POPIA Security Concerns: South Africa’s Information Regulator Issues WhatsApp Enforcement Notice for Privacy Compliance

The Information Regulator has found that the Electoral Commission of South Africa (IEC) does not have adequate access control measures to protect the confidentiality of personal information (Popia) in its possession.

This development has caused InfoReg to issue the messaging app, WhatsApp, with an enforcement notice.

InfoReg Acts Against Potential Popia Breaches

This comes after the data privacy enforcer’s preliminary report found WhatsApp applies different terms of service and privacy policies for European users compared to those outside Europe, including South African users.

Also read: WhatsApp New Status Video Limit and Other Latest WhatsApp Updates 2025

Note, that the regulator has gone ahead to issue enforcement notices against the IEC, WhatsApp LLC, Blouberg municipality, and Lancet Laboratories after it probed into possible breaches of the Protection of Personal Information Act (Popia).

InfoReg chairperson advocate Pansy Tlakula confirmed this and said, “Since April, the regulator has issued four enforcement notices. The other notices were issued to the Electoral Commission, Blouberg Municipality, and Lancet Laboratories.”

She also emphasized the “very lengthy” and “complex” nature of the matter involving WhatsApp.

Also Read: South Africa’s Telkom Set to Sell its over $350 Million Mast and Tower Business to UK-based Actis

She said: “The privacy safeguards for users in the European region appeared to be better than those for users in South Africa, even though the General Data Protection Regulations (GDPR) and POPIA have similar standards and protections.”

Regulators To Issue Heavy Penalties To Defaulters

The regulator’s executive for Popia, Tshepo Boikanyo, said where there is noncompliance with the enforcement notice, the regulator can issue an infringement notice which carries a penalty of imprisonment or a fine of up to R10m.

“Where the information regulator has issued a notice, there will be certain directives in that enforcement notice, and the responsible party will then be afforded the particular time frame through which to compile with those directives.

Also read: How to Secretly Tag People on WhatsApp Status (Easy Guide)

“If the responsible party does not comply with those directives after the period has expired, we may issue an infringement notice and can impose a fine,” said Boikanyo.

Inforeg is also investigating complaints made against social media companies X, Meta, and Google over South Africa’s recent general elections.

The regulator accepted the complaints, and all three are under investigation.

Interested in reading more? Interact with us here:

Facebook: Silicon Africa.
Instagram: Siliconafricatech.
Twitter: @siliconAfriTech