Protection of Personal Information

Public and Private bodies are required to register with the Information Regulator their Information Officers as outlined in  section 55 of POPIA.

Who should be registered as an Information Officer?

Information Officers are, by virtue of their positions, appointed automatically in terms of PAIA and POPIA. Information Officers of public and private bodies must designate and/or delegate any power or duty to Deputy Information Officers, as necessary to make the body as accessible as reasonably possible.

Registering Information Officers

The Information Officers are required, in terms of Section 55(2) of POPIA, to take up their duties only after being registered with the Regulator. The registration of Information Officers can be done on the Regulator’s E-Services Portal

Your duties as the Information officer

Section 55(1) of POPIA sets out the duties and responsibilities of an Information Officer which include the following:-

  • the encouragement of compliance by the Body with the conditions for the lawful processing of personal information.

an Information Officer may develop a policy on how employees should implement the eight (8) conditions for the lawful processing of personal information or consider issuing a circular in the case of provincial and national departments;

  • dealing with requests made to the Body pursuant to POPIA.
  • working with the Regulator in relation to investigations conducted pursuant to Chapter 6 of POPIA in relation to the body
  • ensuring compliance by a body with the provisions of POPIA

The additional duties and responsibilities of the Information Officers, in terms of regulation 4 of POPIA, are to ensure that

  • a compliance framework is developed, implemented, monitored and maintained;
  • a personal information impact assessment is done to ensure that adequate measures and standards exist in order to comply with the conditions for the lawful processing of personal information;
  • manual is developed, monitored, maintained and made available as prescribed in sections 14 and 51 of PAIA, as amended;
  • internal measures are developed together with adequate systems to process requests for information or access thereto;
  • internal awareness sessions are conducted regarding the provisions of POPIA, regulations made in terms of POPIA, codes of conduct, or information obtained from the Regulator; and
  • upon request by any person, copies of the manual are provided to that person upon the payment of a fee to be determined by the Regulator from time to time..

Related Resources

Guidance Note on Information Officers and Deputy Information Officers

Guidance note on direct marketing in terms of the Protection Of Personal Information Act of 2013 (POPIA)

The purpose of this Guidance Note is to guide the responsible parties on how to comply with POPIA when processing personal information of data subjects for direct marketing by means of unsolicited non-electronic communications in terms of sections 11 and unsolicited electronic communications in
terms of section 69 of POPIA.

Processing of personal information of voters, and the countering of misinformation and disinformation during elections.

The purpose of the guidance note is to guide political parties and independent candidates in respect of the scope and applicability of the Protection of Personal Information Act, 4 of 2013 (POPIA) and measures that can be taken to comply with the provisions of POPIA, whilst ensuring the free flow of accurate and reliable information to achieve free and fair elections.

Processing of Special information

The purpose of this Guidance Note is to guide responsible parties who are required to obtain authorization from the Regulator to process special personal information, as provided for in section 27(2) of POPIA.

Processing of Personal Information of Children

The purpose of this Guidance Note is to guide responsible parties who are required to obtain authorisation from the Regulator to process personal information of children, as provided for in section 35(2) of POPIA.

Processing Personal Information in The Management and Containment of COVID-19 Pandemic

Processing of Personal Information of a Voter by a Political Party

The purpose of the document is to guide political parties with regards to the scope and applicability of the Protection of Personal Information Act, 4 of 2013 (POPIA) in relation to political parties.

Guidance Note: Processing of Personal Information of a Voter by a Political Party in terms of the Protection of Personal Information Act, 4 of 2013, 28 Jan 2019

In terms of the provisions of section 61 (2) of the Protection of Personal Information Act (POPIA) No 4 of 2013, the Information Regulator gives notice that is in receipt of a codes of conduct from:

Guidelines

Protection of Personal Information (POPIA) Forms

This Guidance Note is issued to guide responsible parties who are currently processing or intend to process personal information which is subject to prior authorization to ensure compliance with the relevant provisions of the Protection of Personal Information Act 4 of 2013 (POPIA).

POPIA prescribes the eight (8) conditions for the lawful processing of personal information by or for a responsible party. These conditions are not applicable to the processing of personal information to the extent that such processing is exempted in terms of section 37 or 38, from one or more of the conditions concerned in relation to such processing.