Gauteng Department Of Health In The Spotlight Following Information Regulator’s Third Enforcement Notice Of 2026

The Information Regulator of South Africa issued an enforcement notice against the Gauteng Department of Health (“Department”) on 8 June 2026 following complaints brought under the Promotion of Access to Information Act, 2000 (“PAIA”). This enforcement notice was as a result of the Department’s failure to comply with its obligations to provide access to records requested by a journalist, as well as its failure to comply with a settlement certificate previously concluded between the parties.

This issue arose against the backdrop of the assassination of Babita Deokaran, the former Chief Director of Financial Accounting at the Gauteng Department of Health, who was murdered in August 2021 after reportedly raising concerns regarding procurement irregularities and corruption within the Department. The Information Regulator noted that the records requested by the complainant formed part of broader efforts to investigate allegations of fraud, corruption and governance failures linked to matters that Deokaran had been examining prior to her death.

Following its assessment, the Information Regulator found that the Department had failed to fulfil its constitutional and statutory obligations under PAIA by not responding to access requests or internal appeals as well as failing to provide complete access to records that it had agreed to disclose under a settlement certificate.

Specifically, the findings include that:

• the Department failed to respond to the original requests for access to information, resulting in deemed refusal under PAIA;
• the Department failed to respond to the requester’s internal appeal and as a result, failed to fulfil its constitutional obligations under PAIA;
• the Department failed to comply with the terms of the settlement certificate;
• the Department failed to disclose all audit reports and related records requested by the complainant and failed to adequately explain why only a single report was disclosed despite evidence suggesting that multiple audit reports may exist;
• the Department failed to disclose all records relating to payments and purchase orders associated with Mamelodi Hospital;
• the Department failed to provide sufficient explanations regarding records that were allegedly missing or not disclosed; and
• the affidavit submitted by the Information Officer did not contain sufficient detail to demonstrate compliance with the settlement certificate or adequately address concerns raised by the complainant.

Based on these findings, the Information Regulator directed the Department to take the following actions:

• grant access to all audit reports and any related annexures or addenda generated by the internal control team, including records previously disclosed;
• provide an index or cover page identifying each disclosed audit report and relevant record;
• where requested records cannot be found or do not exist, provide detailed affidavits describing the searches conducted, communications with individuals involved in the searches, and supporting confirmatory affidavits;
• obtain an affidavit from the Department’s spokesperson explaining statements previously made regarding audits conducted across facilities and providing any supporting documentation;
• grant access to the requested Mamelodi Hospital payment schedules, purchase orders and associated procurement records;
• provide an index or cover page identifying the nature of all records disclosed;
• disclose all requested records to the complainant in electronic format; and
• comply fully with the enforcement notice within 31 days of receipt of the notice.

Key takeaways from this enforcement notice

Access to information held by the state is a constitutional right, and PAIA makes it clear that disclosure is the default position, with refusal permitted only in limited circumstances. Public bodies carry the burden of justifying any refusal and must respond timeously to both access requests and internal appeals, failing which they may be deemed to have refused access and become subject to complaints before the Information Regulator.

This enforcement notice also highlights that settlement agreements and settlement certificates facilitated by the Information Regulator must be fully complied with. Public bodies should therefore ensure that they maintain robust records management practices so that records can be readily located, retrieved and disclosed when required. Where records cannot be found or no longer exist, organisations should be able to demonstrate the steps taken to locate them through documented searches and supporting affidavits.

The notice serves as a reminder that transparency, accountability and openness remain foundational constitutional principles, and that all organisations should regularly review and update their PAIA manuals, access to information procedures, records management practices and compliance frameworks to ensure that requests are handled effectively and within the prescribed timeframes.

Whether you are reviewing your PAIA compliance framework, responding to an access to information request or managing a regulatory investigation, get in touch with our team.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.