Legal & Risk: What Businesses Need to Watch
2026‑09‑24
In a landscape where headlines swing from data breaches to regulatory reforms, the quiet legal risks that slip through daily operations can be far costlier. Below are three recent stories that illuminate hidden compliance traps many commercial leaders overlook – and concrete actions a CLO or risk team should flag immediately.
---
1. How Gauteng’s new panic app exposed your data
The “panic” safety application rolled out by the Gauteng provincial government is now a cautionary tale about personal data protection in South Africa. While designed to help citizens report emergencies, the app has unintentionally become an information‑leak vector.
Legal angles often missed
- POPIA compliance – The Protection of Personal Information Act 4 of 2013 mandates that any processing of personal information must have a lawful basis, be purpose‑limited, and secure. The app’s data‑collection procedures did not clearly delineate consent or specify retention periods, exposing the provincial government to potential breaches of POPIA.
- Cross‑border transfer risk – If the app stores or forwards data outside South Africa (e.g., to cloud services based in the EU), the entity must satisfy the “Adequacy” criteria set by the Information Regulator. Failure to do so risks violating both POPIA and the UK GDPR if the data is processed for users in the United Kingdom.
Compliance actions for a CLO
- Conduct a POPIA Data‑Protection Impact Assessment (DPIA) – Map all personal data flows, identify lawful bases, and document retention schedules.
- Review third‑party agreements – Ensure that any cloud or analytics provider includes robust data‑processing addendums covering cross‑border transfers and security obligations.
- Establish an incident‑response protocol – Mandate immediate notification to the Information Regulator and affected users in case of a breach, per POPIA sections 26–29.
---
2. Labat now says the law bars it from paying its maiden dividend
Labat’s board recently realised that a 900 million‑share issue has rendered the company legally barred from distributing its first dividend – a striking reminder of how corporate finance decisions can run afoul of statutory restrictions.
Legal angles often missed
- Dividends and capital adequacy (Companies Act 71 of 2008) – Section 173 requires that any dividend be declared only out of the company’s undistributed profits, and Section 175 imposes a statutory prohibition if the company has suffered losses or is in jeopardy of insolvency. The massive share issue diluted earnings per share to the point where undistributed profit fell below the threshold for dividend payment.
- Disclosures to shareholders – Under section 167(5) of the Companies Act, directors must inform shareholders that a dividend cannot be paid and provide reasons. Failure to do so can trigger shareholder litigation.
Compliance actions for a CLO
- Re‑evaluate capital structure – Conduct an analysis of the impact of new share issues on profitability metrics relevant to dividend eligibility.
- Update shareholder communications – Draft a compliant notice explaining the legal restriction, referencing the relevant sections of the Companies Act.
- Plan a dividend‑eligible restructuring – If dividends are a strategic priority, consider alternative financing or recapitalisation structures that preserve undistributed profit.
---
3. London’s IPO drought could be broken by an African fintech
Airtel Money, with 53 million monthly users, is poised to break the long‑standing pause in UK initial public offerings – a headline that brings cross‑border securities law into sharp focus for South African businesses eyeing European capital markets.
Legal angles often missed
- UK Listing Rules vs. SA disclosure obligations – A South African company looking to list on the London Stock Exchange must satisfy the UK’s Listing Rules (which embed the Financial Conduct Authority’s regulatory framework) while also complying with SA disclosure duties under the Companies Act and the Securities and Investment Amendment Act 1998.
- Foreign exchange controls – The SA Reserve Bank requires that any proceeds from a foreign listing be repatriated in line with the Foreign Exchange Regulation Act. Failure to do so can trigger penalties or block repatriation.
Compliance actions for a CLO
- Synchronise disclosure regimes – Map out parallel reporting obligations (e.g., annual reports, MD&A) and ensure that all material information is harmonised across jurisdictions.
- Engage with UK advisors early – Secure counsel on the London Listing Rules’ “Material Information” provisions to pre‑empt any regulatory missteps during the prospectus drafting process.
- Secure FX clearance – Arrange a foreign exchange licence or an approved mechanism (such as an Approved Investment Arrangement) for repatriating IPO proceeds in compliance with SA regulations.
---
Bottom line
Whether it’s data leaks from a seemingly innocuous mobile app, the hidden impact of a share issue on dividend rights, or the regulatory tightrope walked by a South African fintech eyeing London, each headline underscores that legal and risk oversight must go beyond the surface. Promptly flagging these issues with robust compliance procedures will safeguard your company against costly penalties and reputational harm.
---
Sources