Matric results no longer in the newspapers: Here’s why

The Information Regulator has issued an enforcement notice to the Department of Basic Education (DBE), halting the publication of the 2024 matric results in newspapers due to non-compliance with South Africa's data protection law, the Protection of Personal Information Act (POPIA).

The crux of the issue? Consent. Under Section 11 of POPIA, organisations must have a lawful basis for processing personal information, including (as applicable) explicit consent from the data subjects—in this case, learners over 18 years old or their parents/guardians.

In a recent ruling, the Information Regulator found that the DBE had failed to secure valid consent for the publication of the 2023 matric results. The long-standing practice of publishing results alongside personal information, such as examination numbers that can be used to identify learners, was deemed a violation of learners' privacy rights.

The Enforcement Notice

The DBE has been instructed to:

• Cease newspaper publications: Within 31 days of the enforcement notice, DBE must provide an undertaking to the Information Regulator that it will not publish the 2024 matric results in newspapers. The 2024 matric results must only be released using methods that are compliant with POPIA, for example, obtaining results from the schools or the DBE’s secure SMS platform.
• Develop a consent system: By 5 February 2025 (i.e. within 90 days of the enforcement notice), the DBE must provide an undertaking to the Information Regulator that it create and implement a process to obtain voluntary, informed consent from learners or their parents/guardians before publishing results. The Information Regulator must be given an opportunity to verify the system before it is deployed.
• Ensure anonymity: Examination numbers or methods of publication must protect learners' identities.

Why Consent Matters

POPIA is clear: processing personal information requires lawful grounds. Where the processing is based on consent, the consent must be voluntary, specific, and informed, and subject to withdrawal. This will require that:

• Learners and/or parents/guardians must actively agree to the publication of results. There can be no deemed or assumed consent.
• The consent process must be easy to understand and allow for withdrawal of such consent by the data subject, at any time.

The absence of these measures exposes the DBE and, in other contexts, organisations to potential penalties, reputational damage, and a loss of public trust.

A New Era of Privacy

This case highlights the growing influence of South Africa’s Information Regulator. For learners, it may feel like the end of an era. For organisations, it should act as a wake-up call: compliance with POPIA isn’t optional.

Ensuring compliance with POPIA is essential—not just to avoid penalties, but to build trust with those whose data you handle, and to ensure the privacy of personal information. Whether you’re a government department or a private business, now is the time to review your data processing practices and make privacy a priority.

Act today and contact us to assist you with implementing the necessary steps to protect personal information, safeguard your organisation, and avoid being the next headline for all the wrong reasons.

Download the enforcement document