In short: POPIA enforcement runs through a defined Chapter 10 pathway - complaint or own initiative, investigation, an information notice (a request, not a fine), the Enforcement Committee, and an enforcement notice under section 95. Failure to comply with that enforcement notice is usually what opens the section 109 administrative fine, which is capped at a fixed ten million rand, not a percentage of turnover. POPIA runs three separate consequence tracks: administrative (s109), criminal (sections 100 to 106, penalties on conviction under s107), and civil (s99). A responsible party has 30 days from receiving an information notice or enforcement notice to appeal it (section 97(1)), and a complainant has 180 days from receiving the result of an investigation (section 97(2)). An infringement notice allows 30 days from service to pay, arrange instalments or elect to be tried in court (section 109(2)(d)). The first POPIA administrative fine - R5 million against the Department of Justice and Constitutional Development in July 2023 - followed exactly this pathway.
A responsible party’s compliance lead opens an envelope from the Information Regulator. She reads the words “information notice” and her stomach drops. She calls the chief financial officer and says the Regulator has fined the company. Within the hour the board is convened, a provision is discussed, and someone asks whether they must pay ten percent of last year’s turnover. None of that is true. No fine has been issued. No turnover formula exists anywhere in South African law. What has actually landed on her desk is a request, not a penalty - and the difference between those two things is the difference between panic and a proportionate response.
Who the Regulator actually is
The Information Regulator is established under section 39 of POPIA as an independent body, subject only to the Constitution and the law, and accountable to the National Assembly. That independence matters, because enforcement decisions cannot be leaned on by a minister or a regulated party. Two features are worth holding onto. First, the Regulator has a dual mandate: it enforces both POPIA and the Promotion of Access to Information Act (PAIA). The same body that polices how you protect personal information also polices how you grant access to it. Second, it is a juristic person with its own powers, not a division of a government department. The correspondence it sends carries specific legal meaning depending on which power it is exercising - and knowing which power is in play is the whole game.
The pathway begins with a complaint
The enforcement ladder in Chapter 10 has a defined shape, and it almost never begins with a fine. It begins with information reaching the Regulator, either through a complaint lodged under section 74 by a data subject or any person, or through the Regulator acting on its own initiative. From there the Regulator may conduct a pre-investigation and then a full investigation, with real teeth at this stage: it can summon people, administer oaths, and require the production of records. But investigation is a fact-finding phase, not a punishment. The Act deliberately front-loads inquiry so that consequences, when they come, rest on established facts rather than assumption.
The information notice - not a fine
One of the Regulator’s early instruments is the information notice: a formal, written request compelling a responsible party to furnish specified information within a stated period. It is exactly what the opening scenario got wrong. An information notice is not a determination of guilt, it is not a fine, and it does not by itself impose any monetary liability. The correct response is to treat it seriously, meet the deadline, and answer completely - because failing to comply with a lawful notice is itself an offence - but the correct emotional register is composure, not crisis. A responsible party that understands the ladder reads an information notice as an invitation to demonstrate compliance, not as a sentence already passed.
The Enforcement Committee
Where a matter warrants it, the Regulator refers it to the Enforcement Committee, appointed under section 50, whose role is to consider matters referred to it and make recommendations to the Regulator. It is an important structural safeguard, because it separates the body that investigates from the body that weighs the evidence and recommends an outcome. The Committee does not itself issue the final instrument; it recommends, and the Regulator then acts. This deliberate distance between investigation, deliberation and the final enforcement step is what gives the process its procedural fairness.
The enforcement notice - the instrument that bites
The instrument that genuinely bites is the enforcement notice, issued under section 95. Acting on the Committee’s recommendation, the Regulator can direct a responsible party to take specified steps, or to stop doing something, within a set period - to cease a processing activity, to remediate a failure, or to comply with a condition it has breached. This is the operative order the earlier envelope only felt like. And here is the hinge point for consequences: failure to comply with an enforcement notice is usually what opens the door to the section 109 administrative fine. The fine does not usually fall from the sky on first contact. It tends to follow a failure to obey a binding order that itself followed investigation and recommendation.
Three tracks that do not mix
POPIA creates three distinct consequence tracks, and a given failure may attract one or more, but they operate on different logic. The administrative track under section 109 is the infringement notice and administrative fine that usually follow non-compliance with an enforcement notice. The criminal track, sections 100 to 106, creates actual offences - such as obstructing the Regulator, breaching confidentiality provisions, or failing to comply with a notice - prosecuted through the ordinary criminal courts, not imposed by the Regulator. The civil track under section 99 lets a data subject institute a civil action for damages for a breach, whether or not there was intent or negligence. Administrative, criminal, civil: three doors, three different keys. When you map a scenario, the first question is which door, or doors, the failure actually opens.
The section 109 fine and the fixed cap
Here is the correction that matters most for anyone trained on European rules. Under section 109, when a responsible party fails to comply, the Regulator may issue an infringement notice with an administrative fine - and that fine is capped at a fixed rand figure, a maximum of ten million rand. It is not a percentage of turnover. There is no “ten million rand or ten percent of annual turnover, whichever is greater” formula in South African law; that construction is imported straight from the GDPR and is simply wrong here. So when a board asks what the maximum administrative exposure is, the honest, precise answer is a fixed statutory ceiling, not a turnover-linked number that could balloon without limit.
Penalties on conviction
The criminal side stays distinct. Section 107 sets the penalties a court may impose on conviction for the offences in sections 100 to 106, in two bands: a more serious band carrying a fine or imprisonment for a period not exceeding ten years, or both, and a lesser band carrying a fine or imprisonment for a period not exceeding twelve months, or both. Which band applies depends on which offence was committed. The crucial discipline is never to describe these as something the Regulator hands down. The Regulator does not convict anyone - criminal liability runs through the prosecuting authority and the courts. The Regulator’s own monetary instrument is the administrative fine under section 109.
The time limits
Timing needs the same precision. Section 97 governs the right of appeal to the High Court, and it sets two different clocks that must never be conflated. A responsible party on whom an information notice or an enforcement notice has been served has 30 days from receiving it to appeal against that notice (section 97(1)). A complainant who has been informed of the result of the investigation has 180 days from receiving the result to appeal against it (section 97(2)). Notice the asymmetry: 30 days for the responsible party, 180 days for the complainant. An infringement notice under section 109 runs on a third clock, which is not an appeal: the notice must tell the person that, not later than 30 days after it is served, they may pay the administrative fine, make arrangements to pay it in instalments, or elect to be tried in court (section 109(2)(d)). If you take one operational fact into your diary system, make it this: the moment a notice lands, a 30-day clock starts.
What precision buys you
The first administrative fine under POPIA is a useful anchor for all of this. It was issued to the Department of Justice and Constitutional Development - five million rand, in July 2023 - following exactly this kind of failure to comply with an enforcement notice. Precision here is not pedantry. It is the difference between advising a board to provision for a phantom turnover-percentage penalty and advising it to answer an information notice on time; between missing a 30-day appeal window and preserving your organisation’s rights. Carry the pathway, hold the fixed cap, keep the three tracks apart, and watch the time limits - and the next envelope that lands on your desk will not produce panic. It will produce a plan.
Would an information notice find you ready?
The free POPIA Compliance Assessment helps your organisation gauge how well it could answer the Information Regulator - before an envelope arrives. No email required to start. Enrolment in Celagenix® Academy unlocks the full learning unit this article is drawn from.
Take the free POPIA Compliance Assessment →Frequently asked questions
No. An information notice is a formal written request compelling a responsible party to furnish specified information within a stated period. It is not a determination of guilt, not a fine, and it imposes no monetary liability by itself. It should be answered fully and on time - failing to comply with a lawful notice is itself an offence - but it signals a fact-finding stage, not a penalty.
No. Under section 109 the administrative fine is capped at a fixed maximum of ten million rand. There is no “ten million rand or a percentage of annual turnover, whichever is greater” formula in South African law - that construction is imported from the GDPR and does not apply to POPIA.
Usually after a defined pathway: a complaint under section 74 or the Regulator acting on its own initiative, investigation, referral to the Enforcement Committee (section 50), and an enforcement notice under section 95. Failure to comply with that enforcement notice is usually what opens the section 109 administrative fine - the fine does not usually arise on first contact.
Administrative (section 109 infringement notice and fine, usually following non-compliance with an enforcement notice); criminal (offences in sections 100 to 106, with penalties on conviction under section 107 of up to ten years or twelve months imprisonment depending on the band, imposed by the courts, not the Regulator); and civil (section 99, a data subject’s action for damages, with or without intent or negligence). A single failure may open one or more of these doors.
A responsible party on whom an information notice or enforcement notice has been served has 30 days from receiving it to appeal to the High Court (section 97(1)). A complainant who has been informed of the result of the investigation has 180 days from receiving the result to appeal to the High Court (section 97(2)). An infringement notice under section 109 is a different clock: it must tell the person that, not later than 30 days after it is served, they may pay the administrative fine, make arrangements to pay it in instalments, or elect to be tried in court (section 109(2)(d)).