Skip to content
- A member of the Regulator or a person referred to in section 49(1)(b) or 50(1)(b) who is not subject to the provisions of the Public Service Act, 1994 (Proclamation No. 103 of 1994), or who is not a judge of the High Court of South Africa or a magistrate will be entitled to such remuneration, allowances, including allowances for reimbursement of travelling and subsistence expenses incurred by him or her in the performance of his or her functions under this Act and the Promotion of Access to Information Act, benefits and privileges as the Minister in consultation with the Minister of Finance may determine.
- The remuneration, allowances, benefits or privileges of different members of the Regulator may differ according to the different
- positions held by them in the Regulator; or
- functions performed, whether in a part-time or full-time capacity, by them from time to time.
- Information processing as contemplated in section 57(1) must be notified as such by the responsible party to the Regulator.
- Responsible parties may not carry out information processing that has been notified to the Regulator in terms of subsection (1) until the Regulator has completed its investigation or until they have received notice that a more detailed investigation will not be conducted.
- In the case of the notification of information processing to which section 57(1) is applicable, the Regulator must inform the responsible party in writing within four weeks of the notification as to whether or not it will conduct a more detailed investigation.
- In the event that the Regulator decides to conduct a more detailed investigation, it must indicate the period within which it plans to conduct this investigation, which period must not exceed 13 weeks.
- On conclusion of the more detailed investigation referred to in subsection (4) the Regulator must issue a statement concerning the lawfulness of the information processing.
- A statement by the Regulator in terms of subsection (5), to the extent that the information processing is not lawful, is deemed to be an enforcement notice served in terms of section 95 of this Act.
- A responsible party that has suspended its processing as required by subsection (2), and which has not received the Regulator’s decision within the time limits specified in subsections (3) and (4), may presume a decision in its favour and continue with its processing.
- The Regulator may from time to time issue codes of conduct.
- A code of conduct must—
- incorporate all the conditions for the lawful processing of personal information or set out obligations that provide a functional equivalent of all the obligations set out in those conditions; and
- prescribe how the conditions for the lawful processing of personal information are to be applied, or are to be complied with, given the particular features of the sector or sectors of society in which the relevant responsible parties are operating.
- A code of conduct may apply in relation to any one or more of the following:
- Any specified information or class of information;
- any specified body or class of bodies;
- any specified activity or class of activities; or
- any specified industry, profession, or vocation or class of industries, professions, or vocations.
- A code of conduct must also—
- specify appropriate measures—
- for information matching programmes if such programmes are used within a specific sector; or
- for protecting the legitimate interests of data subjects insofar as automated decision making, as referred to in section 71, is concerned;
- provide for the review of the code by the Regulator; and
- provide for the expiry of the code.
- If a responsible party is alleged to have committed an offence in terms of this Act, the Regulator may cause to be delivered by hand to that person (hereinafter referred to as the infringer) an infringement notice which must contain the particulars contemplated in subsection (2).
- A notice referred to in subsection (1) must—
- specify the name and address of the infringer;
- specify the particulars of the alleged offence;
- specify the amount of the administrative fine payable, which amount may, subject to subsection (10), not exceed R10 million;
- inform the infringer that, not later than 30 days after the date of service of the infringement notice, the infringer may—
- pay the administrative fine;
- make arrangements with the Regulator to pay the administrative fine in instalments; or
- elect to be tried in court on a charge of having committed the alleged offence referred to in terms of this Act; and
- state that a failure to comply with the requirements of the notice within the time permitted, will result in the administrative fine becoming recoverable as contemplated in subsection (5).
- When determining an appropriate fine, the Regulator must consider the following factors:
- the nature of the personal information involved;
- the duration and extent of the contravention;
- the number of data subjects affected or potentially affected by the contravention;
- whether or not the contravention raises an issue of public importance;
- the likelihood of substantial damage or distress, including injury to feelings or anxiety suffered by data subjects;
- whether the responsible party or a third party could have prevented the contravention from occurring;
- any failure to carry out a risk assessment or a failure to operate good policies, procedures and practices to protect personal information; and
- whether the responsible party has previously committed an offence in terms of this Act.
- If an infringer elects to be tried in court on a charge of having committed the alleged offence in terms of this Act, the Regulator must hand the matter over to the South African Police Service and inform the infringer accordingly.
- If an infringer fails to comply with the requirements of a notice, the Regulator may file with the clerk or registrar of any competent court a statement certified by it as correct, setting forth the amount of the administrative fine payable by the infringer, and such statement thereupon has all the effects of a civil judgment lawfully given in that court in favour of the Regulator for a liquid debt in the amount specified in the statement.
- The Regulator may not impose an administrative fine contemplated in this section if the responsible party concerned has been charged with an offence in terms of this Act in respect of the same set of facts.
- No prosecution may be instituted against a responsible party if the responsible party concerned has paid an administrative fine in terms of this section in respect of the same set of facts.
- An administrative fine imposed in terms of this section does not constitute a previous conviction as contemplated in Chapter 27 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977).
- A fine payable in terms of this section must be paid into the National Revenue Fund referred to in section 213 of the Constitution.
- The Minister may, from time to time and after consultation with the Regulator, by notice in the Gazette, adjust the amount referred to in subsection (2)(c) in accordance with the average of the consumer price index, as published from time to time in the Gazette, for the immediately preceding period of 12 months multiplied by the number of years that the amount referred to in subsection (2)(c) has remained the same.
