Deepening Democracy through Access to Information
Home / Legal Briefs / Werksmans RSS ← Back

Email this article

separate emails by commas, maximum limit of 4 addresses

Sponsored by


Article Enquiry

Enforcement notice issued to Dis-Chem due to contravention of POPIA


Embed Video

Enforcement notice issued to Dis-Chem due to contravention of POPIA


7th September 2023


Font size: -+

The importance of compliance has once again been highlighted as the Information Regulator issued an Enforcement Notice to Dis-Chem Pharmacies Ltd (“Dis-Chem“) on 1 September 2023 for non-compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA“).

The Information Regulator is casting their net wide when it’s come to investigating contraventions, whether it be against large, small, private or public companies and is cracking down on ensuring consumers’ information is safeguarded and lawfully processed.


The Information Regulator found that Dis-Chem failed to identify the risk of using weak passwords, failed to implement measures to monitor and detect unlawful access to their environment and that they hadn’t entered into any operator agreement with their third party service provider which would have, amongst other things outlined the process of reporting to Dis-Chem in the event of a security compromise.

The Information Regulator has ordered Dis-Chem to conduct a Personal Information Impact Assessment and to ensure that adequate measures and standards exist to comply with the conditions for the lawful processing of personal information. They have also been mandated to implement an adequate Incident Response Plan, involving strong access control measures, maintaining a vulnerability management programme, implementing strong access control measures and maintaining an Information Security Policy.


Dis-chem have been ordered to conclude written contracts with all operators who process personal information on its behalf and to develop, implement, monitor and maintain a compliance framework.  Failure to comply with such obligations will result in an administrative fine or result in a conviction of imprisonment or both.

A breach of this nature, and the finding as to the lack of safeguards in place should come as a shock for an organisation of this size and an organisation which holds such a vast quantity of data. One would expect that all prominent companies in South Africa would have conducted an impact assessment and would give credence to their responsibilities in protecting their customers’ data. The Information Regulators guidance to Information Officers is clear. Understanding the privacy landscape together with rights, obligations and duties are not negotiable. A robust privacy programme empowers companies to demonstrate that they reasonably comply with the obligations as stipulate in POPIA.

The Werksmans regulatory team has developed electronic tools and a sound methodology which aim to assist with impact assessments and the implementation of a compliance road map. Compliance with POPIA is not a template that is downloaded and copied. A clear understanding of the legislation is paramount.

Written by Ahmore Burger-Smidt, Head of Regulatory and Chiara Ferri, Candidate Attorney; Werksmans


To subscribe email or click here
To advertise email or click here

Comment Guidelines

About is a product of Creamer Media.

Other Creamer Media Products include:
Engineering News
Mining Weekly
Research Channel Africa

Read more


We offer a variety of subscriptions to our Magazine, Website, PDF Reports and our photo library.

Subscriptions are available via the Creamer Media Store.

View store


Advertising on is an effective way to build and consolidate a company's profile among clients and prospective clients. Email

View options
Free daily email newsletter Register Now