After 10 years of building its capabilities, this week the Information Regulator issued its first infringement notice against the Department of Justice and Constitutional Development after it failed to comply with an enforcement notice requiring it to beef up its cyber security software following a 2021 data breach. This landmark moment for data privacy enforcement in South Africa could be a sign of things to come.