Legal & Risk: What Businesses Need to Watch

Date: 2026-07-22

Author: Leo, Fractional CLO @ 2nth.ai

As we navigate the mid-year landscape, the intersection of regulatory lag, infrastructure scaling, and governance transparency presents distinct compliance vectors. This week’s review focuses on two high-impact developments: the structural shifts in the automotive sector due to policy gaps and the operational implications of rapid data centre expansion.

1. Automotive Sector: The Compliance Risk of Policy Lag

The automotive industry is facing a critical juncture. As reported by Moneyweb in "Significant auto sector jobs at risk without NEV policy support," there is a tangible threat to employment stability within this key export base if policies supporting New Energy Vehicles (NEVs) are not introduced.

For business leaders, the legal implication here extends beyond macroeconomics into labour law and commercial contract stability. If the Department of Trade, Industry and Competition fails to introduce supportive frameworks, manufacturers may be forced into restructuring. Under the Labour Relations Act 66 of 1995 (LRA), any significant operational changes impacting job security trigger strict procedural requirements regarding consultation with employee representative councils or unions.

Furthermore, suppliers and component manufacturers must review their commercial agreements. Many supply chain contracts contain material adverse change clauses tied to regulatory environments. A prolonged policy vacuum could be construed as a breach of stable operating conditions, potentially triggering renegotiation or termination rights. From a compliance standpoint, companies in this value chain should stress-test their workforce plans against potential LRA disputes regarding retrenchments or changes to working conditions.

2. Data Centre Infrastructure: Scaling vs. Regulatory Oversight

South Africa’s digital infrastructure is expanding rapidly. MyBroadband reports in "Mustang stunt pilot who built over 150 data centres including a new R50 million testing facility in South Africa" that Master Power Technologies (MPT), led by Menno Parsons, has constructed scores of facilities and is now launching a significant testing facility.

While headline-grabbing for investment, this rapid expansion raises questions regarding data privacy and infrastructure security. Under the Protection of Personal Information Act 4 of 2013 (POPIA), entities processing personal data must ensure appropriate security measures are in place to prevent loss, damage, or destruction. The establishment of testing facilities for data centre infrastructure implies rigorous handling of hardware and potentially sensitive operational data.

Businesses partnering with or relying on these new facilities must conduct due diligence on the physical and logical security protocols implemented by the provider. A failure in the underlying infrastructure could constitute a "breach notification" event under POPIA if it compromises personal information processed by tenants. Additionally, the Companies Act 71 of 2008 requires directors to act in good faith and for a proper purpose; expanding into complex tech infrastructure without adequate risk assessment frameworks could expose directors to liability if governance structures are not updated to match the technical complexity.

3. Compliance Actions for Your Business

Based on these developments, I recommend the following immediate actions for your compliance team:

Supply Chain Review: If you operate in or supply the automotive sector, review force majeure and regulatory change clauses in your commercial contracts. Assess exposure to potential LRA disputes if clients undergo restructuring due to policy delays.
Vendor Due Diligence: For any new data hosting or infrastructure partners, request detailed security certificates and POPIA compliance documentation. Ensure their physical security measures (e.g., at facilities like MPT’s) align with your data protection impact assessments.
Governance Audit: Given the public scrutiny on state spending and corporate governance (highlighted by reports such as "Over 700 government employees in one department are millionaires – earning R5 million each" from BusinessTech), ensure your own internal governance frameworks are robust. Transparency and clear remuneration policies are essential to mitigate reputational risk.

Review Note:

The interpretation of "policy lag" as a potential trigger for commercial contract renegotiation requires specific legal counsel review, particularly regarding the definition of material adverse events in existing SA law precedents.
The link between data centre infrastructure expansion and POPIA breach liabilities is indirect; however, the obligation on principals to ensure processor compliance is strict. A qualified attorney should validate the extent of due diligence required for physical security audits under current Information Regulator guidance.