Information Regulator Investigation into UWC
Report: Status and Timeline of POPIA Complaint (POPIC20262962)
Date: September 27, 2026
1. Complaint Overview
-
Reference Number: POPIC2026296212
-
Current Status: Complaint successfully processed and officially allocated to a team member for review as of September 15, 2026.
2. Chronological Timeline
-
17 June 2026: Initial complaint submitted to the Information Regulator regarding POPIA non-compliance at the University of the Western Cape (UWC).
-
02 August 2026: Supplemental disclosure submitted; Information Regulator formally copied (CC) on the Consolidated Forensic Disclosure and Demand for Independent External Investigation sent to the KPMG Fraud Hotline.
-
15 September 2026: Received official notification that complaint POPIC20262962 has been allocated to a team member for processing.
3. Summary of Disclosures Submitted to the Regulator
The following allegations were submitted via the consolidated disclosure on 02 August 2026:
-
Suppression of Cyber-Incidents: UWC management allegedly suppressed at least three major uncontained cyber-attacks post-2022, failing to comply with POPIA and DPSA Cybersecurity Circular directives.
-
Unlawful Data Migration: Institutional and student research data allegedly migrated to unverified third-party cloud hosts, violating POPIA data residency rules and Department of Public Works infrastructure frameworks.
-
Breach Concealment: Intentional concealment of material losses—specifically the R20 million telecom/VPN breach—from financial statements, DHET, and National Treasury, preventing mandatory breach notification to the Information Regulator as required by Section 24 of POPIA.
-
Governance Failures: Internal audit and governance structures allegedly restricted or neutralized to prevent independent forensic oversight of data protection risks.
4. Next Steps
-
The Regulator may request further information or clarification via the “Complaint Updates” section on their eServices portal.
-
Monitor the eServices portal for updates. Failure to respond to requests for additional information may lead to automatic rejection of the complaint due to inactivity.
