed criminal records and conflicts of interest among staff. As part of this process, employees’ personal information was collected to verify their academic qualifications and criminal records. This was done by a service provider preparing Personal Credential Verification Reports (Verification Reports). The Acting Chief Financial Officer erroneously included the complainants’ Verification Reports in a folder of finance policies, which was then emailed to unauthorised employees. The email was recalled and a follow-up was sent alerting staff to the error. An investigation was launched and corrective action was taken against staff who forwarded the document. The Information Regulator issued an enforcement notice to the College on 22 May 2026.
The enforcement notice set a significant precedent that even accidental, purely internal disclosures of personal information to unauthorised parties constitute a “security compromise” under the Protection of Personal Information Act 4 of 2013 (POPIA), triggering formal breach notification obligations.
The Information Regulator identified three categories of POPIA violations.
- First, the College had failed to register an information officer or designate deputy information officers, breaching POPIA’s accountability condition.
- Second, distribution of the Verification Reports to staff uninvolved in the governance restoration exercise, constituted further processing of information which was incompatible with the original collection purpose.
- Finally, the College’s failure to maintain separate files for Verification Reports and finance policies, coupled with its failure to register an information officer, revealed an absence of organisational controls to prevent unlawful access or processing .
The Regulator found that the accidental internal disclosure triggered POPIA’s data breach notification obligations under section 22, which the College had failed to discharge.
The Regulator directed the College to: register an information officer and deputy information officers, formally notify the Regulator and affected data subjects of the breach, issue a written apology to the complainants, to be circulated to all staff, take disciplinary action against the responsible employee, develop and submit a POPIA Compliance Framework and conduct staff awareness and training programmes.
At the end of the 120-day period stipulated in the enforcement notice, the Regulator received a response from the College addressing its findings and orders. After considering that response, the Regulator found that the College had failed to comply with the notice and issued an infringement notice imposing an administrative fine of R500,000.
Failure to comply with an enforcement notice is a criminal offence punishable by a fine of up to R10 million, imprisonment of up to ten years, or both .
The most significant aspect of the original enforcement notice is the Regulator’s confirmation that even internal breaches fall within the definition of a “security compromise” for POPIA purposes. The subsequent fine reinforces that responding to an enforcement notice requires organisations to complete the prescribed corrective actions within the required timeframes.
Responsible parties are required to notify the Regulator and affected data subjects “where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person”. The provision does not distinguish between external attackers and internal employees, nor between deliberate and inadvertent disclosures.
In the College’s case, the breach was entirely accidental. Nevertheless, the Regulator held that this constituted a security compromise triggering POPIA’s notification obligations in full. The Regulator held that even the college’s good-faith remedial steps of recalling the email, launching an investigation and alerting employees that the information was not for staff, did not absolve the College of its statutory duty to formally notify the Regulator and affected data subjects. The message is clear: informal internal remediation, however swift, is no substitute for formal compliance with POPIA’s breach notification requirements.
