Every South African business that handles personal information already has an information officer, whether it knows it or not. Under the privacy and access-to-information laws, the head of the organisation holds the role by default. The question is whether that person has been registered, understands the duties and has the systems in place to meet them.
The role has become more visible. The Information Regulator now issues enforcement notices against public and private bodies, and in June 2026 it ordered a JSE-listed mining company to set aside a refusal of access to records, finding that the company had not justified relying on the commercial information exemption. Registered information officers are also the gateway to the Regulator’s annual reporting system. A body whose officers are not registered on the Regulator’s eServices portal cannot file its PAIA annual report, which is due by 30 June each year.
This article explains who the information officer is, what the law requires of them and how to put the role on a proper footing.
Two laws, one role
The information officer has responsibilities under two related statutes:
- the Protection of Personal Information Act 4 of 2013 (POPIA), which regulates how organisations collect, use, store, share and destroy personal information; and
- the Promotion of Access to Information Act 2 of 2000 (PAIA), which gives people a right to request access to records held by public and private bodies.
The Information Regulator enforces both. In practice the same person usually handles privacy compliance and access requests, and the Regulator expects the details recorded for them to match across both regimes.
Who is the information officer?
For a private body, the information officer is the head of the body. The Regulator’s guidance note on information officers explains how this works in practice:
- Sole proprietor: the person trading, or someone they authorise.
- Partnership: any partner, or someone the partnership authorises.
- Company or other juristic person: the chief executive officer, managing director or equivalent officer, or the person acting in that role. That person may authorise someone else in writing.
- Group companies: each subsidiary is a separate responsible party and must register its own information officer.
- Foreign-based multinationals: must authorise a person in South Africa.
Authorising someone else does not remove accountability. The head of the business remains responsible for compliance, so it is risky to hand the role to a junior employee and forget about it. The guidance expects an authorised person to be at management level or above.
Deputy information officers
Section 56 of POPIA and section 17 of PAIA allow, and in larger organisations effectively require, the designation of one or more deputy information officers. They must be employees, should be accessible to the public and should understand the business and the legislation. The information officer may delegate duties to deputies in writing, but remains accountable for how those duties are performed.
Registration with the Information Regulator
Section 55(2) of POPIA requires information officers to be registered with the Regulator before they take up their duties. Registration is done online through the Regulator’s eServices portal. Details must be kept current, for example when the CEO changes or a deputy leaves. Out-of-date registrations are a common gap, and they now have a practical consequence: you cannot submit the annual PAIA report without registered officers.
What the information officer must do
Under POPIA
Section 55(1) of POPIA sets out the core responsibilities:
- encouraging compliance with the conditions for lawful processing of personal information;
- dealing with requests made under POPIA, such as requests by data subjects to access or correct their information;
- working with the Regulator in investigations; and
- otherwise ensuring that the organisation complies with POPIA.
Regulation 4 of the POPIA Regulations adds practical duties, including developing, implementing, monitoring and maintaining a compliance framework, conducting a personal information impact assessment, putting in place internal measures and systems to process requests, and running internal awareness sessions. The Regulations were amended with effect from 17 April 2025. Among other changes, the amendments call for the compliance framework to be continually improved, and they moved the duty to maintain the PAIA manual out of the POPIA Regulations, as it already sits in PAIA itself.
Under PAIA
- PAIA manual. Private bodies must compile a manual under section 51, describing the records they hold, how to request access and the categories of personal information they process. It must be available on the website, if there is one, and at the principal place of business.
- Responding to requests. Requests must be decided within the statutory timeframe, generally 30 days, which can be extended in limited circumstances. A refusal must be based on a ground in PAIA and explained, and parts of records that are not protected should be released.
- Annual reporting. Under section 83(4), the Regulator collects annual information from private bodies about the requests they received and how they dealt with them. Reports are submitted on the eServices portal by 30 June, covering the year ending 31 March.
The cost of getting it wrong
The Regulator can investigate complaints, conduct assessments and issue enforcement notices requiring specific steps within set timeframes. Failing to comply with an enforcement notice is a criminal offence, and POPIA allows administrative fines of up to R10 million. PAIA also creates offences for wilfully or with gross negligence failing to comply with the manual requirement. Beyond the legal exposure, a poorly handled access request or data breach can quickly become a reputational problem with clients, staff and the media.
A practical checklist
- Confirm who your information officer is, and whether you want to authorise a senior manager to act in that role.
- Designate deputy information officers in writing, with clear delegations.
- Register (or update) all officers on the Information Regulator’s eServices portal.
- Prepare or update your PAIA manual and publish it on your website.
- Document your POPIA compliance framework and complete a personal information impact assessment.
- Set up a register and a simple internal process for PAIA and POPIA requests, with response deadlines.
- Train staff who receive requests, complaints or breach reports, so that they know to escalate them immediately.
- Diarise the annual PAIA report and a yearly review of registrations, the manual and the framework.
How O’Reilly Law can help
We help businesses set up and maintain their POPIA and PAIA compliance. This includes advising on the appointment and authorisation of information officers and deputies, preparing PAIA manuals, privacy policies and compliance frameworks, conducting personal information impact assessments, training staff, and responding to access requests, complaints, breaches and Information Regulator investigations.
Contact us to review your information officer appointment and POPIA and PAIA compliance.
Related reading: Data breaches under POPIA: what business owners must do · Direct marketing and data protection: new obligations for South African businesses
This article is general information and not legal advice. Correct as at October 2026.