In terms of the Protection of Personal Information Act 4 of 2013, an Information Officer will need to be appointed by your business in order to process queries related to POPI such as requests for information that you have stored about an information subject, as well as to take steps to ensure the organization’s compliance with POPI.
Information officers are encouraged to train staff in the nuances of POPI and to create POPI-related guidelines for staff. There are numerous penalties, including criminal ones, for not complying with one’s duties to register and failure to abide by their duties as an information officer. An information officer may delegate their duties to a deputy information officer, who must be an employee of the firm. This deputy information officer or officers must have their duties in written form in their job description.
All public or private bodies must register an information regulator. In the case of a partnership, it will be the partner; in the case of a business, it will be the CEO or managing director or a person of similar executive standing.
Those persons identified as information officers must complete an online registration form, as noted in the following link: https://www.justice.gov.za/…/InfoRegSA-GuidanceNote-IO…
An information officer is mandated to manually complete a printed, physical form contained at pages 23-28 of the above link, as well and to send this form to the following address (as per paragraph 13 of the link): registration.IR@justice.gov.za. The form can also be posted to the information regulator at the following address: PO Box 31533; Braamfontein, Johannesburg, 2017.
Once completed, you also have the option of delivering the completed form physically to the following address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
The information regulator will have the names and contact details of the information officers available on its website for the purposes of transparency once their database is updated.
