Protection of personal information and access to universities' records requires the establishment of a records management division to handle personal information. Yet little attention has been focused on the roles and responsibilities of records management professionals, who enable the management of personal information. The purpose of this chapter is to assess and compare the current state of the implementation of the Protection of Personal Information Act No 4 of 2013 in two South African universities, namely the University of Venda and the University of Witwatersrand. The chapter used a qualitative research approach. Secondary data were derived from a literature search and primary data from interviews. Despite the enactment of the act, privacy breaches continued to increase due to the ineffective records management division dedicated to the management of personal information. Universities are to strengthen their internal process on personal information to comply with the General Data Protection Regulations (GDPR).