Forensic Reports Are Not Automatically Privileged, Says The SCA

In a landmark judgment, the Supreme Court of Appeal (“SCA”) in the case of Ibex RSA Holdco Ltd and Another v Tiso Blackstar Group (Pty) Ltd and Others 2025 (2) SA 408 (SCA) (“Ibex”), considered whether a private body could rely on legal privilege as a defence to deny access to a requested record, in terms of the Promotion of Access to Information Act 2 of 2000 (“PAIA”). This decision marks a pivotal moment in the evolution of corporate accountability in South Africa and clarifies the limits of legal privilege in the context of forensic investigations.

The case centred on the collapse of Steinhoff International Holdings NV (“Steinhoff”), which lost over R200 billion in shareholder value following the discovery of extensive accounting irregularities. 

In the wake of Steinhoff’s accounting crisis, Steinhoff instructed its attorneys to commission third party auditors, PricewaterhouseCoopers Advisory Service (Pty) Ltd (“PwC”), to conduct an independent forensic investigation into accounting irregularities within Steinhoff. PwC produced a comprehensive report running to approximately 4 000 pages (the “Report”). Steinhoff did not release the Report publicly but elected instead to publish an 11 page document titled “the overview of the Forensic Investigation”. When Tiso Blackstar Group (Pty) Ltd (a publishing group and digital publisher in South Africa) (“Tiso Blackstar”) and AmaBhungane Centre for Investigative Journalism (“AmaBhungane”), requested a copy of the Report under PAIA, Steinhoff refused access on the grounds that it was legally privileged in terms of section 67 of PAIA, framing the forensic work as protected from release. That refusal precipitated the litigation. The dispute effectively tested whether section 67 of PAIA could shield third‑party forensic work where the mandate is compliance‑driven. 

High Court

Tiso Blackstar and AmaBhungane (collectively the “respondents”) approached the High Court for an order setting aside Steinhoff’s decision to refuse access to the Report and directing Steinhoff to provide the records requested in the PAIA request within 10 days. Steinhoff opposed the application on the basis that the Report is privileged and that Steinhoff did not waive such privilege. It further argued that there was no public interest override applicable in the circumstances. The High Court ordered Steinhoff to provide the Report and Steinhoff appealed that decision to the SCA.

SCA’s Analysis 

While the issues before the SCA were conventionally framed—whether the PAIA requirements were met, whether privilege attached, whether it was waived, and whether section 70 applied—the judgment itself approached those questions through a more integrated lens. The Court’s reasoning was anchored in dominant purpose, tested against conduct inconsistent with confidentiality, and culminated in the application of the public‑interest override. The analysis below reflects that progression.

The SCA stated the following in relation to the issues considered

PAIA test

The procedural entitlement to access under PAIA was not contested. The real contest lay in whether Steinhoff could rely on the privilege exemption in section 67 of PAIA, and whether the statutory public interest override in section 70 of PAIA displaced any such claim.

Legal privilege

The SCA reaffirmed that litigation privilege is not established by association or labelling, but by purpose. To attract protection, the creation of the document must be directed at obtaining legal advice or advancing adversarial litigation, and that litigation must have been a real and foreseeable prospect at the time the document came into existence. In support of its privilege claim, Steinhoff relied heavily on PwC’s engagement letter, which was headed “Privileged in contemplation of litigation”. The SCA held that this characterization was not determinative. Privilege does not turn on form or description, but on an objective assessment of the dominant purpose for which a document was created. When the terms of PwC’s mandate were examined, they revealed an investigation directed at establishing the nature and extent of accounting irregularities for reporting and compliance purposes, rather than the provision of legal advice or preparation for contemplated litigation. The involvement of attorneys, and the engagement letter’s reference to privilege, could not alter that substantive reality, and, the claim to litigation privilege therefore failed at the threshold. Consequently, the Report was not subject to litigation privilege.

Waiver of Privilege

Even if privilege had attached to the Report, the SCA held that it could not be maintained in light of Steinhoff’s own conduct. By placing substantive aspects of the forensic findings into the public domain, Steinhoff acted in a manner inconsistent with preserving the confidentiality of the underlying material. Accordingly, Steinhoff could not rely on section 67 of PAIA as a defence to refuse access to the Report. Having voluntarily placed significant information in the public domain, Steinhoff could not maintain that the underlying Report remained immune from disclosure.

Public interest 

Finally, the SCA considered section 70 of the PAIA which requires that a private body grant access to a record if its disclosure reveals evidence of substantive legal contraventions or serious public safety or environmental risks, and if public interest in the disclosure of the record clearly outweighs the harm of disclosure. The SCA held that the Report's disclosure would reveal significant fraud and accounting irregularities, which is in the public interest. In light of the scale of the Steinhoff collapse and its impact on investors and the public, the public interest in transparency plainly outweighed any potential harm to Steinhoff. The public interest override therefore applied. The SCA accordingly dismissed the appeal.

The significance of the judgment extends well beyond the immediate dispute and has important implications for how boards and senior leadership should approach governance, privilege, and disclosure risk. The key takeaways are set out below.

Key Takeaways for Boards and Senior Leadership

Governance shift: From “Will this remain confidential?”, To “How would this read if disclosed?”

Boards should proceed on the basis that transparency is not a reactive obligation triggered by crisis, but a structural feature of sound governance frameworks, particularly in matters with public impact or regulatory significance. Legal privilege is narrow and must genuinely be established. Privilege will be upheld only where its application is clear and objectively defensible. Boards should expect privilege claims to be scrutinised against objective evidence and should guard against over‑reliance on privilege as a risk‑containment tool. Audit and risk committees must plan for disclosure, not assume confidentiality. In high‑impact matters, committees should operate on the realistic assumption that investigative material may enter the public domain - shifting the lens from Will this remain confidential? to How would this read if disclosed? - and ensure that oversight, documentation, and decision‑making can withstand scrutiny. Governance accountability extends beyond shareholders. The judgment reflects a governance environment in which regulators, investors, media, and civil society play a legitimate oversight role. Boards should factor this broader accountability landscape into risk assessment and strategic decision‑making. The public‑interest override is a governance risk that requires anticipation. Boards should ensure that governance structures are equipped to identify, escalate, and manage this risk proactively rather than defensively.

Conclusion

Taken together, these takeaways underscore a broader shift in how courts expect corporates to approach privilege, transparency, and accountability. Ultimately, the Ibex case, stands as a sharp reminder that legal professional privilege is a principled protection, not a tactical convenience. The judgment reflects a clear judicial resolve to look beyond form and rhetoric, to substance and purpose, particularly where investigations are commissioned in response to regulatory pressure, market expectations, or governance failures. Assertions of privilege will be tested against objective evidence, contemporaneous records, and the realities of why a document came into existence not merely how it is later characterised. In doing so, the SCA has sent an unmistakable signal that courts will not permit privilege to be used as a shield to suppress accountability or frustrate transparency where the public interest is engaged.

For corporates and their advisers, the implications are profound: decisions about who commissions investigations, how mandates are framed, and how findings are deployed may determine whether confidentiality is preserved or lost.

In an era marked by heightened scrutiny, constitutional commitments to openness, and increasing reliance on third‑party experts, the Ibex case underscores that privilege will protect what is genuinely legal in nature and will yield where investigations serve broader commercial, regulatory, or reputational ends.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.