Guest article
Philani Mdingi - Executive Director Tech4Good

On 31 August 2026, South Africa's Information Regulator marked its tenth anniversary with a media briefing that should have every NPO and NGO leader in the country paying attention. According to a detailed account of that briefing published by Werksmans Attorneys, the Regulator's message was blunt. The era of soft enforcement is over.

For a decade, the Regulator has been building institutional capacity, issuing guidance, and giving organisations time to get their houses in order. That grace period, according to the same briefing, is ending. The Regulator disclosed that two R5 million fines have already been handed down, both for failing to comply with enforcement notices rather than for the underlying breach itself, which tells you exactly where the real risk now sits. It is not in having a problem, but in failing to act once the Regulator tells you to fix it. It also confirmed that an enforcement notice has been issued against the South African Bureau of Standards following a 2024 ransomware attack, and that further matters are being referred to it via the Madlanga Commission of Inquiry. The Regulator said it has moved from awareness campaigns to proactive monitoring, sending letters that require organisations to demonstrate compliance before any complaint has even been lodged.

None of this was aimed specifically at the NPO sector. But that is precisely the point. When a regulator hardens its posture across the board, it does not carve out an exception for good intentions.

The myth that is putting your organisation at risk

Talk to NPO leaders about POPIA and PAIA, and a familiar reassurance comes up quickly. We are too small to be a target, and our cause is too important for anyone to come after us. Both halves of that sentence are wrong, and dangerously so.

POPIA in South Africa protects juristic persons, not just individuals, which means your donor database, your partner organisation records, and your funder correspondence are all squarely within scope, not just the personal details of the people you serve. And when it comes to the people you serve, NPOs are often custodians of some of the most sensitive personal information that exists, including health and HIV status, disability, income and social grant details, and records belonging to children. A data breach involving this kind of information is not a lesser problem because the organisation holding it is a non-profit. It is a worse one, because the people affected are often the least able to absorb the consequences.

Add to this the Regulator's confirmed position, also set out at the same briefing, that telephone calls count as electronic communication under POPIA. It reported that roughly one in ten of the more than 3,800 complaints it received last year related to direct marketing. Every NPO running a fundraising call centre, an SMS donor drive, or an email appeal without properly managed consent is running a live compliance risk, not a hypothetical one.

The PAIA blind spot almost nobody in the sector is watching

While POPIA gets most of the attention, PAIA compliance is where the sector's exposure is arguably greater and far less understood. National compliance with PAIA annual reporting obligations, the Regulator reported at the same briefing, currently sits in the single digits for public bodies, a figure it itself called dismal. It said it is now pushing for amendments that would let it compel disclosure directly where an order goes unmet for 180 days, alongside stronger enforcement powers generally.

Many NPOs that receive public funding, or that perform functions of public interest, carry PAIA manual obligations under the Act that have simply never been actioned. This is not a hypothetical future risk. It is very likely a present, unaddressed one, sitting quietly in the compliance file marked "later."

Your funders are moving faster than the law is

Here is the part that should concentrate minds even among NPOs willing to bet against the Regulator's enforcement timeline. Funders are no longer waiting for legislation to force the issue. Increasingly, international donors and development finance institutions are building data governance and POPIA compliance into their due diligence, as a condition of releasing funds, not as a nice-to-have. An organisation that cannot demonstrate basic compliance is starting to lose access to funding long before it ever attracts the Regulator's attention. That is a faster, quieter, and in some ways more immediate threat than any fine.

Why the sector has fallen behind, and why that is forgivable but not fixable by ignoring it

None of this is because NPO leaders are careless. Most non-profits run lean, volunteer-supported operations with no dedicated legal or compliance function, and a founder or programme director juggling fundraising, service delivery, and governance rarely has bandwidth left for a POPIA gap analysis. Even the most basic step, registering an Information Officer with the Regulator, a free process that takes under half an hour, is one of the most commonly skipped requirements in the sector.

That is an honest explanation. It is not, however, a defence the Regulator or a funder is likely to accept indefinitely.

What to actually do this month

You do not need a full compliance overhaul to start closing the gap. A handful of concrete, low-cost steps make a real difference.

Register your Information Officer with the Regulator if you have not already. It costs nothing and takes under 30 minutes.

Check whether your organisation needs a PAIA manual, and whether the one you have is current.

Map where donor and beneficiary data actually lives, who has access, and how it moves between your organisation and your funders or partners.

Review consent practices for every fundraising channel you use, particularly phone and SMS.

Put a basic incident response plan in place so that if something does go wrong, you are not improvising under pressure and against a statutory notification clock.

The invitation

The Regulator has told the market, in plain language, that it has found its voice and its teeth. NPOs and NGOs across South Africa have a narrow window to move from good intentions to demonstrable compliance, before enforcement, or funder due diligence, forces the issue on far less favourable terms.

None of these steps require a large budget or a legal department. They require a decision to stop treating compliance as something for "next quarter," and start treating it as part of how the organisation protects the people it exists to serve.

Philani Mdingi is Executive Director of Tech for Good , a Johannesburg-based IT strategy and digital transformation consultancy helping NGOs and civil society organisations across Africa navigate data governance, POPIA and PAIA compliance. Download Tech for Good's Digital Governance & Trust board brief at techforgood.co.za/board-brief.