What happens if our club breaks POPIA with a child's photo?
Rule- South Africa
- POPIA
- Information Regulator
- POPIA Regulations 2025
- Junior sport
- Under 18
- Photos and social media
- 2025
- Media officers
Breaching any of POPIA's conditions for lawful processing (including posting a child's photo without a lawful basis) is an "interference with the protection of personal information" (s73).
- Complaints: a complaint can be lodged with the Information Regulator in writing (s74, s75). Under the 2025 regulations this can come from the data subject, someone acting for them, anyone with a sufficient personal interest, or anyone acting in the public interest, using Form 5 (online, at the Regulator's offices, or by fax, post, courier or email). The Regulator acknowledges it with a reference number within 14 days.
- Enforcement notice: the Regulator can order the club to take specified steps or stop processing (s95). Failing to comply with an enforcement notice is an offence (s103(1)), punishable by a fine or up to 10 years' imprisonment, or both (s107(a)).
- Administrative fine: for an alleged offence, the Regulator can issue an infringement notice with a fine of up to R10 million (s109).
- Civil claim: the data subject (or the Regulator at their request) can sue for damages, whether or not the club acted intentionally or negligently (s99).
Sources: POPIA (Act 4 of 2013) ss 73-75, 95, 99, 103, 107, 109; POPIA Regulations as amended in 2025, regulation 7.
Added 21 Oct 2026