What a POPIA information officer must do
The framework, impact assessment and PAIA manual a South African information officer must put in place under the POPIA Regulations, and how to keep them.
By Achekam · · 5 min read · For Running a business businesses in South Africa
Registering an information officer with the Information Regulator feels like the end of a compliance task. In fact it is the start of one. Once registered, the information officer has specific things to put in place, and they produce exactly the documents that others, from the Regulator to a large customer, may ask to see.
For a small or medium South African business, those duties can sound like a project for a consultancy. They need not be. This article sets out what the POPIA Regulations require the information officer to ensure, why size is no excuse, how the security requirement in section 19 fits in, and how to keep the resulting documents in a way that shows who changed what.
First, the role must be registered
The Information Regulator says public and private bodies must register their information officers with it under section 55 of POPIA, and that information officers may only take up their duties once registered. Registration is done on the Regulator's eServices Portal. Who the information officer is, and how registration works, is covered in your POPIA information officer and registration.
Everything below assumes that step is done.
Duty one: a compliance framework
The Information Regulator says that, under regulation 4 of the POPIA Regulations, an information officer must ensure that a compliance framework is developed and maintained.
"Framework" sounds grand, but for a small business it can be a short, honest document that answers practical questions:
- What personal information do we hold, about whom, and why?
- Where is it kept, and who can see it?
- Who in the business is responsible for what?
- How do we handle a request from someone who wants to see or correct their information?
- How do we respond if something goes wrong?
"Developed and maintained" matters as much as the content. A framework written once and filed is not maintained. Review it when the business changes: a new system, a new type of customer, a new office.
Duty two: a personal information impact assessment
The second item in regulation 4 is that a personal information impact assessment is done. In plain terms, this is looking at how the business processes personal information and asking where the risks are.
A workable approach for a smaller business:
- List the processes that involve personal information: sales enquiries, customer accounts, payroll, supplier records, CCTV, marketing.
- For each one, note what information is collected, who has access, where it goes and how long it is kept.
- Ask what could go wrong: information seen by the wrong person, kept too long, sent to the wrong address, lost.
- Record what you do about each risk, and what you still need to do.
Date the assessment and keep earlier versions. A later assessment that shows risks being closed off is good evidence that the framework is being maintained.
Duty three: a PAIA manual, made available
The third item is that a PAIA manual is developed and made available. The manual relates to the Promotion of Access to Information Act, which gives people a way to request records held by a body. Check the Regulator's current requirements for what the manual must contain and how it must be made available, and keep a copy of each version you publish.
The Regulator's POPIA page covers registering information officers, their duties, guidance notes, codes of conduct and the POPIA forms, and it is the first stop for the information officer when any of these three duties needs checking.
Size is no exemption
Small businesses sometimes assume POPIA is for banks and hospitals. The Information Regulator says any organisation, public or private and irrespective of its size, or any individual that processes personal information, is a responsible party with a duty to comply with POPIA's eight conditions for lawful processing.
A two-person accounting practice, a hair salon with a client list and a builder with a supplier database are all responsible parties. The duties scale with what you do, but they do not disappear.
Security safeguards under section 19
The framework and the impact assessment both lead to the same place: protecting the information. The POPIA text published on the government's page, in section 19 of the Act as published in 2013, requires a responsible party to secure personal information with appropriate, reasonable technical and organisational measures, including identifying foreseeable risks, maintaining safeguards, and regularly verifying and updating them.
The impact assessment is how you identify foreseeable risks. The framework is where the safeguards are described. The regular review is the "verifying and updating". Seen this way, the three duties and section 19 are one piece of work. What reasonable safeguards look like for a small business is covered in POPIA security safeguards for a small business.
Versioned documents and a record of who changed what
The information officer's work produces documents that change over time, and the history is part of the evidence.
In Achekam, Document Centre is a folder-based store where a business uploads files or whole folders, previews, downloads, renames, moves, tags, archives and searches them, and a new version of a file keeps the earlier ones. A folder for the POPIA framework, the impact assessments and the PAIA manual, each uploaded as a new version when it changes, gives you the sequence of revisions without anyone having to remember to rename files.
For records under Achekam's record governance, there is a further layer. Record Governance keeps a log of changes to governed records showing who did what, when and with what result, which can be filtered and checked for an unbroken chain. It sits under QUALITY & GOVERNANCE, in Record Governance, and viewing it needs the AUDIT_LOG_VIEW permission. It covers records under record governance, not every screen in the system, so be clear about which records it applies to before relying on it as evidence.
A short annual cycle
Once a year, the information officer can walk the same loop: update the impact assessment, revise the framework to match, check the PAIA manual is current and available, review the security safeguards, and upload the new versions. Done regularly, it stays a routine task rather than becoming a scramble when someone asks for the documents.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
