DPOs and Notification Requirements
Jump to
DPOs and Notification Requirements Start Comparison
Is the concept of data protection officer (DPO) recognized in the jurisdiction?

Last review date: 31 December 2024

Yes.

Are there circumstances in which it is mandatory to appoint a DPO or similar position?

Last review date: 31 December 2024

No.

The position of the information officer ("DPO") is an automatic appointment, with the CEO or head of an organization designated as the de facto information officer in terms of PAIA. In addition to an information officer, a responsible party is entitled to appoint or designate deputy information officers as required in order to perform the duties placed on the information officer. The information officer and the deputy information officer are required to be registered with the Information Regulator and can only take up their duties in terms of POPIA upon being registered with the Information Regulator.  The information officer's and the deputy information officer's details are to be included in the manual prepared in terms of  PAIA and are made available on the Information Regulator's website. Responsible parties are encouraged to register their information officers, but at the moment, a failure to do so is not considered an offence.

Where a DPO is appointed, does the DPO have to meet specific requirements?

Last review date: 31 December 2024

If yes, what are these requirements?

☒  resident in the jurisdiction

☒  other

Yes.

Any person authorized as an information officer should be at an executive level or equivalent position. This means that only an employee of a private body at a level of management and above should be considered for authorization as an information officer of that body.

To ensure accessibility of a private body, the information officer of a multinational entity based outside South Africa must authorize any person within South Africa to act as its information officer.

Are there obligations to notify, submit filings to, register with or obtain approval from local data protection authorities to collect and/or process personal data generally?

Last review date:  31 December 2024

No.