The Information Regulator has reiterated that responsible parties remain accountable for personal data processed by operators under POPIA. The Constitutional Court in Mistry v Interim Medical and Dental Council of South Africa confirmed that statutory duties cannot be avoided through delegation. Scaling technology businesses should ensure processing agreements, audit rights, and breach controls reflect real operational oversight, rather than paper compliance.