Who has to be registered with the Information Regulator?
Every responsible party's Information Officer has to be registered, and so should any Deputy Information Officers the organisation designates. POPIA section 55(2) says officers "must take up their duties" only after the responsible party has registered them with the Regulator. Read literally, section 55(2) means an Information Officer should not take up their POPIA duties until registered.
By default the Information Officer is the head of the organisation. For a private body, PAIA section 1 defines the head as the person who carries on the business if it is a sole proprietor, any partner in a partnership, and the chief executive officer or equivalent (or a person duly authorised by them) in a company or other juristic person. POPIA section 56 requires the organisation to make provision for designating as many Deputy Information Officers as are necessary (if any) and for delegating the Information Officer's powers and duties to them.
In a law firm, that usually means a partner or director by default. Many firms authorise a named person to carry the role in practice. Whether an authorisation or delegation is properly done is a question for your own attorney or governance adviser, not for a portal form.
What do you need before you start?
You need a user profile on the eServices portal, the organisation's CIPC registration number if it has one, the organisation's contact details and physical and postal addresses, and the ID number, full name, physical address and contact details of the Information Officer and of each Deputy Information Officer. The Regulator's guide lists these as the mandatory fields.
- CIPC number. Used to pull the organisation's details automatically.
- Information Officer details. ID number, full name, physical address and contact details.
- Deputy Information Officer details. The same, for each deputy.
- Admin Officer details (optional). People who will help with eServices tasks for the organisation.
- A monitored email address. The certificate is sent by email.
Agree internally on who the Information Officer and deputies are before you open the form. The guide says My Organisations lets you view or change a registration, but if you cannot update officers there, contact the Regulator. It is cleaner to get the names right first.
How do you register on the eServices portal, step by step?
You register a user profile, log in, open Services, choose Information Officers and then New Registration, and work through the organisation, Information Officer, deputy and declaration screens. The steps below follow the Regulator's own eServices registration guide.
- Open the portal and create a profile. Go to eservices.inforegulator.org.za (or the eServices banner on inforegulator.org.za), register a user profile and log in.
- Go to Services, then Information Officers. Click Services in the top navigation and choose Information Officers. Use New Registration for a first registration, My Organisations to view or change an existing one, and Download Certificate for an organisation already registered.
- Choose the organisation type. The options are Public Organisation, Private Organisation and Private Organisation: Political Party. A law firm or SME is a private organisation.
- Enter the CIPC number, or choose Other. If the organisation is CIPC registered, choose that option and enter the registration number; the portal retrieves the details from CIPC. If the organisation is not CIPC registered (for example a partnership or sole practice), choose Other; the guide does not detail that path.
- Complete the organisation details. Fill in contact details and physical and postal addresses. Check them before you continue.
- Add the Information Officer. Enter the ID number, full name, physical address and contact details of the designated Information Officer.
- Add Deputy Information Officers and Admin Officers. Use Add Deputy IO for each deputy and Add Admin Officer for anyone who will help administer the registration. If there are none, the guide allows you to skip the step.
- Agree to the declaration and submit. Read the declaration, tick the box and submit. A confirmation page shows that the registration was received.
- Keep the certificate. The certificate is emailed to you and can be downloaded again at any time under Services, Information Officers. File it with your POPIA records.
Can someone else register on the firm's behalf?
The portal provides for Admin Officers, whom the Regulator's guide describes as "individuals designated to assist with eServices tasks for the organisation". In practice, that is how an outside attorney, company secretary or consultant can help. The Information Officer's own details still have to be the real Information Officer's, and the organisation remains responsible for what is declared.
Do you need to re-register if you used the old portal?
Check My Organisations on eServices first. The Regulator now runs registration through its eServices portal, and some practitioner guidance advises organisations registered on an earlier portal or by form to register again there. Guidance on this has changed over time, so if in doubt confirm with the Regulator.
The simple test: log in to eServices and look under My Organisations. If your organisation and its officers are not there, and you cannot download a certificate, register again. If you are unsure, ask the Regulator through the portal's iSupport option or at enquiries@inforegulator.org.za.
What about subsidiaries and groups?
The portal registers one organisation at a time, and POPIA ties registration to each responsible party, so a separate legal entity in a group will generally need its own registration; check with your attorney if your group structure is unclear. If your firm runs a separate company for property, trusts or IT, check whether it processes personal information in its own right.
Is there still a manual form?
A manual e-form submitted by email has been offered as a fallback for people who cannot use the portal, but the Regulator encourages online registration, and we could not confirm a current email address for manual submissions. If the portal fails you, log an iSupport ticket or contact the Regulator before relying on the manual route.
Why does this matter now?
Because the Regulator is now fining organisations that do not follow its enforcement notices, and in one recent case registering officers was one of the orders. On 26 October 2026 it announced a R500 000 administrative fine against Central Johannesburg TVET College (the same statement also covered a separate fine against FNB).
Be precise about why the college was fined. Its enforcement notice of 22 May 2026 followed complaints by three people whose personal information was shared with third parties without legal justification. The notice ordered it to register its Information Officer and Deputy Information Officer, apologise to the complainants, develop a POPIA compliance framework, train staff and take disciplinary action. At the end of the 120 days CJC responded; having considered the response, the Regulator found it had not complied, citing among other things the failure to report the security compromise in the prescribed manner, the missing compliance framework, a delayed apology and missed timeframes. The fine was for not complying with the enforcement notice, not for failing to register as such.
The lesson for a small firm is that registration is the cheapest item on the list and the easiest one to show. For how fines work, see POPIA fines explained, and for the wider pattern, POPIA enforcement so far.
What should you do after registering?
Name the Information Officer, with a working contact, in your PAIA manual and your privacy notice, and make sure that person actually receives requests. Registration tells the Regulator who is responsible; your published documents tell clients and the public.
- PAIA manual. Update the contact details so they match the registration.
- Privacy notice. See what a law firm privacy notice must include.
- Requests. POPIA section 55(1)(b) makes dealing with requests one of the Information Officer's duties. See handling data subject requests.
- Keep it current. When the Information Officer or a deputy leaves, update the registration under My Organisations, or contact the Regulator if the portal does not allow it.
For the rest of the year's checklist, see POPIA compliance in 2026. If the firm sends newsletters or marketing messages, the Information Officer should also know the section 69 rules, and for security incidents, see email fraud and trust accounts.
Frequently asked questions
Is registering an Information Officer mandatory, and does it cost anything?
POPIA section 55(2) says Information Officers may take up their duties only after the responsible party has registered them with the Regulator. Registration is done online through eServices; the Regulator's registration guide does not mention a fee, and we are not aware of one.
Who is the Information Officer in a law firm or SME?
By default, the head of the private body as defined in PAIA section 1: the owner of a sole practice, any partner in a partnership, or the CEO or equivalent (or a person duly authorised by them) in a company or incorporated practice. Deputies can be designated under POPIA section 56.
Do I need to re-register if I registered on the old portal?
The Regulator now runs registration through eServices, and some practitioner guidance advises re-registering if you used the old portal or form. Check My Organisations on eServices; if you are not listed and cannot download a certificate, register again.
Can my attorney or consultant register on our behalf?
The portal lets an organisation add Admin Officers to help with eServices tasks. The details entered must still be those of the real Information Officer and deputies, and the organisation is responsible for the declaration.
Do subsidiaries need separate registrations?
POPIA ties registration to each responsible party, so a separate legal entity that is its own responsible party will normally need to register its own Information Officer. Take advice if your group structure makes this unclear.
Where do I download the registration certificate?
The certificate is emailed after registration. You can download it again on eServices under Services, Information Officers, Download Certificate.
Check what your website says
Registration happens on the Regulator's portal, but clients judge you on what your website shows: a named Information Officer, a PAIA manual and a privacy notice that match. Our law firm assessment checks public privacy signals such as your privacy notice and consent handling. getohdit is not a law firm and nothing here is legal advice; for who should hold the role or how to delegate it, speak to an attorney.
Primary sources
- Protection of Personal Information Act 4 of 2013 (sections 55 and 56)
- Promotion of Access to Information Act 2 of 2000 (section 1, definition of "head" of a private body)
- Information Regulator: eServices registration guide
- Information Regulator eServices portal
- Information Regulator media statement, 26 October 2026: fines against CJC and FNB