I apologize for misunderstanding your request. Here's the original text with formatting applied as per your instruction:
POPIA IMPLEMENTATION: APPOINTMENT AND REGISTRATION OF INFORMATION OFFICERS
The information regulator (IR) has recently issued their Guidance Note on Information Officers and Deputy Information Officers. This is an important step in clarifying the position of Information Officers (IOs) and Deputy Information Officers (DIOs) within organisations.
The IO of an organisation is the person who is responsible for their data privacy compliance. The Guidance Note has a useful table setting out exactly who the IR will see as IO for various bodies.
This article is only focusing on private bodies.
The net result of the above is that the IO is, by default, the head of an organisation. This is unless an IO is appointed in terms of the abovementioned guidance note. Even when appointed, however, they may only take up this appointment once registered with the IR.
Some risk can be conferred to this appointed IO as they are required to be senior within the organisation. The person ultimately responsible for POPIA and PAIA compliance will, however, always be the head of the company. This is important as the Guidance Note confirms that an Information Officer may (on conviction) be held criminally liable for certain offences in terms of the PAIA.
If your company is a multinational (and operating in South Africa) you will be required to designate a person within South Africa as your IO.
The IO is then responsible for compliance with the POPIA and the PAIA. This can be by whatever means they deem appropriate (as the legislation is principle based and not prescriptive) but in terms of Regulation 4 of the POPIA Regulations they must, at least ensure that:
Sections 56 of the POPIA and 17 of the PAIA, allow for the appointment of any number of DIOs who may be conferred any power or responsibility of the IO. The need for a DIO, or DIOs, must be determined using the structure and size of an organisation. While the Guidance Note states that all multinationals must appoint a DIO in South Africa.
Only sufficiently qualified employees may be designated, in writing, as DIOs (from manager level and above). Whereafter they are to be given sufficient time, resources, training and budget to comply with their delegated responsibilities.
The DIOs are to act as the “face” of data privacy for an organisation. They are the people who will likely run the day-to-day activities of data privacy within an organisation. The IO, however, may step in at any time as the IO is the person ultimately responsible.
Both IOs and DIOs need to be registered with the IR, starting from 1 May 2021.
In a media statement, the IR stated that it is creating an online portal to facilitate the registration of IOs. This portal should be online by the end of April. The portal, however, has yet to be launched. Consequently, we would recommend manually making manual appointments using the form issued by the IR.
Internally, there should be an appointment letter issued and signed by the IO and/or DIOs. The internal appointment letter must capture, at a minimum, the same level of detail as set out in the Guidance Note but should also capture specificities of the company – which may need to remain confidential, such as Research and Development. This letter is especially important if the IO and/or DIOs have dual roles.
Should you need assistance in appointing, training or registering your IOs or DIOs, contact one of our data privacy experts here at Atvance Intellect.
CLICK HERE
to connect with our expert
Brendon Ambrose
Back to Articles