Who is the information officer?
You do not appoint an information officer into existence — the Act designates one: for a private body, the head of the body (the CEO or equivalent; for a sole proprietorship or partnership, the proprietor or a partner). The head may authorise another person in writing — and should, because the role is operational. The Regulator’s Guidance Note sets the bar for that delegation: “only an employee of a private body at a level of management and above should be considered for authorisation as an Information Officer”, with deputy information officers below for the day-to-day. The role is POPIA’s answer to the GDPR’s DPO — but unlike a DPO, it exists in every organisation automatically.
The registration duty
“Officers must take up their duties in terms of this Act only after the responsible party has registered them with the Regulator.”
The Guidance Note calls registration “a compulsory requirement”, requires each subsidiary in a group to register its own officer, and registration now runs through the Regulator’s eServices portal — the same portal that handles breach reporting, which is a second reason to have credentials before an incident. And the Regulator checks: the Central Johannesburg TVET College enforcement notice (22 May 2026) included, among the findings, a straightforward failure “to register the Information Officer with the Regulator” — see the enforcement tracker.
The duties
Section 55(1) lists the statutory core: encouraging and ensuring compliance with the Act, dealing with requests made under it, cooperating with the Regulator in investigations, and otherwise ensuring compliance. Regulation 4 turns that into a programme: develop, implement and maintain a compliance framework; conduct a personal information impact assessment to ensure adequate measures and standards; develop and maintain the PAIA manual; build internal awareness; and ensure data subject requests are handled. In practice the officer owns the compliance shortlist end to end.
Setting the role up properly
- Decide who actually does the work; if not the CEO, authorise a management-level employee in writing
- Appoint deputies where size or structure needs them — in writing, with defined portfolios
- Register the officer (and each subsidiary’s officer) on the eServices portal before duties begin
- Stand up the regulation 4 deliverables: compliance framework, impact assessment, PAIA manual, awareness training
- Wire the officer into incident response — they file the breach reports and answer the Regulator
- Revisit on every leadership change: the designation follows the office, not the person who left