CookieGate
Start free trial

South Africa’s SABS enforcement notice: the ransomware attack was the trigger, not the violation

3 min read By Comply Ark

Regulation: POPIA

In this post

What happened

South Africa’s Information Regulator has issued an enforcement notice under the Protection of Personal Information Act 4 of 2013 (POPIA) to the South African Bureau of Standards (SABS). The Regulator set out the matter at a media briefing on 31 August 2026, which its own media invite listed as covering “the status of Infringement and Enforcement Notices issued by the Regulator to institutions such as the South African Bureau of Standards”.

The background is a ransomware attack on SABS in November 2024. Reporting at the time said the attack took down its salary systems and November salaries were paid manually. A parliamentary committee later heard that the Lynx ransomware group was responsible and that SABS’s systems were still encrypted months afterwards.

The Regulator opened an assessment of SABS on its own initiative after the attack. According to law-firm and trade-press accounts of the briefing, it found SABS had processed excessive or irrelevant personal information, used inadequate consent mechanisms, kept weak security safeguards, failed to deal with known vulnerabilities, had no incident response plan, and did not tell data subjects how their personal information was being collected. SABS has 90 days from receipt of the notice to revise its policies, carry out personal information impact assessments and put adequate security measures in place.

No administrative fine against SABS has been reported. This is an enforcement notice, a direction to fix things within a deadline. The Regulator has said, in an earlier statement, that failing to comply with an enforcement notice is an offence that can lead to a fine, imprisonment or both.

The distinction the Regulator drew

The Regulator stressed that it did not act because SABS was the victim of a cyber-attack. It acted because of the compliance failures the assessment found.

Several of those failures have nothing to do with the attacker. Collecting more than is needed goes to minimality (section 10). Inadequate consent goes to the lawful basis for processing (section 11). Not telling people what is being collected goes to the notification duty in section 18. Security safeguards and vulnerability management sit under section 19. The published accounts do not cite the specific sections in the notice, so treat this as the statutory context, not the Regulator’s citations. Either way, the ransomware is what brought the Regulator in, and the gaps in consent and transparency were there before the attack.

An organisation with the same consent and notice gaps that has never been breached faces the same exposure once a complaint or an assessment reaches it.

Why this matters beyond South Africa

POPIA does not make consent a precondition for all processing. Section 11(1) lists consent as one of several justifications, alongside contract, legal obligation, the data subject’s legitimate interest, public law duties and the legitimate interests of the responsible party or a third party. The SABS notice is therefore not a ruling that every cookie or tracker in South Africa now needs an opt-in banner, and it should not be read that way.

What it does show is that where an organisation relies on consent, the Regulator will check whether that consent was adequate, and whether people were told what was collected and why, whether or not anything went wrong. The same applies to cookie consent in any jurisdiction. A consent record that cannot show the choice was informed, specific and tied to an actual disclosure is a weakness from the day it is created. A breach usually determines when a regulator looks, but the findings can rest on everything else.

Sources

enforcementconsentsecuritybreach-response

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles the POPIA