South Africa's Information Regulator goes to court, and keeps losing on matric results

On 3 June 2026, the Gauteng High Court refused the Information Regulator leave to appeal to the Supreme Court of Appeal in the matric results case, the fourth court order against the Regulator's position that publishing exam results infringes POPIA (IOL). The Regulator can still petition the SCA directly. The Department of Basic Education, which pressed ahead with publication of the 2025 results while the leave application was pending, has won every round since December 2025, when a full bench set aside the IR's enforcement and infringement notices (TimesLive).

The matric fight is one entry in a docket. The Regulator disclosed at its November 2025 media briefing that it is pursuing a court test case on whether telemarketing calls are "electronic communication" under POPIA section 69; the vehicle is an investigation into a direct marketer whose identity the cited reporting does not confirm (Moonstone; Werksmans). A compliance agreement with WhatsApp on transparency for South African users awaits a court order. The R5 million infringement notice issued to the Department of Justice in 2023 remains contested. And the Regulator has begun work on an own-initiative code of conduct on personal information processed at gated accesses, with a draft due to be finalised in 2026/27, extending its reach to estates, office parks and venues scanning IDs and biometrics at the boom.

Why it matters. POPIA is more than a decade old and its central terms are only now being construed by courts, because the Regulator has chosen litigation as its clarification instrument. Each case fixes the meaning of something practitioners currently guess at: what counts as "personal information" (matric results, per the High Court, may be published by exam number), whether section 69's consent regime captures live phone calls (the industry says no, the Regulator's guidance note says yes), and whether IR enforcement notices survive judicial scrutiny at all. The pattern so far is uncomfortable for the Regulator: courts have repeatedly favoured respondents, and the December 2025 full-bench ruling set aside its notices on the merits. A regulator that loses its own test cases sets precedent against itself.

Who is affected. Direct marketers first: if the section 69 case goes the Regulator's way, every outbound telemarketing operation in South Africa needs prior consent or an existing-customer relationship, which is an operating-model change, not a policy tweak. Public bodies second, since the matric and DOJ matters define how enforceable IR notices are against the state. Property managers, estates and venues third, under the gated-access code. And any respondent weighing whether to comply with or challenge an IR notice now has a growing body of precedent saying challenges can succeed.

What to do now:

1. If you run outbound marketing, model both outcomes of the section 69 test case now. The compliant-by-design option (consent or existing-customer basis for every call) is the only one that survives both.
2. Do not treat IR enforcement notices as self-executing or as ignorable. The DBE defied one and won; the DOJ is contesting its fine. But every challenge ran through the courts, with counsel, on procedural and interpretive grounds. The lesson is to litigate deliberately, not to disregard.
3. If you control physical access points that scan identity or biometric data, map the gated-access code of conduct against your visitor-management stack before the first complaint arrives.