How to register with the Information Regulator (step by step)

Registering with the Information Regulator happens on its eServices portal at eservices.inforegulator.org.za, it is free, and it is not optional: section 55(2) of POPIA requires your Information Officer to be registered before taking up the duties of the office. The process itself has four steps - create a portal account, activate it and log in, register your organisation, and add any deputies before you submit - and it goes fastest when you gather the details the form asks for before you start. This walkthrough covers each step, what to have at hand, and the questions owners ask most.

This article assumes the appointment side is settled: who your Information Officer is, and whether a deputy will carry the day-to-day work. If it is not, start with our walkthrough on how to appoint an Information Officer, then come back here for the registration.

Registration comes before the rest of the job

The sequencing matters more than most owners realise. Section 55(2) does not say the Information Officer should register at some point; it says the officer takes up their duties only after registration with the Regulator, and section 56 applies the same rule to deputies. Every other part of the role - answering data subject requests, maintaining the PAIA manual, dealing with the Regulator during an investigation - formally sits behind this one administrative step.

The portal profile also carries obligations beyond the registration itself. PAIA annual reports are submitted through the same eServices account, and the Regulator runs that submission window on fixed dates: in 2026 it ran from 1 April to 30 June, with no extensions granted. An organisation that only creates its profile when the reporting window opens is doing two unfamiliar processes under one deadline.

One history note before you start. The Regulator's original registration portal was retired, and since 1 May 2024 all of its online services - Information Officer registration, PAIA annual reports, breach notifications, and the public register of organisations - live on the eServices portal. If your business registered on the old portal, your registration is not lost, but it must be migrated to the new one; the FAQ below covers how.

What the form asks for

Have these ready before you create the account:

The Information Officer's particulars - ID number, title, full name and surname, email address, and cell phone number. The portal allows one account per ID number, and the activation link and login codes go to the email address you enter, so use an address the officer actually reads.
Your company registration number, if the business is registered with the CIPC. The portal looks the company up by this number and pulls its director list from the CIPC records, so having it exact saves a support ticket.
Each deputy's particulars, the same set as for the Information Officer, if you are designating deputies.
Your previous registration certificate number, only if you registered on the old portal and are migrating.

Step 1: Create the account

On the eServices portal, choose the option to register as a new user (or to migrate an existing profile, if you hold an old-portal registration). Enter the Information Officer's particulars and set a password. The portal also allows an administrative user to create the registration on the Information Officer's behalf, which is useful where the officer is the owner or CEO and someone else runs the paperwork; the officer named in the registration is still the one who holds the statutory role.

Step 2: Activate the account and log in

The portal emails an activation link to the address you registered. Click it, then log in from the Regulator's site. Logins are verified with a one-time PIN sent to the registered email address, so the mailbox from step 1 needs to be one you can open on the spot. Once the OTP is accepted you land on the portal dashboard.

Step 3: Register your organisation

From the dashboard, open the Information Officers section and add your organisation. For a CIPC-registered company, the portal retrieves the company record and its directors from the registration number; confirm the details it pulls through and complete whatever it could not, including the Information Officer's own details. If you are migrating from the old portal, this is where the previous certificate number comes in: the portal uses it to find your existing registration and carry it across.

Step 4: Add deputies, submit, and file the confirmation

Add any deputy Information Officers before you finalise, since deputies must be registered before taking up their duties just as the Information Officer must. Then submit the registration and keep the confirmation the portal issues. It belongs in the same file as the signed appointment letter: the appointment records who holds the role, and the registration proves the Regulator was told. If you have not put that letter in place yet, the appointment walkthrough above covers it, and POPIAdesk generates the Information Officer Appointment document with the statutory duties spelled out.

Frequently asked questions

Is there a deadline for registering?

There is no calendar deadline for the registration itself. The Act ties it to the role instead: the Information Officer must be registered before taking up the duties of the office, which in practice means the registration belongs at the start of your compliance work, not the end. The dated deadline to keep in view is the PAIA annual report window on the same portal, which the Regulator holds to fixed dates each year.

Does registration cost anything?

No. Registration on the eServices portal is free, for the Information Officer and for deputies. If a provider quotes a fee for the registration itself, you are paying for the typing, not the Regulator.

We registered before May 2024, on the old portal. Do we need to register again?

Your registration must be migrated to the eServices portal, since the old registration portal was retired when eServices launched. Create the account as in step 1, choose the migration option, and have your previous registration certificate number ready so the portal can find and carry across your existing record.

Where this fits in the bigger picture

Registration is the visible half of step one of our POPIA compliance checklist for small businesses; the privacy policy, PAIA manual, and request process all build on it. To see how the rest of your compliance measures up, take the free POPIA assessment - it takes about five minutes and shows you exactly which pieces are in place.

This is general information, not legal advice. For your specific situation, consult an attorney.