The 2026 Q3 data privacy update highlights a clear shift from compliance on paper to compliance that can be proved. Locally, the Information Regulator’s recent POPIA and PAIA enforcement notices show that public and private bodies must report security compromises, justify refusals of access, honour settlement agreements and keep proper evidence of their decisions.