Penalties and fines for contravening the POPI Act will be dependent on the nature of the data breach. Fines can be issued up to an amount of R10 million, or a jail sentence of up to 10 years can be imposed.