The Information Regulator has issued credit bureau TransUnion with an enforcement notice following a 2022 data breach that led to 4TB of data relating to the records of millions of South Africans being compromised.

“TransUnion was one of the biggest breaches that we have dealt with in terms of the number of subjects that were compromised,” Information Regulator chair Pansy Tlakula said at a media briefing in Johannesburg on Tuesday. “The regulator conducted an assessment which has found, among other things, that TransUnion breached the conditions for the lawful processing of personal information.”

The enforcement notice was served under the Protection of Personal Information Act (Popia). According to the regulator, TransUnion failed to:

Secure the confidentiality of the personal information in its possession or under its control;
Take appropriate technical and organisational measures to ensure access control is implemented as directed by their own policy and did not have controls to detect this failure;
Prevent unlawful access to or processing of personal information that enabled unauthorised actors to gain unlawful access through the use of compromised credentials and use of a weak password;
Implement the safeguards that had been put in place in the form of access management and user creation policies; and
Implement the provisions of its own security policies.

The enforcement notice stipulates remedial measures that the credit bureau has 60 days to implement and send proof of doing so to the regulator to avoid an infringement notice. As part of the remedial process, TransUnion will have to “obtain the services of a qualified auditor/audit firm” that will audit all user accounts to determine if they fall within a predetermined policy framework.

Should TransUnion not respond to the enforcement notice or fail to address the issues raised by the Information Regulator adequately, then the company could face a fine of up to R5-million for non-compliance, similar to the one imposed on the department of justice & constitutional development in June 2023.

That fine, which was the first of its kind in South Africa, is being challenged in court by the justice department, which claims that the regulator misapplied Popia in administering the penalty.

“TransUnion has until 26 May to submit to the regulator that all the remedial measures in the enforcement have been implemented,” said Tlakula.

In a statement on Tuesday, TransUnion stated that immediately after the 2022 incident, it “implemented a number of improvements” following a review by an independent forensics and security firm.