The regulator might slap companies with sanctions, including fines of up to R10m or company directors facing imprisonment for up to 10 years. Companies in the regulator's firing line would ordinarily have weak control systems that fail to protect sensitive information belonging to consumers or even fail to take corrective measures once there is a data breach.

South Africa's information regulator is getting tough on companies found to have been negligent in safeguarding the personal information of consumers, which lands in the wrong hands through data breaches.

The Information Regulator South Africa is a watchdog that monitors compliance with information protection legislation by private and public sector companies to prevent, among other incidents, data breaches.

The spate of high-profile data breaches in South Africa in recent months has jolted the regulator to launch a unit within its office -- supported by forensic investigation and IT skills -- that will investigate and impose sanctions against errant companies. Companies in the regulator's firing line would ordinarily have weak control systems that fail to protect sensitive information belonging to consumers or fail to even take corrective measures once there is a data breach.

The regulator was launched in 2016, but its powers were...