POPIA
Already Running ISO 27001? Your AI Governance Programme Is Mostly Built
“Do we have an AI policy?” now reaches IT managers from clients, auditors and tender documents. If your organisation already runs an ISO/IEC 27001 information security management system (ISMS), you hold most of the machinery needed to answer it. Two frameworks, two jobs A Kovrr comparison published on Security Boulevard in October 2026 sets out the choice. ISO/IEC 42001 is certifiable through accredited bodies in a two-stage audit. NIST AI RMF is voluntary and free to apply, and it carries no certification.
The Breach a Journalist Had to Report: What Gauteng's e-Panic Button Teaches Us About Section 22
On 21 September, GroundUp told the Gauteng government and the vendor behind its e-Panic Button app that the database behind the app was unsecured. According to GroundUp’s investigation, the exposed data included names, phone numbers, email addresses, vehicle registration numbers, GPS coordinates and movement histories, the contents of crime reports, and more than 5,000 report photographs. Some reports concerned domestic violence and assault. The vendor, Evolve Value Added Services, responded and fixed the reported vulnerabilities. The government’s first public response came on Tuesday 29 September, eight days after the tip-off. It said no citizens’ personal information was compromised. On 30 September the Information Regulator told the Mail & Guardian it had not received a notification from the department. By 3 October the Gauteng Legislature’s e-Government Committee was saying the app was not safe to use and asking for a report on access logs going back to the app’s 2024 launch.
Your Vendor's Breach Is Your POPIA Problem: Third-Party Risk in SA's Breach Wave
South African enterprises operate in the middle of an aggressive supply chain breach wave. Major incidents across public and private institutions—including the Companies and Intellectual Property Commission (CIPC), the Department of Justice, major credit bureaus, and national healthcare administrators—demonstrate a consistent attack strategy. Sophisticated threat actors prioritize third-party vendors, IT service providers, and cloud processors. Compromising a single service provider unlocks access to the sensitive customer databases of hundreds of corporate clients simultaneously.