Enforcement notice
(1) If the Regulator, after having considered the recommendation of the Enforcement Committee in terms of section 93, is satisfied that a responsible party has interfered or is interfering with the protection of the personal information of a data subject as referred to in section 73, the Regulator may serve the responsible party with an enforcement notice requiring the responsible party to do either or both of the following: (a) To take specified steps within a period specified in the notice, or to refrain from taking such steps; or (b) to stop processing personal information specified in the notice, or to stop processing personal information for a purpose or in a manner specified in the notice within a period specified in the notice.
(2) An enforcement notice must contain— (a) a statement indicating the nature of the interference with the protection of the personal information of the data subject and the reasons for reaching that conclusion; and (b) particulars of the rights of appeal conferred by section 97.
(3) Subject to subsection (4), an enforcement notice may not require any of the provisions of the notice to be complied with before the end of the period within which an appeal may be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.
(4) If the Regulator considers that an enforcement notice should be complied with as a matter of urgency it may include in the notice a statement to that effect and a statement of its reasons for reaching that conclusion, and in that event subsection (3) does not apply.
(5) A notice in terms of subsection (4) may not require any of the provisions of the notice to be complied with before the end of a period of three days beginning with the day on which the notice is served.
What this means for your board
- An enforcement notice can require your estate to take specified steps, refrain from certain steps, or stop a specific kind of processing altogether, within a set deadline (subsection (1)), this is the Regulator's core compulsion power, and it names the trustees/board as the responsible party who must act.
- Subsection (2)(a) means the notice must explain exactly what interference was found and why, read that reasoning closely, since it's also the basis for any appeal under s.97.
- Subsections (3)-(5) mirror s.90's timing rules: compliance generally isn't required until the appeal window passes, unless urgency is invoked, in which case at least three days is still guaranteed.
The free POPIA Compliance Status Assessment helps you see whether you could mount a defensible, minuted response to a s.95 enforcement notice, the kind of governance record that matters if the notice is ever contested or referenced later.