The Protection of Personal Information Act, 2013, (POPI) does more than prescribe regulations in relation to the personal information of data subjects (the person to whom the information relates).
If the responsible party (such as a business, or body corporate) breaches the conditions of lawful processing of personal information, it may be sued for damages. This is in addition to any other penalties, or enforcement action against it.
Most notably, the responsible party can be held liable for the damages regardless of whether the breach or non-compliance was intentional or negligent.
The attached article deals with the questions of who may sue, what for, and how much may be involved. It also deals with defences and out of court settlements.