Legal & Risk: What Businesses Need to Watch
Date: 2026‑08‑23
In every headline lies a hidden compliance risk that most managers overlook. This week’s stories illustrate how routine developments can trigger serious legal obligations across data protection, environmental law and consumer rights.
---
1. The Spreadsheet Trap – Governance Under Scrutiny
Zaronia’s reliance on spreadsheets for critical decision‑making has been branded “a governance challenge” in Moneyweb. While the article focuses on internal control gaps, the legal dimensions run deeper:
- Personal Information Protection Act 4 of 2013 (POPIA) – Spreadsheets often contain employee or customer data. If that data is used for performance or credit decisions, POPIA requires a lawful basis, purpose limitation, and data minimisation. A processing impact assessment becomes mandatory when the data informs materially consequential decisions.
- Companies Act No. 71 of 2008 – Companies must keep accurate records in compliance with section 75; unapproved spreadsheets may constitute non‑conforming record keeping, exposing directors to liability for failure to maintain statutory books.
What a CLO Should Do
- Audit critical spreadsheets for personal data and assess POPIA compliance – Identify where PII resides and whether it is protected under encryption or access controls.
- Transition to an approved electronic records system – Ensure that all statutory documents are stored in an auditable format with version control.
- Implement a spreadsheet governance policy – Define approval workflows, data handling guidelines, and regular reviews.
---
2. Eskom’s Legal Breach at Kusile – Environmental Compliance Gone Wrong
The Supreme Court of Appeal’s judgment on 14 August 2026 found that Eskom failed to prevent substantial water pollution from its R233 billion Kusile power station, ordering the utility and its board of directors to file a detailed action plan within 30 days. Though the case is public‑sector focused, it raises key points for private sector partners:
- Environmental Management Act 167 of 2004 – While not cited directly in the article, any entity that supplies goods or services to Eskom may be implicated if their operations contribute to environmental harm.
- Companies Act No. 71 of 2008 (directors’ duties) – Directors must act with due care and diligence; non‑compliance can lead to civil liability for breach of duty.
What a CLO Should Do
- Review all supply‑chain agreements for clauses that assign environmental compliance responsibilities to contractors.
- Demand written evidence of Eskom’s remediation plan before continuing engagement, ensuring the plan aligns with statutory deadlines and monitoring mechanisms.
- Implement an internal audit of water‑related processes to guard against inadvertent breaches in any facility linked to power generation.
---
3. R299 EV Charging Subscription – Consumer Protection at Risk
The new GridCars subscription, which offers public EV charging credits for a monthly fee, is advertised as a cost‑saving scheme. Moneyweb reports that the average South African driver will not recoup the subscription cost and may still pay more when using all credits.
- Consumer Protection Act 68 of 2008 – Unfair contract terms or deceptive marketing can expose companies to liability. A subscription priced at R299, coupled with opaque credit usage limits, may be deemed misleading.
- VAT Act 95 of 1991 (SA) – Any service pricing structure must clearly disclose VAT-inclusive amounts; hidden surcharges can trigger compliance issues.
What a CLO Should Do
- Conduct a fairness review of the subscription contract – Verify that all terms are transparent, especially credit limits and rollover policies.
- Audit marketing materials for compliance with the Consumer Protection Act – Ensure no deceptive statements about cost savings or usage expectations.
- Implement real‑time usage dashboards for customers so they can track credit consumption and avoid unexpected charges.
---
Key Compliance Actions to Flag
- Data‑Protection Governance – Audit spreadsheet use for PII; enforce POPIA data minimisation and impact assessments.
- Environmental Risk Management – Scrutinise supply‑chain contracts for environmental duties, particularly with partners like Eskom.
- Consumer‑Facing Transparency – Review all subscription or pricing models against the Consumer Protection Act to avoid misleading conduct.
---
Sources
---
**