Matric results will be released on 14 January 2026. (Photograph: Freepik.)
Days ahead of the release of matric results on 14 January for the 2025 cohort, the Department of Basic Education (DBE) says it will defend a new court bid by the Information Regulator to stop it from publishing these in the media.
The Information Regulator, having lost a bid earlier this month to stop the DBE from publishing matric results in the media, is now approaching the Supreme Court of Appeal with a request that it be allowed to appeal the North Gauteng High Court ruling that it says is erroneous.
In its court papers, a copy of which is in ITWeb’s possession of, the regulator says such an appeal would resolve all the issues between the parties. “It is in the interests of justice and in the public interest that the lawfulness of the publication of matric results be finally determined by a higher court,” the papers say.
Lukhanyo Vangqa, ministerial spokesman, says the DBE will defend the court application.
Among the Information Regulator’s arguments is that the High Court should not have introduced and relied on the new term of “personally identifiable information,” which is not found in the Protection of Personal Information Act (POPIA).
In addition, the Information Regulator says this definition is too narrow and suggests that information is only protected if a person can be identified without any particular effort or “diligence”.
“The court has introduced a phrase and a definition which is foreign to POPIA,” the papers state. “The introduction of the phrase and a definition for it amounts to making law as opposed to interpreting the law and the court does not have law-making powers.”
Based on this new terminology, the High Court concluded that DBE’s publication of results did not violate the law.
However, the agency – headed by Advocate Pansy Tlakula – says the details that the DBE publishes include examination numbers and the associated results, which it argues constitutes personal information under the law. The regulator says the use of the exam number doesn’t require much effort to associate with a person.
POPIA is designed to protect all personal information, regardless of how much “trouble” someone has to go through to link it to a specific person and the high court’s narrow interpretation undermines the purpose of the privacy law, the regulator says.
In November 2024, the Information Regulator issued the DBE with an infringement notice following an “own-initiative assessment” of the department and found that it failed to obtain consent for the publication of matric results from learners or parents/guardians of learners that sat for the 2023 National Senior Certificate examinations.
The regulator directed the department to get consent before it published this year’s results in the media. The DBE stopped publishing full names with matric results in newspapers after the 2021 exams, which were released in January 2022, using individual examination numbers instead.
In the enforcement notice, the Information Regulator argues that publishing results in the media is not the only avenue available to the department to distribute results. Matric results are available via the exam centre, the DBE’s website, and SMS.
Skeleton staff
Another ground for its application is that the department filed its appeal against the regulator’s initial enforcement notice late; after the deadline set by POPIA.
The court permitted this late filing, with the data privacy enforcement agency saying it had no jurisdiction to do so under POPIA.
The papers were lodged with the regulator six days late as the Office of the State Attorney was working on “skeleton staff,” which the North Gauteng High Court deemed was reasonable.
Creating certainty
Donrich Thaldar, Professor of Law at the University of KwaZulu-Natal, argues in an open letter to the Information Regulator that the 12 December judgement should be welcomed “without hesitation” as it “affirms a realistic and workable understanding of identifiability” under the Act.
“Crucially, the judgment makes clear that pseudonymised data placed in the public domain is, in general, non-personal in nature. Where direct identifiers have been removed and no unusual or highly distinctive features render identification realistically possible, the data falls outside POPIA’s scope. This is not a weakening of privacy protection; it is a principled articulation of its limits,” says Thaldar.
Thaldar adds that the ruling provides a practical, principled framework for data governance in South Africa that protects privacy, enables responsible data use, and gives researchers, institutions, and regulators legal certainty.
