The update, which allows WhatsApp to collect personal data from users, has prompted a global backlash.
But it has received no agreement from WhatsApp, it added.
"We are obligated as the Regulator to ensure the protection of personal information of all South African citizens and monitor compliance of the POPIA by responsible parties," Chairperson of the Regulator, Advocate Pansy Tlakula said.
"Under the circumstances, the Regulator is briefing attorneys to prepare an opinion on the way forward in terms of litigation," the Regulator said.
The Regulator has raised concerns that citizens of the EU will receive significantly higher privacy protection than people in South Africa and Africa.
In March, a WhatsApp spokesperson said the update does not expand the company's ability to share data with Facebook, nor does it impact the privacy of users' messages with friends or family.
The Regulator has also asked the Portfolio Committee on Justice and Correctional Services, a parliamentary oversight committee, to request Facebook South Africa and WhatsApp LLC testify in Parliament on this matter, it said.
"Given Facebook's status as one of the world's largest companies, the Regulator is of the view that it should work together with other organisations in order to hold Facebook accountable," it added.