The Information Regulator has issued enforcement notices under the Protection of Personal Information Act 4 of 2013, emphasising lawful processing, valid direct marketing consent, and appropriate security safeguards. The Regulator has clarified that responsible parties must evidence compliance, not merely assert it. Scaling SaaS and adtech businesses operating in South Africa should review consent mechanisms, operator agreements, cross-border transfer controls, and documented security governance to mitigate administrative penalties.