Legal & Risk: What Businesses Need to Watch

Legal & Risk: What Businesses Need to Watch – 2026‑09‑16

Regulators are tightening, public procurement is becoming more convoluted, and technology moves faster than law. Three stories from the week expose hidden legal pitfalls that many businesses overlook.

---

1. Data‑Centre Approval under Scrutiny

Source: Activists appeal City of Cape Town data centre approval – Moneyweb

The Cape Town municipality’s recent decision to green‑light a new data‑centre has triggered an activist appeal. While the project promises local job creation and energy savings, it sits at the intersection of municipal planning law, environmental protection, and South African data‑protection statutes.

Legal angle missed by most firms:

Under the National Environmental Management: Waste Act and Protection of Personal Information Act 4 of 2013 (POPIA), operators must conduct a Data Protection Impact Assessment (DPIA) before any data centre that will process large volumes of personal information is approved. The appeal suggests the DPIA was either incomplete or omitted, exposing companies to future POPIA fines and potential civil claims if breaches occur.

Compliance actions for CLOs:

• Verify DPIA completion: Request a copy of the DPIA from the project lead; confirm it covers all POPIA high‑risk criteria (identification data, biometric identifiers).
• Municipal compliance audit: Ensure all municipal environmental impact assessments comply with the National Environmental Management Act and that any exemptions are legally justified.
• Insurance & liability review: Update cyber‑insurance policies to cover potential POPIA breaches tied to the new infrastructure; confirm indemnity clauses protect against third‑party data subject claims.

---

2. Police Bodycam Tender Collides with Biometric Rules

Source: Saps bodycam tender collides with Popia's biometrics rules – TechCentral

The South African Police Service’s bid for a nationwide body‑camera system faces a POPIA hurdle: facial recognition data is classified as special personal information (SPI), and its collection is only permissible under strict exceptions.

Legal angle missed by most firms:

Contractors awarded the tender are risking a breach of Section 8(2) of POPIA if they fail to secure an exception. Many companies assume that procurement contracts automatically satisfy data‑protection requirements because the system will be government‑operated, but POPIA requires explicit legal basis and robust governance mechanisms for SPI.

Compliance actions for CLOs:

• Exception audit: Confirm whether the police can legitimately invoke the law enforcement exception or if a new law is needed; if not, secure a separate lawful basis.
• Contractual safeguards: Insert clauses that require the vendor to implement POPIA‑compliant data handling practices, including encryption, retention limits, and mandatory reporting of breaches to the Information Regulator within 72 hours.
• Data minimisation review: Advise the government client to adopt a “data‑by‑default” model that captures only essential biometric traits for the stated purpose.

---

3. Revolut’s Limited Scope in South Africa’s Banking Market

Source: What Revolut can and cannot take from South Africa's banks – TechCentral

Revolut’s planned entry into SA banking has triggered debate over which functions it may perform under current legislation. The article highlights that while Revolut can offer digital wallet services, it is barred from taking deposits or issuing credit without a full banking license.

Legal angle missed by most firms:

Many fintechs interpret the Financial Intelligence Centre Act and the Companies Act as permitting “bank‑like” activities through a single licence. In reality, the Banking Act 25 of 1990 differentiates between banks, trust companies, and non‑bank financial institutions; each has distinct regulatory obligations and capital requirements.

Compliance actions for CLOs:

• Licensing gap analysis: Map Revolut’s intended services against the Financial Sector Conduct Authority categories to confirm which licences are required or prohibited.
• Capital adequacy review: If Revolut seeks to expand beyond a wallet, ensure it meets Tier 1 capital thresholds under the South African Reserve Bank’s prudential guidelines.
• Consumer protection compliance: Verify that all product disclosures meet Financial Advisory and Intermediary Services Act requirements, preventing mis‑representation of deposit safety or credit risk.

---

Bottom Line

The week’s stories demonstrate that technology‑driven growth often outpaces the legal frameworks meant to protect consumers and regulators alike. Whether it is a new data centre, biometric police gear, or a fintech entrant, the common thread is that compliance must be built into every contract, decision, and system from day one.

---

Sources

• Activists appeal City of Cape Town data centre approval — Moneyweb
• Saps bodycam tender collides with Popia's biometrics rules — TechCentral
• What Revolut can and cannot take from South Africa's banks — TechCentral

**