3 September 2026LANTEK Computers
Of all the POPIA conversations we have, this is the one that produces the longest pause. Not because the requirement is complicated, but because the answer to who is your Information Officer is usually you, and the person being told that did not know they had the job.
None of what follows is legal advice. It is the shape of the role as we routinely explain it to clients, and the point at which you should be talking to your attorney is marked.
You already have one
The part that catches people is that this is not an appointment you make or decline. Under POPIA, if a business has not designated somebody, the role falls by default to the head of the organisation. For a small company that is the managing director or the owner. For a partnership it is the partners. For a sole proprietor it is you.
So the question is never whether you have an Information Officer. It is whether the person who holds the role knows they hold it, and whether anything has been done about it.
It applies to every business that processes personal information, and that is effectively every business. If you have staff, you process personal information. There is no size threshold below which this stops applying.
What the role is actually responsible for
The duties are less about technology than people expect. In plain terms, the Information Officer is accountable for the business complying, which breaks down into a handful of real activities.
Making sure somebody has worked out what you hold and why. Not doing it personally. Making sure it is done, and knowing the answer.
Making sure reasonable security measures exist. This is the Section 19 obligation, and it is the one most likely to be delegated to a provider. Delegating the work does not delegate the accountability, which is worth being clear about when you buy IT services. What that looks like practically is in what POPIA actually requires from a business with no IT department.
Dealing with requests from people about their own information. Somebody asking what you hold about them, asking for it to be corrected, or asking for it to be deleted. These arrive rarely and then all at once, usually during a dispute.
Handling a breach. Assessing whether personal information was accessed, deciding with advice whether it is notifiable, and doing the notifying. In practice this means the Information Officer is the named owner during an incident, which is exactly the role described in the first 24 hours.
Being the point of contact for the Regulator. If the Information Regulator writes to your business, it is addressed to this role.
The PAIA manual. A separate Act, related obligation, and it also lands here. Ours is on the PAIA manual page.
Registration
Information Officers must be registered with the Information Regulator before taking up their duties, through the Regulator’s own portal.
We are deliberately not printing a deadline or a fee here. Both have moved since POPIA commenced, the portal itself has changed, and the practical position is better confirmed on the day than read in an article. Ask your attorney or check the Regulator’s site directly.
What is worth knowing is that registration is administrative rather than onerous, and that a business which has not registered is in a position that is easy to remedy and awkward to explain if left.
Deputies, and why you probably want one
You may designate Deputy Information Officers. Nothing forces a small business to, and plenty do not.
Two reasons to consider it anyway. The first is availability: if the only person who can respond to a request or a breach is the managing director, then December and any period of leave is a gap. The second is practicality: the person who actually knows where the information lives is frequently not the person at the top.
A deputy does not remove the head of the business’s accountability. It creates somebody who can act.
Can you outsource it
The accountability, no. The head of the organisation cannot contract out of being the Information Officer, and any supplier offering to become your Information Officer so you do not have to worry about it is describing something POPIA does not provide for.
The work, yes, and sensibly so. Somebody else can maintain the inventory, operate the security measures, run the review, draft the manual and be on the telephone during an incident. That is a normal division of labour. What you are buying is the doing, not the responsibility, and a provider being straight with you will say so.
What good looks like
You do not need a compliance department. What you want is that a named person can answer four questions without preparation.
Who is the Information Officer here, and are they registered. What personal information does this business hold, and where. What have we done to secure it, and who decided that was enough. What would we do in the first hour if we thought it had leaked.
A business that can answer those four is in a materially better position than one with more policies and no answers, and the gap between the two is usually an afternoon of work rather than a project.
The most common mistakes
Assuming somebody else took care of it. Frequently the bookkeeper, the attorney or the IT provider is assumed to have done it. Ask, specifically, and get the answer in writing.
Naming somebody without telling them. A designation nobody knows about is worse than the default, because now there is a named person who does not know they are named.
Treating it as a policy exercise. A document nobody follows does not help. A short record of real decisions does.
Leaving the person who left. If your registered Information Officer no longer works there, that needs updating.
Where to go next
Our own details for exercising rights are on the Information Officer page, and how we build the security side of this into what we do is on Compliant by design.
If you have got this far and concluded that you are the Information Officer and nothing has been done, that is an extremely common place to be and it is not a crisis. Start with the inventory, get registration confirmed with your attorney, and ask us about the security half.