Most security failures are told as stories about attackers. The more useful story is usually about the months before the attacker arrived: the licence that lapsed, the alert nobody owned, the renewal that waited for a budget approval that never came. By the time the incident happens, the control had already stopped being a control. It was a line in an asset register describing something that used to work.
The Information Regulator's fine against the Department of Justice and Constitutional Development, reported at the time as the first under the Protection of Personal Information Act, is a public example of that pattern, and of a second one that matters just as much. The fine was not imposed for the original incident. It was imposed because, according to the Regulator, the order that followed the incident was not complied with in time.
CloudNala's view is that a security safeguard includes everything needed to keep it running and to prove that it is running: an owner, a renewal path, health monitoring, escalation and evidence. And once a regulator issues an order, remediation is no longer ordinary operational work. It is an obligation with a deadline, an accountable executive and an evidence pack.
This series is general information about running privacy controls in production systems, not legal advice. This part discusses a matter that, on the public record we could find, is still in dispute. Read the primary sources, check the current position and take advice from a qualified legal practitioner before relying on any interpretation.
Parts 1 to 6 of POPIA in Production followed a fictional lender. Parts 7 and 8 examine real, public enforcement matters. We describe only what the published record says, attribute each fact to its source, and avoid any judgement about the people involved.
What the public record says
The Regulator's media statement of 4 July 2023 sets out the core sequence:
- On 9 May 2023 the Regulator issued an enforcement notice to the Department of Justice and Constitutional Development, following a finding that it had contravened various sections of POPIA.
- The notice required the department to submit proof, within 31 days of receipt, that its Trend anti-virus licence, its SIEM licence and its intrusion detection system licence had been renewed. It also required disciplinary proceedings against the official or officials who failed to renew the licences, which the statement describes as "necessary to safeguard the department against security compromises".
- The 31 days expired on 9 June 2023. The Regulator said it had received no implementation report "or any other communication in that regard", and that the department had not exercised its right of appeal under section 97(1).
- On 3 July 2023 the Regulator issued an infringement notice and an administrative fine of R5 million for failure to comply with the enforcement notice.
The background was a ransomware attack on the department's systems in 2021, which ITWeb reported had compromised at least 1,200 files containing personal information. In October 2023 the department announced that it would take the fine on review. The Mail & Guardian reported that the department maintained there was no proof that personal information was lost, damaged or otherwise compromised, and that the then Justice Minister was understood to regard the Regulator's timeframe as unreasonable. The department's director-general acknowledged to Parliament's justice committee that the appeal deadline had been missed, which he attributed to a staff error.
In September 2026, BusinessTech reported that the Regulator had recently confirmed the fine remained in dispute. We found no court judgment on the review. So the fine and the findings behind it should not be described as final.
The licence is part of the safeguard
Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. It then spells out what that involves: identify reasonably foreseeable internal and external risks, establish and maintain appropriate safeguards against them, regularly verify that the safeguards are effectively implemented, and ensure they are continually updated.
Read as an engineer, the important verbs are maintain, verify and update. An anti-virus engine whose licence has lapsed may still be installed. It may still appear on the architecture diagram and in the asset register. But it is no longer maintained, and if nobody checks it, nobody can verify that it works.
This is why we say the governance failure starts earlier than the incident. Long before any attacker arrives, a security control depends on a quiet chain of administrative facts:
- someone knows the control depends on a licence, certificate, key or subscription;
- someone knows when it expires;
- someone owns the renewal, and the budget for it is approved before the expiry date rather than after;
- something shows, continuously, that the control is running and covering what it should cover; and
- when any of that fails, an alert reaches someone with the authority to act.
None of those links is a security product. All of them are needed for the product to be a safeguard. Organisations that buy well and renew badly have, in effect, bought a control with a hidden expiry date.
Four questions that find the gap before an attacker does
The same pattern shows up in private and public organisations, in large estates and small ones. Four questions find most of it.
Which safeguards depend on something that expires? Licences are the obvious case. Certificates, API keys, support contracts, threat-intelligence feeds, backup-storage subscriptions and managed-detection contracts all expire too. The inventory needs the expiry date, the owner, and the systems and personal information each safeguard protects, so that a lapse can be ranked by what it exposes.
Who owns the renewal, and when is it approved? "IT" is not an owner. The owner is a named person with a deputy, and the renewal approval sits on a timeline that finishes well before expiry, because public procurement and many corporate approval processes take months. A renewal that depends on an approval meeting the week after expiry is already late.
How would we know the control has stopped working? A lapsed licence often fails silently: signatures stop updating, a SIEM stops ingesting a source, an agent stops reporting. Control-health telemetry, such as the time since the last signature update, the share of endpoints reporting and the sources ingested per day, turns a silent failure into an alert. The technology health check approach applies here: look for evidence that the control ran, not a statement that it exists.
Who hears about it, and when? Alerts at 90, 30 and 7 days before expiry, routed to the owner and then to an executive, cost almost nothing. A lapse that goes unnoticed is a monitoring failure. A lapse that is noticed and allowed to happen is a risk acceptance, and it should be recorded as one, with a name against it.
After the order: remediation is an obligation with a clock
The second lesson is less technical and, on the Regulator's account, it is where the R5 million came from. An enforcement notice is not an ordinary ticket. Under POPIA it carries specified steps, a deadline and a 30-day window to appeal under section 97. Failing to comply with it is an offence under section 103, and section 109 lets the Regulator deal with that offence by way of an administrative fine of up to R10 million.
Whatever the outcome of the review, the sequence shows how easily an order can fall between the people who receive it and the people who would have to act on it. Legal receives the notice. The fix belongs to technology. The disciplinary step belongs to human resources. The budget belongs to finance. The deadline belongs to everyone, which in practice means no one. The Basic Education matter in Part 8 shows the same pressure on a different clock: there, the court had to decide whether to condone an appeal served six days late.
A regulatory order needs the same treatment as any other high-severity obligation:
- Register it on the day it arrives. Record the order, each required action, the deadline for each, the appeal deadline and the accountable executive. The appeal decision itself has a deadline and needs an owner.
- Split it into owned work. Each required step becomes a tracked action with a named owner and a due date well before the regulatory deadline, so there is time to assemble proof.
- Decide early whether to comply, appeal or seek more time. Any of these can be legitimate. Silence is not. If the organisation believes a timeframe is unreasonable, the record should show when it said so and to whom.
- Build the evidence pack as the work happens. The regulator asked for proof, not assurance. Renewal invoices, configuration exports, health telemetry and the record of disciplinary steps taken are what "proof" means.
- Close it independently. Someone who did not do the work confirms that it is complete and sustainable, and the closure is recorded. The difference between an audit finding and a corrective action applies directly: a status update is not closure.
Fix the control, and be careful with blame
The enforcement notice required disciplinary proceedings against the officials who failed to renew the licences. Individual accountability has a place. But Part 6 argued that a review ending in a name has not finished its work, and the same applies here. If a single official's oversight can disable three security controls at once, the design depended on that person never being absent, overloaded or underfunded. The lasting fix is the inventory, the renewal path, the telemetry and the escalation, so the next person in the same seat cannot fail in the same way.
What this means for AI systems
AI features add more things that expire and more places where a lapse goes unseen. Model and API keys rotate. Content-safety and data-loss-prevention services are licensed. Guardrail configurations depend on a vendor subscription. Evaluation suites stop running when a pipeline credential expires, and nothing turns red because nothing is running. If a safeguard protects personal information flowing through prompts, retrieval or traces, it belongs in the same inventory, with the same owner, expiry and health signal as the anti-virus engine. Classifying incidents in advance also matters more when the first sign of a lapse is a model behaving differently.
Start this week
- List every security safeguard that depends on something that expires, with its expiry date and a named owner. Start with anything protecting systems that hold personal information.
- Add one health signal per critical safeguard that turns a silent failure into an alert, and test it by checking what you would see today.
- Write down how a regulator's order would be registered, who owns the appeal decision, and how its deadlines reach the people who have to act.
Next: Part 8, Is an examination number personal information? It depends on identifiability. All parts are on the series page.
How CloudNala can help
CloudNala reviews the security safeguards that protect personal information as running systems rather than purchased products. We build the inventory of what expires, check control-health evidence against live telemetry, design renewal and escalation paths that finish before the deadline, and set up an obligation register that turns a regulator's order into owned, dated, evidenced work. We work alongside your information officer and legal advisers, who remain responsible for legal positions and engagement with the Regulator.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a POPIA Controls Review or write to us at consult@cloudnala.co.za