For the first few years since the Protection of Personal Information Act 4 of 2013 (“POPIA”) became fully enforceable on 1 July 2021, most SMEs have treated POPIA compliance as something for banks, big corporates and government departments to worry about.
That is no longer a safe assumption.
The Information Regulator has increasingly moved from education to enforcement – and smaller businesses are firmly within its sights. Notably, its first fine for a direct-marketing contravention was imposed not on a listed corporation, but on a small training consultancy.
At its November 2025 media briefing, the Regulator reported 2,374 security compromise notifications for the 2024/25 financial year, an average of nearly 200 breaches a month, with reported incidents rising a further 40% in the months that followed. Given this, and with amended POPIA Regulations in force since 17 April 2025, the message for SMEs should be pretty simple:
Data protection compliance is not “nice to have” or even a once-off box-ticking exercise. It needs to form part of how your business actually operates.
The good news? The fundamentals are practical and achievable.
The POPIA Essentials Every SME Should Have on Its Radar
1. Register Your Information Officer
Every organisation has an Information Officer by default – typically the owner, managing director or CEO.
That person must be registered with the Information Regulator before performing their Information Officer duties. The registration can be completed through the Regulator’s eServices portal or the CIPC BizPortal.
This remains a common compliance gap among SMEs, but it is becoming harder to ignore. Businesses that have not registered may be publicly flagged, making their compliance status visible to banks, investors and counterparties.
2. Have a PAIA Manual and File the Annual Report
The exemption that once spared most small businesses from keeping a manual under the Promotion of Access to Information Act (“PAIA”) ended on 31 December 2021. Every private body, including sole proprietors, must now have a PAIA manual, and the Regulator has published templates that make this a manageable exercise.
There is also an annual reporting obligation. The submission window runs from 1 April to 30 June each year through the Regulator’s eServices portal, and the Regulator does not grant extensions. Even a business that received no access requests must submit a nil report. The most recent window closed on 30 June 2026, and the portal does not accept late submissions once it closes, so a business that missed the deadline cannot simply file late. It carries the compliance gap until the next cycle, and non-submission exposes it to an own-initiative compliance assessment by the Regulator under section 77H of PAIA, which can involve a physical inspection and a review of the business’ compliance documentation.
If your business is in this position, your most practical approach would be to do three things now.
- Confirm that your Information Officer’s registration on the eServices portal is valid and current, since a missing or lapsed registration is the most common reason submissions fail and it blocks the next filing too.
- Put your house in order for a possible assessment: an up-to-date PAIA manual and a register of access requests received, even a nil register, to demonstrate a functioning compliance framework.
- Diarise 1 April 2027 and submit early in the window rather than in the final days of June.
3. Put Operator Agreements in Place
Does your payroll provider, IT company, cloud provider, email-marketing platform or another supplier process personal information on your behalf?
If so, that provider is an “Operator” under POPIA.
Sections 20 and 21 require appropriate written contractual safeguards dealing with how that information is protected. Importantly, outsourcing the processing does not mean outsourcing your accountability.
The absence of an operator agreement was a specific finding against Dis-Chem following its 2022 breach, which exposed roughly 3,6 million records.
4. Get Direct Marketing Right
Direct marketing remains an area where businesses can easily get themselves into trouble.
Section 69 regulates electronic direct marketing, including email, SMS and automated calls. Broadly, marketing may be permitted where the recipient has consented or, in certain circumstances, where an existing customer’s details were obtained through a previous sale of similar goods or services and appropriate opt-out opportunities are provided.
For prospective customers, the rules are more restrictive. Non-customers may be approached only once to ask for consent, using the prescribed form.
The Regulator’s Guidance Note also takes the position that live telephone marketing falls within electronic communications requiring opt-in consent. That view is contested by the direct marketing industry and is headed for judicial determination, but until the courts rule, the cautious course is to treat telemarketing as consent-based, and to record marketing calls as the amended Regulations require.
The practical takeaway?
Know where your marketing lists came from, respect opt-outs immediately and don’t assume that having someone’s contact details means you can market to them.
5. Protect the Information You Hold – and Know What to Do If Something Goes Wrong
POPIA requires businesses to put appropriate and reasonable technical and organisational safeguards in place.
Depending on the business, that can include things like:
- access controls;
- appropriate password practices;
- monitoring;
- encryption where suitable; and
- staff awareness and training.
And if you have reasonable grounds to believe that personal information has been accessed by an unauthorised person, POPIA imposes notification obligations to the Regulator and affected data subjects as soon as reasonably possible.
Importantly, a breach itself does not automatically mean you have broken the law. The quality of your safeguards and how you respond to the incident matter enormously.
6. Don’t Forget About Cross-Border Transfers
Using overseas cloud services, software providers or suppliers can mean that personal information is being transferred outside South Africa.
Section 72 regulates these transfers and requires an appropriate legal basis. One common mechanism is a binding agreement requiring the overseas recipient to provide an adequate level of protection.
For SMEs using global SaaS and cloud tools, this is an area worth checking rather than assuming the service provider has dealt with everything for you.
What Recent Enforcement Actually Tells SMEs
One of the clearest lessons from recent enforcement is that a data incident does not necessarily result in a fine.
How the organisation responds – particularly to the Information Regulator – can be critical.
The first administrative fine, R5 million against the Department of Justice and Constitutional Development in July 2023, arose from a 2021 ransomware attack, but was imposed because the department failed to prove within the stipulated period that it had renewed the security software licences the enforcement notice required.
By contrast, Dis-Chem and TransUnion complied with remedial directions following high-profile breaches and avoided administrative fines altogether.
And the examples most relevant to SMEs are often much less dramatic:
- FT Rams Consulting, a training business, was fined R100,000 following unsolicited marketing emails, failures to honour opt-outs and subsequent non-compliance with an enforcement notice. The Regulator has since instituted court proceedings to recover the unpaid fine, warning that continued non-compliance could attract a fine of up to R10 million or imprisonment of up to 10 years.
- Lancet Laboratories was fined R100,000 for failing to notify security compromises.
- Blouberg Municipality was fined R500,000 following the online exposure of a former employee’s personal information.
None of those examples required a Hollywood-style cyberattack.
They involved ordinary business conduct: marketing lists, breach paperwork, and information carelessly published.
That is exactly why SMEs should pay attention.
Your SME POPIA Checklist
So, where should you start?
Ask yourself:
- Is our Information Officer properly registered?
- Do we have an up-to-date PAIA Manual?
- Have we diarised our PAIA annual reporting obligations?
- Do we actually know what personal information our business collects and why?
- Do we know which suppliers process personal information for us?
- Are appropriate Operator Agreements in place?
- Have we dealt with overseas data transfers where relevant?
- Are our direct-marketing practices compliant?
- Do we have appropriate retention periods for the information we hold?
- Would our team know what to do if we suffered a data breach?
If several of those answers are “no” or “I’m not sure”, that is probably where your compliance work should start.
And if the Regulator ever comes knocking, engage. Every fine imposed to date has punished silence and non-compliance with enforcement notices, not the underlying incident. POPIA compliance is not beyond the reach of a small business, but ignoring the Regulator now carries a price that no small business can afford.
The Bottom Line
POPIA compliance does not need to become an enormous legal project for every SME.
But it does need to become part of the way you run your business.
Getting the fundamentals right helps reduce regulatory and liability risk, but good data practices also help build trust with the clients, users and commercial partners who hand their information over to you.
Start with the basics. Implement them properly. And let the framework develop as your business – and its use of personal information – becomes more sophisticated.
Need Some Help Getting There?
Lay Law offers fixed-fee Data Protection and PAIA compliance packages designed around different levels of processing, scale, complexity and involvement – from essential public-facing compliance through to more comprehensive internal frameworks.
If you’re unsure where your business currently stands, we can help you identify the most appropriate next steps.
AuthorJocelyn Bloomer
