Appointing an Information Officer under POPIA is more straightforward than most owners expect, because the law has already made the first decision for you: the head of your organisation holds the role by default. What remains is practical - confirm who that is, decide whether to designate a deputy to carry the day-to-day work, record the appointment in writing with the statutory duties spelled out, give the officer the standing to do the job, and register with the Information Regulator before the duties are taken up. This article walks through those five steps.
For the legal background to the role itself - where section 55 comes from and what the Regulator expects - see our guide to the Information Officer under section 55. This article is the hands-on walkthrough.
Step 1: Confirm who your Information Officer already is
You do not choose your Information Officer from scratch. Under POPIA, the head of a private body is its Information Officer automatically: the owner of a sole proprietorship, the CEO or managing director of a company, the senior partner of a partnership. The role exists whether or not anything has been signed, and you cannot opt out of it.
So the first step is simply naming the person the Act already points to. If you run the business, that is you. In a company with a board, it is the person at the top of the executive structure, not whoever happens to have spare capacity.
Step 2: Decide whether to designate a deputy
The head of the organisation rarely has time to handle every access request personally, and the Act anticipates that. Under section 56 of POPIA, the organisation may designate one or more deputy Information Officers to whom the Information Officer can delegate duties - answering data subject requests, maintaining the PAIA manual, running staff awareness sessions.
Two things to keep straight when you delegate:
- Accountability stays at the top. A deputy carries the workload, not the responsibility. The head of the organisation remains the Information Officer and remains answerable for compliance.
- Deputies are registered too. A deputy must be registered with the Information Regulator before taking up the duties of the office, just like the Information Officer.
A good deputy is someone with enough seniority to ask other departments for records and get them: an office manager, a financial manager, a senior administrator. What matters is authority and access, not a job title.
Step 3: Record the appointment in writing
Nothing in the day-to-day of a small business proves itself. An appointment that lives only in a conversation cannot be shown to the Regulator, a client, or an auditor. The fix is a short, signed appointment letter that records:
- Who is appointed - the Information Officer's full name and position, and the deputy's, if you designate one.
- The statutory duties. Section 55(1) makes the Information Officer responsible for encouraging compliance with the conditions for lawful processing, dealing with requests made under POPIA, working with the Regulator during investigations, and otherwise ensuring the organisation complies with the Act. Regulation 4 of the POPIA Regulations adds the operational list: a compliance framework, a personal information impact assessment, a PAIA manual that is maintained and available, internal measures and systems for handling access requests, and internal awareness sessions.
- Signatures and date - the head of the organisation and the appointee, so the acceptance of the duties is on record.
POPIAdesk generates this letter for you: the Information Officer Appointment document always includes the section 55(1) and regulation 4 duties in full, adds your deputy's designation under section 56 when you name one, and lets you record any duties specific to your organisation on top.
Step 4: Give the officer standing, not just a title
An appointment letter on file does not by itself make the role real. Two practical moves do:
- Publish the contact details. Your Information Officer's contact details belong in your privacy policy and your PAIA manual, so a data subject who wants to exercise their rights knows exactly who to reach.
- Resource the role. The officer needs the authority to see how personal information actually moves through the business, and the time to deal with requests inside their deadlines. An appointee who cannot get answers from payroll or IT cannot do the job the Act describes.
Step 5: Register before taking up duties
Section 55(2) requires the Information Officer to be registered with the Information Regulator before taking up the duties of the office. Registration is done on the Regulator's eServices portal and is free, and deputies are registered the same way. The registration process - the portal, the details you need at hand, and the confirmation to keep on file - is covered in the registration section of our section 55 guide.
Frequently asked questions
Can our Information Officer be someone other than the CEO?
The role itself defaults to the head of the organisation, and the accountability stays there. What you can do is designate a deputy under section 56 and delegate the day-to-day duties to them, which in practice is how most organisations run it.
I am a sole proprietor. Do I still need to do all of this?
You are already the Information Officer - the role attaches to you as the head of the business automatically. The steps that still matter are the written record, publishing your contact details, and registering with the Regulator before taking up the duties.
Does an Information Officer need a legal qualification?
No. The Act prescribes duties, not qualifications. What the role needs is authority within the organisation, working knowledge of what personal information the business holds and why, and the time to handle requests properly - which is also why a well-chosen deputy matters more than a certificate.
Check where you stand
The Information Officer is the anchor of the rest of your compliance: the privacy policy, PAIA manual, and request process all point back to this role. To see how the rest of your setup measures up, take the free POPIA assessment - it takes about five minutes and shows you exactly which pieces are in place.
This is general information, not legal advice. For your specific situation, consult an attorney.