On 5 August 2026, Parliament's Portfolio Committee on Justice and Constitutional Development opened a call for nominations to the Information Regulator. The notice covers three posts, two full-time and one part-time, each for five years. Nominations closed on 31 August 2026. The current members' terms run out on 30 November 2026. Whoever fills the seats takes over the body that enforces the Protection of Personal Information Act (POPIA), with several unfinished matters on its desk.
The case for a hard-nosed regulator
The argument for aggressive enforcement is strong and should be stated fairly. POPIA is a young statute, and compliance habits form in the first years of enforcement. A regulator that is slow or timid signals to every company that breach notification is optional. Large breaches are also hard to investigate from outside, because victims cannot see how their data was handled. An institution that holds the power to demand information is the only party that can find out.
The Regulator has used that power. After Standard Bank told it about a data compromise on 23 March 2026, TechCentral reported that the Regulator sent the bank a notice asking for more information so it could carry out an assessment. A spokesman described it in those terms. That is the proper first step: notification, a request for facts, then an assessment. It is also still only a first step, and I could find no published outcome.
What the next members actually inherit
The appointment mechanics are set by statute. Section 41 of POPIA provides for terms of not more than five years, with members eligible for reappointment. The President appoints on the recommendation of the National Assembly, which acts on a committee's nominations and needs a majority vote. The call also requires at least one member with experience as a practising advocate or attorney or as a law professor, a sensible requirement for a body that increasingly litigates its own decisions.
The pending docket has three features worth noting.
- Investigations that run longer than a single term. The Truecaller complaint, over crowdsourced spam labelling and address-book uploads, has been publicly reported since mid-2025. I found no published finding. Slow investigations are not necessarily bad ones, but they leave businesses and consumers without a reading of the law for a long time.
- Breach assessments that need a visible end point. The Standard Bank assessment is the largest recent test of whether notification leads to a published, reasoned result. Regulated entities can only calibrate their security spending if the Regulator explains what counted as adequate.
- An appeal that questions the Regulator's reading of POPIA. This is the one with the largest consequences.
The matric appeal is the real test
In December 2025 a full bench ruled that matric results can be published using examination numbers, over the Regulator's objection. The Gauteng High Court in Pretoria then refused the Regulator leave to appeal. As IOL reported, the Regulator has applied directly to the Supreme Court of Appeal. The court has yet to decide whether to hear it, and AfriForum has said it will oppose the application.
The Regulator's position is that examination numbers are still personal information, so publishing them is processing under POPIA. That is a defensible reading of a broad definition. But two courts have now looked at the practical question and found the identification risk too remote to justify restricting a long-standing public practice. A regulator that keeps appealing a case where the department says it has never received a complaint of harm risks spending credibility it needs elsewhere.
This is where the pro-innovation, proportionate-regulation view applies. A privacy law works best when the regulator concentrates on cases of demonstrable harm: breaches that expose financial identity data, apps that harvest the contacts of people who never agreed, and organisations that conceal compromises. The Standard Bank incident reportedly exposed names, ID numbers and account details. That is the sort of case where enforcement protects people. Publishing a list of exam numbers is not.
What the appointment process should deliver
Parliament has promised that redacted CVs will be published for public comment and that shortlisted candidates will be screened. That transparency is welcome. Three things would make the process more useful.
- Questions on enforcement priorities. Candidates should be asked how they would rank harm-based cases against definitional disputes, and what they would do about the backlog of open complaints.
- A commitment to published reasoning. Closing a Truecaller-type investigation, with findings, would do more for legal certainty than a dozen general guidance notes. Companies and developers building in South Africa need predictable rules.
- Continuity. Five-year terms with eligibility for reappointment can preserve institutional memory, but replacing a large share of the membership at once puts that memory at risk. Parliament should check that open matters have owners who stay.
South Africa's data protection regime is better for having an independent regulator that is accountable to the National Assembly, and nothing here argues for weakening it. The argument is about focus. Credibility rests on resolving harm-based cases quickly and explaining decisions clearly. Whether the incoming members choose to clear the breach and complaint backlog or keep contesting every definitional question will shape how much trust the regime earns from both citizens and the businesses that must comply.
What to watch
Three things are worth tracking: the shortlist and public comment period, whether the Supreme Court of Appeal agrees to hear the matric case, and whether the Standard Bank assessment ends in a published finding. The answers will show whether the new Regulator inherits a backlog or clears it.