Auto Alpha AdvisoryThe Information Regulator has issued six administrative fines under POPIA since its enforcement powers began in 2021. I traced each one through the Regulator's own statements and the reporting on its August 2026 briefing. Every one followed an enforcement notice the party hadn't complied with. None was for a missing privacy notice, a cookie banner or a form without a consent box. By my count, about R200,000 has been paid in five years.
Most POPIA compliance pitches open with the maximum fine and a missing privacy notice, as if one leads to the other. The record doesn't support that. Below is how I read it as a CA(SA): what triggers a fine, and how likely that trigger is for a small business. It's general information from the public record, not legal advice.
Six fines, and each followed a notice the party didn't comply with
Two of the six were R5 million, and both went to government departments, according to ITWeb's report of the August briefing. The Department of Justice and Constitutional Development was fined in July 2023, and the Regulator's statement says the fine came "following its failure to comply with the Enforcement Notice". The Department of Basic Education was fined in December 2024 for not undertaking to keep matric results out of the newspapers. According to the Regulator's own 31 August 2026 media address, the High Court set aside its enforcement and infringement notices in December 2025 and refused leave to appeal in June 2026, and the Regulator has approached the Supreme Court of Appeal. That matter is still in the courts.
The other four ran from R100,000 to R500,000, according to ITLawCo's table of the briefing figures. They went to the Electoral Commission, Lancet Laboratories, FT Rams Consulting and Blouberg Local Municipality. ITWeb reports that the IEC and Lancet have paid. Blouberg didn't pay, and a court halved its fine. FT Rams didn't pay either, and the Regulator has gone to court to recover the fine. Those two payments are the whole of my total.
That pattern follows from how the Act is written. POPIA's section 109 lets the Regulator issue an infringement notice where a responsible party "is alleged to have committed an offence in terms of this Act". Breaching the conditions for processing personal information is not, on its own, one of those offences. Ignoring the Regulator is. Under POPIA's section 103, a responsible party that fails to comply with an enforcement notice "is guilty of an offence". The rest of the offence list covers things like obstructing the Regulator, lying in reply to an information notice and misusing account numbers, none of which a website does by accident. MJK's enforcement tracker reads the record the same way: every fine to date followed non-compliance with an enforcement notice.
So the R10 million that section 109 sets as the maximum is the ceiling for any offence under the Act, and every fine so far has been for defying the Regulator. A missing privacy notice doesn't carry that price.
The realistic path to a fine starts with a complaint
For a small business, the realistic path starts with a customer complaint. The Regulator's media address says it received over 3,800 complaints last year and that 10% of them concerned direct marketing. My read is that marketing email is the complaint a small business is most likely to face, because it's the privacy failure a customer sees in their own inbox.
FT Rams Consulting shows how it plays out. The Regulator's statement of 27 February 2024 describes one data subject's complaint about "countless direct marketing messages" that kept arriving after repeated attempts to opt out. The Regulator answered with an enforcement notice, its first over direct marketing, and gave the company 90 days to show compliance. The fine came later, once that notice had been ignored.
So the sequence runs: a complaint, then an enforcement notice with time to comply, then a fine only if the notice is ignored. Pansy Tlakula, who chairs the Regulator, described the limit at the August briefing: "once they comply, we cannot move forward with the fine," as ITWeb reported.
None of this is a reason to ignore POPIA. An enforcement notice is real work on a deadline. FT Rams had to stop the messages, give the Regulator an undertaking, build a database of people who had withheld consent and submit its design to the Regulator. The Regulator also named the company in a public statement. For a small business, the deadline and the publicity are the likely costs. The fine is the unlikely one.
Three tiers for any website compliance finding
I sort every website compliance finding into one of three tiers. The tier tells you when the cost arrives, which matters more than whatever severity label a scanner prints next to it.
Bites now. Something goes wrong without anyone deciding to act. An expired TLS certificate puts a browser warning between your visitors and your site. Email without SPF or DKIM gets filtered or refused. Google's sender guidelines tell everyone sending to Gmail to "Set up SPF or DKIM email authentication for your sending domains", and warn that mail which misses the requirements "might not be delivered as expected, or might be marked as spam". Anyone sending more than 5,000 messages a day has to set up DMARC as well. No regulator is involved, and the cost shows up this week.
Bites on incident. Harmless until a complaint, breach or dispute, at which point it's the cause or the evidence. Marketing email sent without consent is the FT Rams pattern. A form that collects personal information with no privacy notice falls short of POPIA's section 18, which requires reasonably practicable steps to make people aware of what is being collected and why. An online store missing the disclosures in section 43 of the ECT Act gives the buyer an exit. The ECT Act's section 43(3) reads: "If a supplier fails to comply with the provisions of subsection (1) or (2), the consumer may cancel the transaction within 14 days of receiving the goods or services under the transaction." Nobody checks those disclosures until a buyer wants their money back.
Paper only. A written rule with no enforcement record against a business this size. Keeping a printed PAIA guide at head office is one. Upgrading an email signing key from 1024 to 2048 bits is another, when Google's guidelines accept 1024 and only recommend 2048. A cookie banner is a third. I looked for enforcement against a business this size over any of these and found none. That doesn't prove none exists, only that I couldn't find any on the public record.
On 8 October I changed my own audit engine so that a paper-only finding can never be reported as a high-severity risk. A report that ranks a missing cookie banner alongside an expired certificate teaches you to spend in the wrong order.
There are two carve-outs. The first is a site that claims something false. A privacy notice saying you share data with no one, on a page running advertising trackers, is evidence waiting for a complaint. The second is that "paper only" describes regulatory exposure, and a paper-only finding can still be a real defect. A removed keyboard focus outline still loses a keyboard user, whether or not a regulator ever acts on it. Even the EU's European Accessibility Act exempts the smallest service firms: its Article 4(5) states that "Microenterprises providing services shall be exempt from complying with the accessibility requirements". The exemption takes the law off the table. The keyboard user who couldn't see where they were on your form still left.
What can a website check see from outside?
A check from outside the website can see the half of POPIA that faces your customers:
- whether a privacy notice exists, and whether it matches what the site actually does
- consent on forms that collect personal information
- marketing opt-outs
- tracking scripts, and whether the notice mentions them
It can't see the other half:
- operator contracts with the companies that process personal information for you
- how long you keep that information
- who inside the business can reach it
- whether your Information Officer is registered with the Regulator
A service that sells a website scan as POPIA compliance is selling the first half. The record shows the second half matters too. FT Rams got its notice over email a customer could see. The Department of Justice and Lancet got theirs over security failures that no website scan would show: lapsed security licences at the department, and breaches Lancet didn't report as section 22 requires.
Read your position the way the Regulator would
The Regulator works from complaints. It asks what you did about one, gives you a deadline, and fines you only if the deadline passes. So for each finding, two questions do most of the work: which tier is it in, and could you answer an enforcement notice about it on time?
Reading your regulatory position that way is part of The Full Read (from R25,000). For a free first look, the POPIA domain of the free scan covers the outside half. It's one of nine domains that run from security to AI readiness. The first call is 15 minutes.