Every organisation in South Africa that collects, processes, stores, or manages personal information is required to register an Information Officer with the Information Regulator. This obligation has been in place since POPIA came into full effect in 2021. Registration is free, it can be completed online, and it takes under 30 minutes.
Despite this, Information Officer registration remains one of the most commonly missed POPIA compliance obligations in the South African SME market. Many business owners either do not know the obligation exists, believe it applies only to large corporates, or have assumed that having a privacy policy on their website satisfies POPIA. It does not.
The Information Regulator has issued two R5 million fines — both for failures to comply with enforcement notices — and has publicly stated that direct marketing non-compliance and data breach management are priority enforcement areas for 2025 and 2026. The enforcement trajectory is clear. Unregistered Information Officers, unresolved data subject rights requests, and undocumented PAIA manuals are the compliance gaps the Regulator is increasingly finding when it investigates complaints.
What an Information Officer is
An Information Officer is the person legally responsible for POPIA and PAIA compliance within your organisation. They are the designated point of contact between your business and the Information Regulator, and the person responsible for ensuring that the organisation processes personal information in accordance with POPIA’s eight conditions for lawful processing.
The role exists under two pieces of legislation simultaneously. Under the Promotion of Access to Information Act (PAIA), the Information Officer is the person to whom requests for access to records must be directed. Under POPIA, the Information Officer is responsible for the organisation’s data protection compliance programme.
These are not two separate people. One person — the Information Officer — carries both responsibilities, though they may appoint and delegate to Deputy Information Officers as needed.
Who is automatically the Information Officer
By default, the Information Officer is the head of the private body. For a company, this is the CEO or managing director. For a close corporation, it is the managing member. For a sole proprietor, it is the owner.
This default appointment is automatic — it requires no formal internal process. The CEO, MD, or managing member is the Information Officer by virtue of their position, regardless of whether they know it, whether the organisation has a POPIA programme in place, or whether anyone has been “appointed” to the role.
The automatic appointment cannot be avoided by not appointing anyone. If your organisation has no registered Information Officer, your CEO is still legally the Information Officer — they simply have not registered, which is itself a compliance failure.
Can the role be delegated?
Yes. The head of the body may authorise another person to act as Information Officer. Any person authorised in this way must be at an executive level or equivalent position. The head of the body retains accountability for any power or function delegated — delegation does not remove the CEO’s legal responsibility, it shares the operational execution.
For organisations with subsidiaries, each entity in the group must appoint and register its own Information Officer. A single group-level registration does not cover subsidiary companies.
For multinational entities based outside South Africa that process South African personal information, an Information Officer must be authorised within South Africa.
What the Information Officer must do
Section 55(1) of POPIA sets out the duties of the Information Officer. In practical terms, these duties cover:
Compliance programme.The Information Officer must develop, implement, monitor, and maintain a POPIA compliance framework for the organisation. This includes the organisation’s privacy policy, its data processing register, its data retention policies, and its procedures for handling data subject rights requests.
PAIA manual.Every private body must compile and make available a PAIA manual describing what information the organisation holds, how people may request access to it, and who to contact. The PAIA manual is a statutory document — it is not optional and it is not the same as a website privacy policy.
Data subject rights requests.When individuals exercise their POPIA rights — requesting access to their personal information, requesting correction or deletion, or objecting to processing — the Information Officer is the person responsible for responding within the prescribed timeframes (typically 30 days).
Data breach notification. If a personal information breach occurs that is likely to affect a data subject adversely, the Information Officer is responsible for notifying both the Information Regulator and the affected individuals. This notification obligation has specific timeframes and content requirements.
Staff training.The Information Officer must ensure that staff who handle personal information understand their obligations under POPIA. Training is not optional — it is a mandatory compliance requirement and the Regulator may ask for evidence of training programmes during investigations.
Cooperation with the Information Regulator.The Information Officer is the organisation’s primary point of contact for the Information Regulator in complaints, investigations, and enforcement proceedings.
How to register — step by step
Registration is free. It can be completed online through the Information Regulator’s e-services portal or via manual email submission.
Online registration (recommended)
The Information Regulator’s registration portal is integrated with CIPC company data, which makes the process straightforward for registered companies.
- Go to inforegulator.bizportal.gov.za or access via inforegulator.org.za/portal
- Log in using your CIPC customer code credentials — the portal pulls your registered company details directly
- At the top of the Information Regulator Services page, select “Information Officer Registration”
- Review and accept the terms and conditions
- The Compliance Check section will display a list of enterprises where you are registered as a director or member — select the relevant entity
- Complete the Information Officer registration details — full name, ID number, position, and a direct email address (not a generic info@ address — the Regulator requires a personal, direct email)
- Add Deputy Information Officers if required
- Confirm the registration
Once submitted, a confirmation page is displayed and a registration certificate is sent to the registered email address. The certificate serves as official proof of compliance.
Manual registration (backup)
If you cannot access the portal:
- Download the registration form from inforegulator.org.za
- Complete the form — Part A covers the Information Officer, Part B covers Deputy Information Officers
- Email the completed form to Registration.IO@inforegulator.org.za
- An acknowledgement of registration should be received within 7 business days
- A registration certificate with a reference number follows
The Regulator encourages online registration but the manual process remains available.
What happens after registration
Registration is the beginning of POPIA compliance, not the end of it. Once your Information Officer is registered, the following obligations become active:
Your PAIA manual must be compiled and made available.If your organisation employs fewer than 50 employees and has an annual turnover below R5 million, you qualify for a reduced PAIA manual. For organisations above these thresholds, the full PAIA manual must be compiled and must be publicly accessible — typically on your website.
Your privacy notice must be current.Every time you collect personal information from a customer, employee, or supplier, the data subject must be notified of the purpose of collection, how the information will be used, who it may be shared with, and their rights under POPIA. A privacy policy page on your website satisfies the public-facing element — internal employee privacy notices are separate.
A data breach response plan must exist.The Regulator can ask for evidence that your organisation has a documented process for detecting, assessing, and reporting data breaches. The first R5 million fine — against the Department of Justice in 2023 — was partly the result of failing to implement security improvements required by an enforcement notice following a ransomware attack.
Data subject requests must be answered within 30 days. If a customer emails asking what personal information you hold about them, you have a legal obligation to respond. Ignoring or delaying the response is a POPIA violation.
The most common POPIA gaps in South African SMEs
For most small and medium businesses, POPIA compliance has a predictable gap pattern:
The Information Officer has not been registered — the business owner does not know the obligation exists, or assumes it applies to bigger companies. The PAIA manual has not been compiled — the website has a privacy policy but no formal PAIA manual. Staff have not been trained — the business has a POPIA notice on its email signature but no internal training programme. There is no documented data breach response plan — the business would not know what to do if a breach occurred.
None of these gaps require expensive consultants to close. The Information Officer registration takes 30 minutes. A basic PAIA manual template is available from the Information Regulator’s website. A staff training session on how to handle personal information is an afternoon’s work. A one-page data breach response plan — who is notified, within what timeframe, and how — covers the procedural baseline.
The Regulator’s enforcement trajectory suggests that organisations with unregistered Information Officers and no visible POPIA programme are at increasing risk as complaint volumes and audit activity grow. Getting the basics in order before a complaint is filed is materially cheaper than responding to a Regulator investigation after one is.
Check your POPIA status alongside the rest of your compliance baseline
ClearComply tracks POPIA Information Officer registration status as part of its compliance dashboard alongside CIPC, COIDA, UIF, and SARS obligations. The free compliance check at clearcomply.co.za/check shows your current status across all monitored obligations in 30 seconds.
For the full picture on POPIA enforcement consequences — including both R5 million fines issued to date — see our non-compliance penalties guide.
Sources: Information Regulator of South Africa — POPIA section 55, Information Officer registration guidance. Bowmans Law POPIA alert. Information Regulator e-services portal user guide (inforegulator.bizportal.gov.za). Masthead compliance note on Information Officer registration. All registration procedures verified against the Information Regulator’s published guidance.