The Information Regulator has produced a number of media statements in the first half of 2025, which can be found at Media statements  

1. Media Statement: Regulator launches online reporting platform for security compromises 7 APRIL 2025
2. MEDIA ALERT: Public and Private bodies invited to submit PAIA annual reports for 2024- 2025 17 MARCH 2025.
3. Media Statement: Information Regulator calls for the submission of PAIA annual reports 12 March 2025.
4. Media Statement: The Regulator welcomes the Justice Minister’s decision on publication of the Sex offenders register 4 March 2025.
5. Media Invitation: Information Regulator hosts a stakeholder consultative session on it’s annual plans for the 2025/2026 financial year 3 March 2025.
6. Media Invitation: Information Regulator & Naspers to host International Data Privacy Day dialogue 21 January 2025.
7. Media Statement: The Regulator acts on alleged security compromise incident suffered by the Department of Basic Education regarding Matric Results 13 January 2025.
8. Media Statement: Information Regulator’s reaction to Matric results court decision 8 January 2025.

A summary of the aspects you need to know follows:

Any security incident or breach should now be reported on the Information Regulators portal. This is mandatory, and must be used instead of sending e-mail to the Regulator. The page providing guidance can be found at Reporting Security Compromises and you can report the incident from links on that page.

Private and Public bodies are invited to submit their PAIA Annual reports for the year 2024-2025 on any information requests received or processed. 

The submission period is from April 1, 2025, to June 30, 2025.

Key points include:

• Public Bodies: Information Officers must submit reports on access to information requests.
• Private Bodies: Heads or Deputy Information Officers must submit similar reports.
• Compliance: The reports help determine compliance with the Promotion of Access to Information Act (PAIA).
• Online Submission: An online platform is available for submitting these reports. You can submit your annual report directly on the eServices portal-PAIA Anual reporting. It is important to note that you will only be able to submit your report if the organisation and Officers are registered on the portal.
• Support: Technical support and step-by-step guides are provided to assist with the submission process.

Amendment to POPIA Regulations

In addition to the media statements, an amendment to the POPIA regulations were published in January 2025, which can be found at POPIA Regulations amendments 2025.

Key changes are:

Definitions

New or revised definitions have been introduced for key terms, namely, “complainant” and “complaint”, “day”, “office hours”, “relevant body/bodies”, and “writing.” These definitions clarify terms used in the Regulations, helping businesses to understand and comply with POPIA more effectively and efficiently.

Office hours have been clarified to include opening hours of the Information Regulator, and operating hours of organisations included in the regulations.

The definition of Writing is as per the ECT Act.

Objection to processing, and request for correction or deletion, of personal information

Regulations regarding

• Objection to Processing of Personal Information, and
• Requests for correction or deletion of personal information or destruction or deletion of record of personal information

These have updated to improve and broaden the process for data subjects to:

• object to the processing of, and
• request the correction or deletion of, or destruction or deletion of record of, their personal information.

Such objections and requests can now be submitted:

• by hand,
• fax,
• post,
• email,
• telephone (provided that the objection or request is recorded (by the responsible party) and made available on request.)
• SMS, and
• WhatsApp,

The strict requirement to use the prescribed forms has been removed, provided that the objection or request is on a form substantially similar to the templates.

Any objection or request must be free of charge.

Responsible parties are required to notify data subjects of their right to object when collecting personal information.

Responsible parties must notify data subjects of the action taken in respect of a request for correction or destruction within 30 days of receiving the outcome of the request.

Consent for direct marketing

Requests for a data subject’s consent to process personal information for direct unsolicited electronic marketing requires businesses to obtain explicit written consent from data subjects for such direct marketing on a form substantially similar to Form 4.

Consent requests can be made by:

• email,
• telephone,
• SMS,
• WhatsApp,
• facsimile, or
• automated calling machines.

Telephonic and automated calling machine requests must be recorded and made available to the data subject upon request, free of charge.

The so-called ‘opt-out’ options, have been clarified –

• opt-out shall not constitute consent as referred to in the Act.

Lodging complaints

The process for lodging complaints with the Information Regulator have been clarified, including details of:

• who may lodge a complaint,
• the process to be followed,
• the information required, and
• the assistance that will be provided by the Information Regulator.

Complaints can be submitted

• online,
• at designated offices,
• via fax,
• post,
• courier, or

The Regulator will acknowledge receipt of the complaint with a reference number within 14 days and will provide assistance free of charge.

Complaints should contain at least the following information:

• name(s) and surname/ registered name of a complainant; unique identifier/identity number/ company registration number of a compliant, if required; address of a complainant;
• the telephone and facsimile numbers of a complainant and e-mail address, if available;
• reasons for a complaint;
• name(s) and surname of a responsible party / registered name of a
• responsible party;
• address of a responsible party;
• the telephone and facsimile numbers of a responsible party and e-mail address, if available.

Administrative fines

Administrative fines for non-compliance can be paid in instalments based on the business’s financial circumstances.

Transitional provisions

Actions taken under previous Regulations continue to be recognised under the new amendments.

Continuous improvement

The regulations emphasise that compliance is an ongoing process, and Responsible Parties are expected to continuously improve their processes and compliance status.