This is for IT managers and small internal IT teams who own some piece of an audit finding, an insurer requirement or a POPIA corrective action with a date on it. After reading, you will know what the Information Regulator said in its 26 October 2026 statement [1], why the fine was about follow-through rather than the original disclosure, and how to start an evidence file this week instead of the week before the deadline.
What happened
On 26 October 2026 the Information Regulator announced administrative fines of R500 000 against Central Johannesburg TVET College (CJC) and R1 million against First National Bank (FNB) [1]. The two cases are different, and the CJC one is the one most IT teams should read twice.
According to the Regulator, CJC was issued an Enforcement Notice on 22 May 2026 after complaints from three people whose personal information was unlawfully shared with third parties without legal justification [1]. Werksmans, writing in June, described the underlying incident as an Acting CFO who erroneously included the complainants' credential verification reports in a folder of finance policies that was emailed to unauthorised employees [3]. ENSafrica reported that the notice cited sections 15(1), 19 and 22(1) of POPIA, as well as the failure to register an Information Officer [4].
The notice ordered CJC to take corrective steps within set timeframes, including [1]:
- Register its Information Officer and Deputy Information Officer.
- Apologise to the complainants.
- Develop and submit a POPIA Compliance Framework.
- Run POPIA awareness and training for employees.
- Take disciplinary action against the employee responsible for the disclosure.
At the end of the 120 days, CJC sent the Regulator a response. After considering that report, the Regulator found CJC had not complied: the security compromise was not reported in the prescribed manner, the Compliance Framework was not developed, the apology was late and the stipulated timeframes were not met [1]. That finding is what led to the Infringement Notice and the R500 000 fine [1][2].
No public statement from CJC was available when this was written.
Why this matters to an IT team
The fine was not for the original disclosure. It came after a response that, in the Regulator's view, did not show the ordered steps had been done on time [1]. In other words, the organisation had 120 days, sent something back, and what it sent back was not enough.
None of CJC's orders were about patching or technical controls. They were organisational: people, documents and process. That is the point. Whatever the corrective action is, someone has to do it, date it, and be able to show it was done.
The FNB notice, published in the same week, makes the expectation explicit. FNB must give the Regulator, within 90 days of receiving the notice, "a full report containing supporting documentary evidence" on implementing every order [5]. Several of those orders land squarely on IT: security safeguards that are "implemented, verified and tested", vulnerabilities assessed and addressed, role-based access control reviewed and strengthened, and staff trained to identify and report security incidents [5].
The notice also states the consequence of not complying: a responsible party that fails to comply with an enforcement notice is guilty of an offence and liable on conviction to a fine, imprisonment of up to 10 years, or both [5]. Werksmans summarises the maximum fine for that offence as R10 million [3]. That is the ceiling for the offence in law, not what CJC was fined.
This is not legal advice. If your organisation has received a notice, your Information Officer and a lawyer lead. IT's job is to make sure the technical items are done and provable.
What to do this week
You may never receive an enforcement notice. You almost certainly already have dated commitments: an external audit finding, a cyber insurance questionnaire, an internal audit action, a board request. The same discipline applies.
- List every open item IT owns. Audit findings, insurer conditions, POPIA corrective actions, board actions. One line each, with the source document.
- Write the deadline next to each one. Not the target date you hope for. The date someone outside IT will check.
- Write what "done" looks like as evidence. For each item, name the document a stranger would need to believe it: a policy with a version and date, a training register, an access review signed off, a configuration export, a report.
- Start the evidence folder today. One folder per item. Save evidence as you produce it, with the date in the file name. Day 30 evidence is more convincing than a pile assembled on day 119.
- Book a halfway check. At the midpoint, open each folder and ask: if this had to go out today, would it hold up? CJC's response arrived at the end of the period [1]; a midpoint check gives you time to fix what is missing.
- Agree who signs off. The Information Officer, the CFO or the MD should see the evidence before it goes, not after.
If you want the bigger picture on what an endpoint fleet should be able to show, our earlier piece on POPIA compliance for IT in South Africa covers Section 19 and a fuller evidence list. For the patching side specifically, see patch management in South Africa.
Where device evidence fits, and where it does not
When an order or audit item touches technical safeguards, such as FNB's requirement that safeguards be verified and tested [5], a dated, device-by-device record of patch state is one exhibit you can put in the folder. It shows which machines are missing which Windows updates and which are waiting on a reboot, as of a date.
It does not register an Information Officer, write a compliance framework, deliver an apology or run training. Most of what CJC was ordered to do [1] sits outside any IT tool. Treat device evidence as one tab in the file, not the file.
What Allocentra does here, and what it does not
- Does: finds missing Windows updates on each device you point it at, flags critical exposure and reboot debt, and gives you a report per device as a PDF that goes into an audit file.
- Does: on a paid plan, rolls updates out in staged rings and keeps the compliance record, with an immutable audit log of who did what and when.
- Does not: make anyone POPIA compliant. No software does, and a patch report will not satisfy an enforcement notice on its own.
- Does not: act as a security scanner. Windows is where patch proof is complete today.
- Does not: replace your Information Officer, your lawyer or the organisational steps an order requires.
- Allocentra is a young South African company, built and run in Johannesburg.
If an audit item on your list asks whether every laptop is patched, you can have a dated answer for 25 devices in 48 hours. Get the free 48-hour Patch Exposure Report: no card, set up in two minutes, and you keep the PDF whether or not you ever buy.
