Information officers for groups and foreign parents
Advising a South African client group or foreign-owned client on POPIA information officers: one per subsidiary, local deputies, written designations.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa
A client's group has a holding company, an operating company, a property-owning company and a small entity that employs the drivers. The group's financial director assumes one information officer registration covers all four. Another client is the South African subsidiary of a German parent, and the parent's data protection officer in Munich is sure she is already the information officer for everything.
Both assumptions are common, and both are wrong according to the Information Regulator's guidance. This article sets out what the Regulator says about groups and multinationals, and how a firm can keep track of the answer for each entity it looks after.
Every subsidiary is its own body
The Information Regulator says public and private bodies must register their Information Officers with it, as section 55 of POPIA requires, and that an Information Officer may only take up their duties once registered. Registration is done on the Regulator's eServices Portal.
Its guidance note on Information Officers goes further for groups. It says each subsidiary in a group of companies must register its own Information Officer and Deputy Information Officers with the Regulator. The guidance note is dated 1 April 2021 on its cover; the copy on the Regulator's site was uploaded in July 2025.
For the client group above, that means four registrations, not one. Whether one person can act for several of those entities turns on the default rule and the authorisation described next, but each entity's registration has to exist in its own right.
Who the officer is by default
The guidance note says the Information Officer of a company is automatically its chief executive officer or managing director, or the equivalent. That person may authorise any natural person within the body to act as Information Officer.
In a group, this often produces a mismatch. The group's compliance manager does the work for every company, but the managing director of each subsidiary is the officer by default unless they have formally authorised someone else. If the compliance manager is employed by the holding company only, ask whether they are "within the body" for each subsidiary, and get the authorisation documented for each.
Foreign parents need someone in South Africa
The guidance note says a multinational based outside South Africa must authorise a person within South Africa as its Information Officer, and that its Deputy Information Officers must be based in South Africa.
So the parent's data protection officer abroad can set group policy, but cannot be the registered Information Officer for South African purposes. The South African subsidiary needs:
- an Information Officer within South Africa, authorised in writing;
- Deputy Information Officers who are based in South Africa;
- a registration on the Regulator's portal in the subsidiary's own name.
When the client is also registering a foreign company's local presence with CIPC, it helps to deal with both at once; registering an external company covers that side.
Deputies: employees only, and in writing
The guidance note says only employees of a body can be designated as Deputy Information Officers, and that the designation or delegation must be in writing.
That rules out two shortcuts groups like to take: naming an outside consultant or the group's attorney as deputy, and naming an employee of a sister company. It also means the paper trail matters. For each entity, the client should be able to produce:
- the written authorisation, if the officer is not the managing director;
- the written designation of each deputy, showing they are employed by that entity;
- the confirmation of registration with the Regulator.
A worked example in words
Take the group with four companies. The holding company's managing director is its officer by default. She authorises the group compliance manager, who is employed by the holding company, to act as its Information Officer, in writing. In each of the three subsidiaries, the managing director either remains the officer or authorises one of that subsidiary's own employees. Each subsidiary designates at least one of its own employees as deputy, in writing. All four are registered separately on the portal.
If the drivers' company has no managing director of its own, the client needs to establish who the equivalent is, because the default rule still has to land on someone.
Keeping the group straight in Achekam
Advising on this is easier when the firm can see the whole group. In Achekam, staff can view clients grouped under their parent group, with each group's entities and engagement counts, and can create a group and add entities to it. Each entity is a client in its own right in the firm's client directory, added through the step-by-step wizard or a CSV import, and can be edited or archived later.
That structure suits a POPIA review. Work through the group's entities one by one, and for each one record who the Information Officer is, who the deputies are and whether the registration is confirmed. An entity missing from the group in the firm's records is often the same entity missing from the client's registrations. For the duties of the officer once registered, see the role of the information officer.
Advice to put in writing
When you raise this with a client group, set out the position entity by entity rather than in a single paragraph about "the group". Send the directors the Regulator's guidance note on Information Officers and Deputy Information Officers, which explains who the officer of a business is, how deputies are designated and how they are registered, and agree a date by which each entity's registration will be checked.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
