POPIA Information Officer: Duties, Registration, Delegation

By operation of law it is the head of the private body, the CEO, managing director, or equivalent (for public bodies, the head of that body). The head may authorize another person at executive level, and must then still ensure the function is performed. Practically, most companies keep the CEO as information officer of record and appoint deputies who run the program day to day. What you cannot do is appoint a junior employee as 'the' information officer and consider the executive layer discharged: the Regulator's guidance is explicit that accountability sits at the top.

Before taking up duties, the information officer (and deputies) must be registered with the Information Regulator; the Regulator provides a registration portal and prescribed forms collecting the organization's details, the officer's identity and contact information, and deputy appointments. Registration should be updated when officers change, after mergers, or when structures reorganize. Keep the confirmation on file: it is the first document requested in Regulator correspondence, and unregistered-officer status undermines the organization's accountability posture in any enforcement engagement.

The Promotion of Access to Information Act requires every private body to publish a manual describing its structure, the records it holds, how to request access, and (post-POPIA) the processing of personal information: purposes, categories, recipients, transfers, and security. The manual must be available at the registered office and on the website. It predates POPIA but POPIA folded personal-information transparency into it, making it the South African analogue of a privacy notice plus records index. The information officer signs it, keeps it current, and the Regulator checks it early in investigations because it is public and dated.

The Regulator's guidance requires the information officer to develop, implement, monitor, and maintain a compliance framework: policies mapping the eight processing conditions to controls, a personal-information inventory, impact assessments to identify risks and treatments, security safeguards aligned with Condition 7, breach response with 'as soon as reasonably possible' notification, data subject request procedures, direct-marketing compliance (Section 69 opt-in), transfer justifications under Section 72, training, and processor (operator) contracts. In substance it is a full privacy program charter, the point of assigning it to an executive is that budget and authority follow accountability.

Nearly inverted. The GDPR DPO must be independent, advisory, protected from dismissal for performing duties, and free of conflicts, deliberately not the accountable decision-maker. POPIA's information officer is the accountable decision-maker: the head of the organization, personally responsible for compliance, with no independence requirement because the role is not oversight but ownership. Multinationals reconcile this by pairing them: the global or regional DPO advises; the South African entity's CEO holds the registered information officer role with deputies executing locally; charters document the interface so neither role's legal requirements are compromised.