Parties to be informed of result of assessment
(1) After completing the assessment referred to in section 89 the Regulator— (a) must report to the responsible party the results of the assessment and any recommendations that the Regulator considers appropriate; and (b) may, in appropriate cases, require the responsible party, within a specified time, to inform the Regulator of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken.
(2) The Regulator may make public any information relating to the personal information management practices of a responsible party that has been the subject of an assessment under this section if the Regulator considers it in the public interest to do so.
(3) A report made by the Regulator under subsection (1) is deemed to be the equivalent of an enforcement notice in terms of section 95.
What this means for your estate
- After an assessment, the Regulator reports its findings and any recommendations to your estate, and can require you to report back on what action you've taken or plan to take (subsection (1)), treat the recommendations as a real to-do list, not just feedback.
- Subsection (2) means the Regulator can make the assessment findings about your estate's information-handling practices public if it considers that in the public interest, a real reputational stake in how the underlying practices actually look, not just a private compliance matter.
- Subsection (3) means an unfavourable report carries the same weight as a formal enforcement notice under s.95, it's not merely advisory.
PopiGuard's Task Manager converts s.91(1) recommendations into tracked, closed-out actions, the exact record you'd want if the same practices are ever assessed again.