An internal data breach, even an accidental one, can trigger formal breach notification obligations under the Protection of Personal Information Act (POPIA). The Information Regulator recently fined Central Johannesburg TVET College R500,000 for failing to comply with an enforcement notice.
This decision shows that organisations must also complete the corrective actions that the Regulator requires.
In a statement dated 26 October 2026, the regulator outlined the college’s failures. These included failing to report the security compromise in the prescribed manner and to develop a POPIA Compliance Framework. The college also issued an apology late and failed to meet stipulated timeframes.
Background of the case
Central Johannesburg TVET College was placed under administration to address governance failures. These included undisclosed criminal records and conflicts of interest among staff. As part of this process, employees’ personal information was collected to verify their academic qualifications and criminal records.
A service provider prepared Personal Credential Verification Reports (Verification Reports) for this purpose. However, the Acting Chief Financial Officer erroneously included the complainants’ Verification Reports in a folder containing finance policies. The CFO then emailed this folder to unauthorised employees.
The college recalled the email and sent a follow-up message alerting staff to the error. It also launched an investigation and took corrective action against employees who forwarded the document. Subsequently, the Information Regulator issued an enforcement notice to the college on 22 May 2026.
The enforcement notice established a significant precedent. It confirmed that even accidental, purely internal disclosures of personal information to unauthorised parties constitute a “security compromise” under the Protection of Personal Information Act 4 of 2013 (POPIA). Consequently, such disclosures trigger formal breach notification obligations.
The regulator’s findings and enforcement action
The Information Regulator identified three categories of POPIA violations:
- First, the College had failed to register an information officer or designate deputy information officers. This breached POPIA’s accountability condition.
- Second, the college distributed the Verification Reports to staff who had no involvement in the governance restoration exercise. This constituted further processing of information that was incompatible with its original collection purpose.
- Finally, the college failed to maintain separate files for Verification Reports and finance policies. Combined with its failure to register an information officer, this revealed an absence of organisational controls to prevent unlawful access or processing.
The regulator found that the accidental internal disclosure triggered POPIA’s data breach notification obligations under section 22. However, the college had failed to fulfil these obligations. Consequently, the regulator directed the college to undertake several corrective actions.
These included:
- Register an information officer and deputy information officers.
- Formally notify the Regulator and affected data subjects about the breach.
- Issue a written apology to the complainants and circulate it to all staff.
- Take disciplinary action against the responsible employee.
- Develop and submit a POPIA Compliance Framework.
- Conduct staff awareness and training programmes.
At the end of the 120-day period stipulated in the enforcement notice, the regulator received a response from the college. The response addressed the regulator’s findings and orders. However, after considering it, the Regulator found that the college had failed to comply with the notice. It subsequently issued an infringement notice imposing an administrative fine of R500,000.
Failure to comply with an enforcement notice constitutes a criminal offence. The offence carries a fine of up to R10 million, imprisonment of up to ten years, or both.
Internal disclosures also trigger notification obligations
The most significant aspect of the original enforcement notice concerns the definition of a “security compromise” under POPIA. The regulator confirmed that even internal breaches fall within this definition. Furthermore, the subsequent fine reinforces an important principle: organisations must complete the prescribed corrective actions within the required timeframes when responding to an enforcement notice.
Responsible parties must notify the regulator and affected data subjects “where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person”. Importantly, this provision does not distinguish between external attackers and internal employees. Nor does it distinguish between deliberate and inadvertent disclosures.
In the college’s case, the breach was entirely accidental. Nevertheless, the regulator held that it constituted a security compromise and triggered POPIA’s notification obligations in full.
The regulator also held that the college’s good-faith remedial steps did not absolve it of its statutory duties. These steps included recalling the email, launching an investigation and alerting employees that the information was not intended for staff.
However, these measures did not replace the college’s obligation to formally notify the Regulator and affected data subjects. The message is clear: informal internal remediation, however swift, cannot substitute for formal compliance with POPIA’s breach notification requirements.
The compliance implications for organisations
The case carries important implications for organisations that process personal information. It demonstrates that POPIA breaches do not necessarily involve external cyberattacks, malicious employees or deliberate misconduct. Even an administrative error that exposes personal information internally can trigger statutory notification obligations.
Organisations must therefore strengthen their internal information management controls. They should maintain appropriate access restrictions, establish clear document management procedures and ensure that employees understand their responsibilities when handling personal information.
Moreover, organisations must recognise that POPIA breaches require more than immediate remedial action. Recalling an email, investigating an incident or disciplining an employee may address aspects of the problem. However, these actions do not automatically satisfy the formal obligations that POPIA imposes.
The R500,000 fine also highlights the consequences of failing to implement corrective measures within prescribed timeframes. Organisations must treat enforcement notices as binding regulatory instructions rather than recommendations. They must document their responses, monitor implementation and retain evidence demonstrating compliance.
Ultimately, POPIA breaches demand both an appropriate incident response and demonstrable regulatory accountability. The Central Johannesburg TVET College case reinforces the importance of understanding that accidental disclosures carry legal consequences. Organisations must therefore respond promptly, notify the relevant parties and complete every corrective action the Information Regulator requires.
 |
 |
 |
| Armand Swart | Director | mail me | | Hlonelwa Lutuli | Associate | mail me | | Isabella Keeves | Candidate Attorney | mail me | |
| | Werksmans Attorneys | | ||
