Every South African business that handles personal information already has an information officer, whether or not anyone has used the title. In a private company it is usually the CEO or the person at the top. That person must be registered with the Information Regulator through its online portal, and they can share the workload with deputies. This guide explains who that person is, what they are responsible for and how to register, using real business situations.
Key Takeaways
- The information officer is not hired from outside. In a private body the role falls to the CEO, managing director or the person in the highest position of authority, or someone that person authorises.
- Registration is done online on the Information Regulator’s eServices portal. The certificate is issued automatically and emailed to you.
- Duties go beyond a name on a form: encouraging lawful processing, handling requests, working with the Regulator and keeping a PAIA manual.
- Large or complex businesses can designate deputy information officers, but the delegation must be in writing and the information officer stays accountable.
- Particulars must be kept current and updated at intervals of not more than one year.
Table of Contents
- What an information officer is, and why the law asks for one
- Who is your information officer?
- What the information officer is responsible for
- Deputy information officers: sharing the load
- How to register your information officer
- Keeping the registration current
- Making the role easier to carry
- Where the toolkits fit
- FAQ
- Sources
What an information officer is, and why the law asks for one
The Protection of Personal Information Act 4 of 2013 (POPIA) is the South African law that governs how public and private bodies handle personal information. It also set up the Information Regulator, which oversees POPIA and the Promotion of Access to Information Act (PAIA).
Think about why. Your customers’ phone numbers, your staff’s ID numbers and your suppliers’ bank details all sit somewhere in your business. The law wants one named, accountable person who makes sure that information is treated properly, who customers and the Regulator can contact, and who can answer when someone asks, “What do you hold about me?”
That person is the information officer. It is a responsibility role, not a technical one. You do not need to be an IT specialist or a lawyer. You need the authority to make decisions and the willingness to build good habits into the business.
Who is your information officer?
The Information Regulator’s guidance note on information officers says information officers are appointed automatically by virtue of their positions. You do not apply to become one. In practice:
| Type of body | Who the information officer is |
|---|---|
| Public body | The Director-General (or person acting as such), the provincial Head of Department, or the Municipal Manager |
| Private company or similar body | The CEO or equivalent, or a person authorised by that officer |
| Sole proprietor | The owner, or a person the owner duly authorises |
| Partnership | Any partner, or a person authorised by the partnership |
The Regulator’s own portal puts it simply: in a private body it is the CEO, managing director or person in the highest position of authority.
A freelancer’s story
Thandi is a freelance graphic designer in Durban. She keeps client contact details, invoices and the occasional ID copy for a contract. She is a one-person business, so she is her own information officer. There is no one else to appoint. What she needs to do is register herself and make sure her habits match what a business holding personal information should be doing: knowing what she keeps, why she keeps it and when she deletes it.
A growing company’s story
Sipho runs a 12-person logistics company in Gauteng. He is the managing director, so he is the information officer. But he is also on the road most days. He has to think about who in the business can carry the day-to-day work. That is where deputies come in.
What the information officer is responsible for
Section 55(1) of POPIA sets the core duties, which the Regulator’s guidance note summarises:
- encouraging the business to comply with the conditions for lawful processing of personal information;
- dealing with requests made to the business under POPIA;
- working with the Regulator in relation to investigations; and
- otherwise ensuring the business complies with POPIA.
The POPIA Regulations add practical detail. According to the Regulator’s POPIA page, Regulation 4 includes:
- developing, implementing, monitoring and maintaining a compliance framework;
- conducting a personal information impact assessment;
- developing internal measures and adequate systems to process requests for information or access;
- running internal awareness sessions on POPIA, the Regulations, codes of conduct and information from the Regulator; and
- developing, monitoring, maintaining and making available a PAIA manual.
What this looks like on an ordinary Tuesday
The wording sounds heavy, but each duty maps onto something familiar:
- Compliance framework: a short set of written rules on how your business collects, stores, shares and deletes personal information.
- Impact assessment: a walk through the business asking, “What personal information do we hold, where does it live and who can see it?”
- Request systems: a simple route for a customer or employee to ask what you hold on them, and a person who knows how to respond.
- Awareness sessions: a short team conversation so the person at reception and the person in payroll treat information the same way.
- PAIA manual: a document that tells people how to request access to records your business holds.
If you want to see how POPIA and PAIA fit together, our guide to PAIA versus POPIA explains it from a business owner’s point of view. For a practical run through the steps, see the POPIA compliance checklist for small business.
Deputy information officers: sharing the load
Section 56 of POPIA allows a private body to designate deputy information officers. The guidance note explains the main points:
- Whether you designate one depends on the size and structure of your business. More than one can be designated if operations are large or complex.
- Only employees of the business can be designated.
- The information officer may delegate powers and duties to a deputy, but the delegation must be in writing. The information officer remains accountable for the functions delegated.
The same note says a deputy should have enough time, resources and financial means to do the work, report to the highest level of management, be accessible to anyone with a request, and understand POPIA, PAIA and how the business actually runs.
Back to Sipho. He designates his operations manager, Nomsa, as deputy information officer, and records the delegation in writing. Nomsa knows the systems, sees the staff daily and is easy for customers to reach. Sipho still carries accountability, so he sets a monthly ten-minute check-in with her. That is a sensible design: authority at the top, daily attention where the work happens.
Industry guidance points the same way. The ASISA guidelines say each responsible party must register its own information officer, and that deputies must be registered as such with the Regulator. If your business is part of a group, each company needs its own registered officer rather than one registration covering them all.
Questions to ask before designating a deputy
- Who in the business already deals with customer and staff records daily?
- Does this person have the time, and will they be given it?
- Can customers easily reach them?
- Do they have a direct line to the top decision-maker?
- Is the delegation written down and signed?
How to register your information officer
Registration is done online through the Information Regulator’s eServices portal. The portal states that it is processed immediately, with no manual approval step, and that a certificate is issued automatically and emailed to you.
What to have ready
The portal form asks for:
- The organisation: registered name, registration number, type and address details.
- The information officer: full name, ID number, designation, appointment date and contact information.
- Deputies and admin officers: the same kind of details for each one.
The Regulator’s guidance note adds that the form needs the postal and street address, phone number, fax number if any, and email address of the information officer and every deputy.
A simple order of work
- Confirm who your information officer is, using the table above.
- Decide whether you need deputies, and put each delegation in writing.
- Gather the details listed above in one document.
- Register on the eServices portal and save the emailed certificate.
- Make sure the details in your PAIA manual match what you gave the Regulator. The guidance note says they must be the same.
- Diarise a review so the particulars are updated at intervals of not more than one year.
Keeping the registration current
Businesses change. People resign, get promoted, or move on. The Regulator’s guidance note says particulars of the information officer and deputies must be updated at intervals of not more than one year. The portal also says that when your information officer changes, the details are updated in the information officers section of eServices.
A useful habit: tie the review to something you already do each year, such as your financial year-end or your annual staff planning. When a new managing director arrives or a deputy leaves, treat the update as part of the handover, not a separate chore.
There is also an annual PAIA report. Per the portal, the PAIA Annual Report is submitted from April to June each year through eServices. Check the portal for the current reporting requirements.
Making the role easier to carry
Most owners find the registration form the easy part. The harder part is turning the duties into routine. A few approaches that work for small and growing businesses:
- Start with a map. List the types of personal information you hold: customers, staff, suppliers, website visitors. Note where each sits, whether in a spreadsheet, an accounting package or a cloud tool.
- Write down the rules once. A short internal policy beats a long one nobody reads.
- Plan for requests. Decide who receives a request, who replies and where it is recorded.
- Look at who you share with. Payroll providers, cloud storage and marketing platforms all handle your data. If any are outside South Africa, our guide to cross-border data transfers under POPIA explains the thinking.
- Teach the team. Ten minutes at a staff meeting beats a document in a folder.
Our wider overview of POPIA compliance for small business shows how these pieces fit together, and our page on data security and breaches covers keeping information safe.
POPIA is one part of building a credible, well-run business. If a question goes beyond what you can settle yourself, such as how a specific contract handles personal information, speak to an attorney who practises data protection law.
Where the toolkits fit
Being a good information officer is easier when your legal foundations are already in place. Ownership, employment, commercial arrangements and data protection all touch each other: the way you onboard an employee, work with a supplier or share information with a partner all involve personal information.
PocketAdvisor Legal Toolkits™ are digital boxes of expert-led videos, practical workbooks, professionally drafted South African legal agreements and compliance resources. The Legal Toolkit™ for Start-Ups and Solopreneurs (R1495, one-off) is designed around legal foundations, which suits someone like Thandi. The Legal Toolkit™ for SMEs (R2495, one-off) is designed around governance and commercial arrangements for growing businesses, which suits someone like Sipho. Understand the legal foundations your business needs: Explore PocketAdvisor Legal Toolkits™.
FAQ
Do I have to appoint an information officer?
In a private body the role attaches automatically to the CEO or person in the highest position of authority, or a person that officer authorises. You do not apply for it. What you do need to do is register that person with the Information Regulator.
Can I be my own information officer?
Yes, if you are a sole proprietor. For a natural person the information officer is that person or someone duly authorised by them. A partnership’s information officer is any partner or a person authorised by the partnership.
Can an outside consultant be my deputy information officer?
The Regulator’s guidance note says only employees of the business can be designated as deputies. A consultant can advise you, but the designated people must be inside the business.
What do I need to register?
You need the organisation’s registered name, registration number, type and address, plus the full name, ID number, designation, appointment date and contact details of the information officer and any deputies. Registration is done on the Regulator’s eServices portal, and the certificate is emailed to you.
How often must I update my details?
The Regulator’s guidance note says at intervals of not more than one year. Update the portal whenever your information officer changes, and keep your PAIA manual consistent with what the Regulator holds.
Sources
- Protection of Personal Information Act 4 of 2013, South African Government
- Guidance Note on Information Officers and Deputy Information Officers, Information Regulator
- Guidance Note on Information Officers and Deputy Information Officers (deputy designation and delegation)
- eServices: Information Regulator, Information Officers
- Information Regulator, POPIA page
- ASISA Guidelines on the Protection of Personal Information, March 2024
Recommended
This article is for educational and informational purposes only. It is not a substitute for professional advice.
