Your POPIA information officer and registration

Who a South African business's information officer is under POPIA by default, how deputies are designated, and why registration must come first.

By Achekam · 11 October 2026 · 4 min read · For Running a business businesses in South Africa

Ask the owner of a small South African business who its information officer is and the answer is often a blank look, or the name of whoever "does IT". Neither is quite right. POPIA decides who the information officer is, and for most businesses the answer is already fixed by law before anyone thinks about it.

What the law does not do automatically is register that person with the Information Regulator, and until that happens they may not take up the role at all. This article explains who the information officer is for a company, a sole trader and a partnership, how the role can be handed to someone else, how deputies are appointed, and the paperwork worth keeping.

The chief executive or managing director, by default

The Information Regulator's guidance note on information officers says the information officer of a company is automatically its chief executive officer or managing director, or the equivalent. Nobody needs to be appointed for that to be true: the person at the top holds the role.

The same guidance note says that person may authorise any natural person within the body to act as information officer. A managing director who does not want to carry the day-to-day work can authorise, for example, the financial manager or the office manager to act in the role. The authorisation should be clear about who is acting and from when.

Sole traders and partnerships

For businesses that are not companies, the guidance note sets out who holds the role:

For a sole trader the guidance note names the owner, so the role sits with them. A partnership has a choice, and should make it deliberately rather than assume that "everyone" is responsible.

The Regulator's guidance note on information officers explains who the information officer of a business is, how to designate deputies, how to register them with the Regulator and what their responsibilities are. The note carries a date of 1 April 2021 on its cover; the file was published on the Regulator's site in July 2025.

Register before taking up the duties

The step that is most often missed is registration. The Information Regulator says public and private bodies must register their information officers with it, as required by section 55 of POPIA, and that information officers may only take up their duties once registered. Registration is done on the Regulator's eServices Portal.

The POPIA text published on the government's page says the same in section 55(2) of the Act as published: information officers may only take up their duties after the responsible party has registered them with the Information Regulator.

So the order is fixed:

1. Identify who the information officer is, by default or by authorisation.
2. Register them on the Regulator's eServices Portal.
3. Only then does the person act in the role.

If the managing director changes, or the authorised person leaves, the registration needs to follow. A registration in the name of someone who has since left does not help the business.

Deputies: employees, designated in writing

Larger businesses often want more than one person handling information requests and privacy questions. The guidance note says only employees of a body can be designated as deputy information officers, and that the designation or delegation must be in writing.

Two practical points follow from that:

• Deputies must be employees. An outside consultant or a service provider cannot be a deputy information officer, however involved they are in your privacy work. They can advise; they cannot hold the role.
• Write it down. A verbal arrangement, or an assumption that the HR manager "obviously" handles it, does not meet the guidance note. A short signed letter naming the deputy, their scope and the date does.

Businesses that belong to a group, with several companies sharing staff, face extra questions about who registers for which entity; those are covered in information officers in a group of companies.

Keeping the authorisation and registration on file

The role leaves a small paper trail, and it is worth keeping it in one place:

• the written authorisation, if the chief executive has authorised someone else to act;
• each deputy's written designation;
• the confirmation of registration from the Regulator's portal;
• a note of any change, with the date it was registered.

In Achekam, those documents can sit in Document Centre, a folder-based store where a business uploads files or whole folders, previews, downloads, renames, moves, tags, archives and searches them. When a new version of a file is uploaded, the earlier versions are kept, so a replaced authorisation letter remains on record beside its successor.

The information officer will usually need to see more of the business's records than most staff. Achekam lets a business allow or deny what each role may do, check why a member may or may not act, and grant named permissions per role or per person, under SETTINGS, in Permissions & RBAC. Use that to give the information officer and deputies the access the role needs, and to keep personal information away from people who do not. What the role then involves day to day is set out in what a POPIA information officer must do.

Check the register this week

Confirm who your information officer is under the guidance note, check whether they are registered on the Regulator's portal, and put the authorisation and any deputy designations in writing. If any of the three is missing, that is the first piece of POPIA work to finish.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.