How to register an Information Officer with the Information Regulator

The head of your business is the Information Officer under the Protection of Personal Information Act 4 of 2013 (POPIA), automatically and by default. Before that person performs any of the duties of an Information Officer, they must be registered with the Information Regulator. Registration is done online, on the Regulator's own portal, at no charge, and takes most people less than an hour once they have gathered the details.

This guide covers who the Information Officer is, what the role involves, how to register on the portal, what a deputy is and whether you need one, and what to do when the business changes hands.

Who is the Information Officer

POPIA borrows the concept from the Promotion of Access to Information Act 2 of 2000 (PAIA). In a private body the Information Officer is the head of the business:

• For a sole proprietor, it is you.
• For a partnership, it is any partner.
• For a company or close corporation, it is the chief executive officer, managing director or equivalent, or the person the entity has authorised to act in that capacity.

You do not choose to become the Information Officer. The position attaches to the head of the business by operation of law. What you can choose is whether to designate one or more Deputy Information Officers to help. In a small business the owner is normally both the head and the person who does the work, so no deputy is needed. Once you have a manager who handles customer records, a bookkeeper who runs payroll, or a second branch, a deputy makes sense.

The Regulator has published guidance on the appointment and duties of Information Officers. Read it before you register. It is free on the Regulator's website.

What the Information Officer must do

The duties under POPIA and PAIA include:

• encouraging compliance with the eight conditions for lawful processing inside the business
• dealing with requests from people who want to know what information you hold about them, and with requests under PAIA for access to records
• working with the Regulator on any investigation into the business
• developing, implementing and monitoring a compliance framework, which for a small business can be a short document
• doing a personal information impact assessment where a new process or system carries risk
• compiling and maintaining the PAIA manual
• putting internal measures in place so that requests for information can be handled
• running internal awareness sessions so that staff understand POPIA

In practice, for a one-person business, this means: knowing what information you hold, having a privacy notice, having a PAIA manual, responding to requests, and having a plan for a breach. The POPIA compliance checker turns this list into a checklist you can work through.

How to register, step by step

1. Go to the Information Regulator's website and find the Information Officer registration portal. Do not use third-party sites that offer to register you for a fee. Registration on the Regulator's portal is free.
2. Create an account on the portal with a business email address you will still have in five years. The account belongs to the business, not the person, so avoid a personal address if you can.
3. Enter the business details: the registered name, trading name if different, the type of entity (sole proprietor, company, close corporation, partnership, trust, non-profit), the registration number where one exists, the physical address and contact details.
4. Enter the Information Officer's details: full name, ID number, position, email address and phone number. This is the head of the business.
5. Add any Deputy Information Officers with the same details. You can add them later if you are not sure yet.
6. Submit and download or print the confirmation. Keep it in your compliance file.
7. Sign an internal designation letter for each deputy, setting out what they are responsible for. The Regulator's guidance includes a template.

The portal has been updated more than once since POPIA came into full effect, so the exact screens change. If the portal is unavailable, check the Regulator's current notices for the alternative it accepts rather than assuming registration can wait.

Illustrative example: a plumbing firm with six staff

The example is illustrative only.

Sipho runs Brightwater Plumbing (Pty) Ltd in Gqeberha. He is the sole director. His sister Naledi handles the office, the invoicing and the customer database. An outside bookkeeper runs payroll.

Sipho is the Information Officer because he is the head of the company. He registers on the portal using the company's registration number, his own ID number and the office email. He designates Naledi as a Deputy Information Officer because she is the one who answers customer queries and would receive a request for access to information. The bookkeeper is not a deputy. She is an operator, and Sipho signs a one-page operator agreement with her instead.

Sipho writes a two-page compliance framework: what information the business holds, where, who can see it, how long it is kept, and what to do in a breach. Naledi writes the PAIA manual from the Regulator's template. Total time: one Saturday morning for the registration, one more for the documents.

What to do this week

1. Identify the head of the business for POPIA purposes and confirm that person understands they are the Information Officer.
2. Gather the registration details: entity type, registration number, addresses, ID numbers of the officer and any deputies.
3. Register on the Regulator's portal and save the confirmation.
4. Decide on deputies. If one person handles customer or staff records day to day, designate them.
5. Download the Regulator's guidance note on Information Officers and the PAIA manual template.
6. Draft a short designation letter for each deputy.
7. Diarise an annual review of the registration and the compliance documents.

Documents and records to set up

• Registration confirmation from the portal.
• A designation letter for each deputy, signed by the Information Officer and the deputy.
• A compliance framework, which for a small business is a two to four page document covering what personal information you hold, why, where, who has access, retention periods, security measures, how requests are handled, and the breach procedure.
• A PAIA manual on the Regulator's template, available at your premises and on your website if you have one.
• A request register logging every request for access, correction or deletion, the date received, and the date and nature of your response.
• A training record noting when staff were briefed on POPIA.
• The information inventory described in does POPIA apply to my small business.

Realistic timeline

• Day one: portal registration, under an hour.
• Week one: designation letters and the compliance framework draft.
• Weeks two to four: PAIA manual compiled and published, staff briefing held.
• Annually: review registration details, update deputies, refresh the manual.
• On any change of ownership or leadership: update the registration promptly, because the Information Officer is whoever heads the business now, not whoever registered.

Common mistakes and what they cost

• Registering the wrong person. The Information Officer is the head of the business, not the most junior person available or an outside consultant. A consultant may be able to act as a deputy, but the accountability sits with the head.
• Paying a third party to register you. Registration is free on the Regulator's portal. Sites that charge a fee are reselling a form you can complete yourself.
• Registering and stopping. Registration is the first duty, not the last. Without a PAIA manual, a privacy notice and a request procedure, the registration is a name in a database.
• Not updating after a change. When a business is sold or a director resigns, the old registration points at someone who no longer speaks for the business. A request or a Regulator letter goes unanswered, which is how enforcement starts.
• Treating the PAIA manual as optional. It is a separate legal duty under PAIA. The Regulator's template makes it a two-hour job.
• No request register. When a customer complains to the Regulator that you ignored them, your register is the evidence that you did not.

The costs of these mistakes are mostly time and exposure. An enforcement notice requires you to fix things on a deadline, and administrative fines can follow if you do not. Fine amounts are set by law and change, so no figure is given here. See what small business and POPIA compliance costs.

If you cannot afford an attorney

You do not need one to register. The Regulator's portal, guidance notes and PAIA manual template are free. The Small Enterprise Development Agency (Seda) offers business support that can include compliance basics. University law clinics in the main centres assist small businesses at low or no cost. If your dispute is really about money, for example a consultant who took a fee to register you and did nothing, the Small Claims Court hears claims up to its limit without attorneys. Legal Aid South Africa serves individuals rather than businesses but can point you to other resources.

Frequently asked questions

Is there a deadline to register? Registration must happen before the Information Officer performs any duties under POPIA. Since the head of a business that processes personal information is already the Information Officer, the practical answer is: register now.

Can I appoint an outside consultant as Information Officer? The Information Officer is the head of the business by law. You may designate deputies, and the Regulator's guidance addresses whether and how outsiders may fill that role. The accountability stays with the head of the business regardless.

Do I need a deputy? Not necessarily. Designate one when someone other than the head handles records day to day, or when the business has more than one site.

What if my registration email is no longer valid? Update it on the portal. If you cannot log in, contact the Regulator through the details on its website. Keep the confirmation and login details in your compliance file so that this does not happen.

Does registration make me compliant? No. It is one duty among many. Use the POPIA compliance checker for the rest.