The Information Regulator South Africa

What The Information Regulator South Africa does

The Information Regulator (South Africa) is an independent statutory body established under section 39 of the Protection of Personal Information Act (POPIA) 4 of 2013, accountable to the National Assembly and subject only to the Constitution. It was constituted in December 2016 with the appointment of Chairperson Adv Pansy Tlakula and four members, assumed PAIA functions from the South African Human Rights Commission in June 2021, and obtained full enforcement powers on 1 July 2021. It operates a dual mandate: enforcing POPIA (data protection) and PAIA (Promotion of Access to Information Act), covering all public and private bodies that process personal information in South Africa.

The Regulator's core digital product is an eServices Portal that consolidates Information Officer registration (Section 55 of POPIA), security compromise notifications (Section 22 of POPIA, launched April 2025), POPIA and PAIA complaint submission, and PAIA annual report submissions. Supporting services include the iSupport helpdesk, published guidance notes, codes of conduct, and enforcement notices. The technology stack is a conventional web portal (no API, SDK, or AI capabilities disclosed) and the organization has no subsidiaries, no commercial revenue model, and no funding rounds. Distribution is self-serve and direct through the website and portal.

The business model is a hybrid of Parliamentary appropriations (the primary funding mechanism) and transaction-based fees (PAIA request fees for private bodies at R140 per requester and public bodies at R100 per requester, plus per-page, search, and preparation charges). The CEO (Mr. Mosalanyane Mosala, permanent since July 2021) serves as accounting officer under the Public Finance Management Act, and the Auditor-General audits financial records annually. Customers are mandated rather than chosen: national, provincial and local government departments; private companies and organizations that process personal information; designated Information Officers; and data subjects (citizens) lodging complaints or PAIA requests. International engagement includes MOUs with Eswatini and Mauritius and leadership roles in the African Network of Information Commissions and the International Conference of Information Commissioners.

Name

The Information Regulator South Africa

Legal name

Information Regulator (South Africa)

Website

https://inforegulator.org.za

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

51–100 employees

Short description

The Information Regulator South Africa is an independent statutory body, established under POPIA, that enforces data protection (POPIA) and access to information (PAIA) compliance by all public and private bodies, and serves data subjects across South Africa.

Ownership category

akta.pro rank

Product category

Data Protection Regulation

NAICS

Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (92615), Public Administration (92)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

akta.pro secondary industry

Consumer Protection & Product Safety Regulators (BPAIAOAE)

Keywords

• Data protection regulation
• Privacy compliance enforcement
• Access to information rights
• Regulatory oversight services
• Statutory body governance

Headquarters

HQ city

Johannesburg

HQ country

South Africa

HQ region

Africa

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Infrastructure, Marketing or Sales, Others

Revenue model

1. Parliamentary Appropriations: Government funding through annual appropriations from Parliament for operational expenses
2. Fees Collected: Fees collected from regulated entities for various services including PAIA request fees, information officer registration, and other regulatory services

Pricing tiers

Distribution channels3 records

Marketing channels7 records

Core offering

The Information Regulator is an independent statutory body that monitors and enforces compliance with the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA) by public and private bodies in South Africa. Its core services include Information Officer registration, security compromise notification handling, complaint investigation and enforcement, codes of conduct development, PAIA request fee administration, and public education on privacy and access to information rights, delivered primarily through the eServices Portal.

Product overview

The Information Regulator South Africa operates as a regulatory body overseeing data protection and access to information rights. Its digital service offering centers on the eServices Portal, which serves as the primary online platform for regulatory interactions. The core services include Information Officer registration (mandatory under POPIA Section 55), security compromise notification submission (Section 22), POPIA and PAIA complaint handling, compliance assessments, and annual PAIA reporting. Supporting services include the iSupport helpdesk for public inquiries, guidance notes and regulatory forms, codes of conduct development, and enforcement notice issuance. The Regulator is subject to audit by the Auditor-General and has received recognition including the BCX Digital Innovation Award for its eServices Portal.

Differentiator

Problem solved

Functional benefit

Products and services

• eServices Portal A comprehensive online portal enabling public and private bodies in South Africa to register Information Officers, submit security compromise notifications, lodge complaints, submit PAIA annual reports, and access regulatory services electronically.
• Information Officer Registration Statutory registration service for Information Officers as required under Section 55 of POPIA, enabling public and private bodies to designate officials responsible for data protection compliance.
• POPIA Compliance Services Regulatory services supporting compliance with the Protection of Personal Information Act, including guidance notes, assessment processes, complaint handling, enforcement notices, and codes of conduct development.
• PAIA Compliance Services Regulatory services supporting compliance with the Promotion of Access to Information Act, including manual templates, form processing, compliance assessments, and annual reporting submissions.
• Security Compromise Notification System Online platform for responsible parties to report security compromises (data breaches) to the Regulator as required under Section 22 of POPIA, operational as of April 2025.
• iSupport Helpdesk Central helpdesk platform for handling general queries from the public regarding POPIA, PAIA, regulatory obligations, and the Regulator's services.
• PAIA Annual Report Submission Service Annual submission service for public and private bodies to report on access to information requests received and processed, as required under Section 32 and Section 83(4) of PAIA.

Quantifiable outcome

• R5 million administrative fine issued to Department of Justice and Constitutional Development for POPIA contravention
• +1 more outcomes

Named customers3 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

Seven partnerships are on record, tiered core and minor.

• Eswatini Communications CommissioncoreStrategic or Co-development Partner · 19 June 2024Memorandum of Understanding signed for cooperation in information regulation, sharing of best practices, and regulatory alignment in data protection and access to information between South Africa and Eswatini.
• Data Protection Office of MauritiuscoreStrategic or Co-development PartnerMOU signed for cooperation between the Information Regulator South Africa and the Data Protection Office of Mauritius, facilitating collaboration on data protection regulatory matters.
• African Network of Information Commissions (ANIC)coreStrategic or Co-development PartnerActive membership and participation in the African Network of Information Commissions, hosting the 2024 conference and engaging with delegates from other African information commissions.
• International Conference of Information Commissioners (ICIC)coreStrategic or Co-development PartnerParticipated in and hosted the 14th edition of the International Conference of Information Commissioners, advancing global standards for information regulation.
• NaspersminorGTM or Marketing PartnerCo-hosted International Data Privacy Day dialogue with Naspers in January 2025.
• Independent Electoral Commission (IEC)minorStrategic or Co-development PartnerCollaborated on dialogue regarding misinformation and disinformation during election periods.
• Media Monitoring AfricaminorStrategic or Co-development PartnerJoint dialogue on misinformation and disinformation during elections.

Scale indicators3 records

Recent moves6 records

Expansion highlights4 records

Direct peers

• Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI): Germany's federal data protection and freedom of information commissioner. Direct comparator combining privacy and FOI mandates, with independent statutory authority and significant enforcement powers.
• Personal Data Protection Commission (PDPC) Singapore: Singapore's data protection authority administering the Personal Data Protection Act with a comparable enforcement and advisory model, including breach notification portal, sectoral codes, and active international engagement.
• Commission Nationale de l'Informatique et des Libertés (CNIL): France's independent data protection authority, enforcing GDPR-equivalent national law. Comparable in statutory independence, enforcement powers (including fines), and online services for breach notification and complaints handling.
• Information Commissioner's Office (UK): UK's independent data protection and information rights regulator, enforcing UK GDPR and the Data Protection Act alongside Freedom of Information. Highly comparable dual mandate of data protection and access to information, with a digital self-service portal and strong enforcement track record.
• Data Protection Commission (Ireland): Ireland's data protection authority, one of the most active EU regulators due to the concentration of US tech headquarters. Comparable enforcement profile (large fines, high-profile cases), online portal for breach notification and complaints.
• Office of the Australian Information Commissioner (OAIC): Australia's independent regulator covering both privacy (Privacy Act) and freedom of information (FOI Act). Direct functional analogue to the Information Regulator South Africa's dual POPIA/PAIA mandate.
• Garante per la protezione dei dati personali (Italy): Italy's data protection authority, comparable in operating a national portal for data breach notifications, handling complaints, and issuing enforcement decisions with statutory independence.
• Autoriteit Persoonsgegevens (AP) — Dutch DPA: Netherlands' independent data protection authority enforcing AVG/GDPR with online breach notification portal, comparable enforcement toolkit including fines, and active international cooperation.
• Office of the Privacy Commissioner of Canada: Canada's federal privacy regulator enforcing PIPEDA and the Privacy Act. Comparable statutory role with breach reporting, complaint handling, and compliance guidance — although access-to-information is handled by a separate Information Commissioner.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/inforegulatorsa
• YouTubeyoutube.com/channel/UCZeYaiwMa2iO0DhmN714K_A
• Facebookfacebook.com/InformationRegulatorSA
• LinkedInlinkedin.com/company/information-regulator-sa

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about The Information Regulator South Africa