Information Officer responsibilities under POPIA
An Information Officer needs a functioning privacy programme, with clear responsibilities and evidence of follow-through. Section 55 of POPIA sets out the role, including registration before taking up duties. Regulation 4 adds specific responsibilities. The role needs time, authority and support from the business.
By POPIA Check · Editorial update · General information, not legal advice
What to organise first
- Confirm who holds the role, the registration record and any written deputy arrangements.
- Identify the processing activities, systems and people responsible for day-to-day controls.
- Maintain a compliance framework and a visible register of outstanding actions.
- Ensure that a personal information impact assessment is done, with decisions and safeguards recorded.
- Keep workable request handling and staff awareness arrangements.
Read older guidance with the 2025 amendments
The April 2025 amendments add continual improvement to the compliance-framework duty and remove regulation 4(1)(c) and 4(2). PAIA's own manual requirements still need separate attention. Use the amended regulations alongside the Regulator's earlier Information Officer guidance, rather than treating the older summary as the complete current wording.
Build a practical review rhythm
| Review topic | Evidence to discuss | A useful outcome |
|---|---|---|
| Changes to processing | New systems, suppliers and purposes. | A named reviewer and recorded decisions before rollout. |
| Requests and incidents | Restricted case log and unresolved issues. | Clear follow-up and escalation owners. |
| Access and retention | Sample access reviews and completed retention actions. | Evidence that controls operate beyond the policy. |
| Open gaps | Action register and overdue items. | Agreed priorities, resources and a review date. |
An illustrative first-month plan
In the first week, locate role and registration records and meet process owners. Next, follow one representative data flow and record the unknowns. Then agree the most urgent evidence checks and rehearse a request or incident with fictional details. Finish by reporting the open issues and resources needed to management. This is an organisational planning example, not a statutory timetable.
Use a readiness report to focus the discussion
The free self-assessment can organise questions across eight areas. Keep its uncertain answers visible and attach evidence references to your action plan. It cannot replace registration, an impact assessment or the Information Officer's ongoing oversight.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Gather the evidence. Assign the actions.
Download seven editable registers with examples and step-by-step instructions.
Get the free starter toolkitKnow what to work on next.
Get a free PDF gap report, then decide whether to discuss it with your chosen partner.
Start free assessmentView a sample report