Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

South Africa: Regulator assesses Department of Basic Education for POPIA compliance

The Information Regulator ('the Regulator') published, on 24 November 2022, a media statement in which it welcomed action taken by the Department of Basic Education ('DBE') to align its processes on the publication of matric results with the requirements of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA'), notably Section 11(1)(a) of POPIA, but clarified that it will conduct a full compliance assessment of the DBE's policies and practices.

Background to the investigation

In particular, the Regulator noted that it met with the DBE to resolve matters following uncertainty on the implications of compliance with POPIA on publishing matric 2021 results on various mediums. Furthermore, the Regulator determined the DBE to be a responsible party and, as such, empowered to decide on the approach to issue or publish the matric results.

Findings of the Regulator

Accordingly, the Regulator provided guidance to the DBE regarding obtaining consent in line with Section 11(1)(a) of POPIA, after which the DBE issued a consent form to approximately 900,000 matriculants, which the Regulator found not to be compliant with POPIA as the form was not purpose-specific and did not allow the data subject to consent, not consent, or withdraw consent to each area requiring the processing of their personal information.


Following its investigation, the Regulator noted that the DBE had revised its consent form and that the Regulator will embark on a full compliance assessment of the DBE's policies and practices on the processing of personal information, launched on its own initiative under Section 89 of POPIA.

You can read the media statement here.