You Are the Information Officer by Default — Now What?
Here is a job you already hold, whether or not anyone told you: if you run a South African company, you are its information officer under POPIA. The Act assigns the role to the head of the organisation automatically — no board resolution, no opt-out. For most small-business owners the discovery comes late, usually when a tender or a client questionnaire asks who your information officer is. Here is what the role actually involves and how to get it properly set up in an afternoon.
- ✔The CEO, owner or equivalent is the information officer by operation of law — no appointment needed.
- ✔Registration with the Information Regulator is free and done on the online portal.
- ✔A deputy information officer can carry the day-to-day work, but accountability stays with you.
- ✔The information officer is the Regulator’s first point of contact in any complaint or breach.
- ✔Fines under POPIA reach R10 million — the role is personal, not just a title.
The information officer you did not appoint
POPIA defines the information officer by position, not appointment: for a company it is the CEO or equivalent; for a close corporation, the members; for a sole trader, the proprietor. If that is you, the duties are already yours — encouraging compliance, handling requests from people whose data you hold, working with the Regulator, and ensuring the internal rules and training exist. ‘I did not know’ is not a defence the Act recognises.
You may appoint one or more deputy information officers — the bookkeeper who runs payroll, the office manager who holds the files — and delegate the daily work to them in writing. What you cannot delegate is accountability: the Regulator holds the head of the organisation responsible. The full role description is in the information officer guide.
Registering your information officer with the Regulator
Registration happens on the Information Regulator’s online portal and costs nothing. You supply the organisation’s details, the information officer’s particulars, and any deputies, and receive confirmation to keep on file. Update the registration when the role-holder changes. It is a short process — the slow part is usually gathering the company registration numbers and contact details the form asks for.
When a complaint or breach lands, the Regulator contacts the registered information officer first. If nobody is registered, the investigation starts with an organisation that has already missed its most basic POPIA duty — not the first impression you want.
What an information officer actually does all year
The calendar is lighter than the title sounds. Once the foundations are in — privacy notices for staff and customers, operator agreements with anyone processing data for you, retention rules, basic security — the ongoing work is maintenance: fielding access or correction requests, keeping the notices current when systems change, refreshing staff awareness, and running the response if personal information is ever lost or leaked (the breach response plan).
Frame it this way: the information officer is simply the named adult for data in your business. Every other POPIA duty — notices, security, retention, breaches — hangs off that role existing and being registered. The full employer-side picture is in the POPIA pillar guide.
Always confirm current requirements with the official source — rules and deadlines change.
- ✔Admin Boss handles registrations, filings and payroll admin
- ✔Registered tax practitioner · 20+ years experience
- ✔Fully remote — all 9 provinces
Frequently asked questions
Who is the information officer in a small company?
The head of the organisation — the CEO, managing director or owner — holds the information officer role automatically under POPIA. No appointment is needed for the role to exist; only registration with the Information Regulator makes it official.
Can the information officer role be outsourced?
The day-to-day work can be delegated to a deputy information officer appointed in writing, and consultants can support the compliance work. But legal accountability stays with the head of the organisation — the role itself cannot be outsourced.
Is information officer registration compulsory?
The Information Regulator requires information officers and deputies to be registered on its online portal. Registration is free, and it is the first thing checked when a complaint or breach triggers an investigation.
Last reviewed: July 2026 · How we research our guides
EmployerGuide.online provides general information about South African employer obligations — not legal, tax or professional advice for your specific situation. Laws, rates and deadlines change; confirm current requirements with the official sources linked above, or ask Admin Boss. See our disclaimer.