If you’ve heard about or received an information notice from the information regulator, you may be wondering what it is and whether it’s harmless. The truth is there’s a lot for you to consider and action that you will need to take if you’ve received an information notice. An information notice is related but different from an infringement notice or an enforcement notice so do not get the them confused.

The information regulator will typically serve an information notice on a responsible party when a data subject or some other party has complained about that responsible party. Sometimes, the regulator can also independently decide to perform this assessment or investigation, but because the regulator won’t know enough about any given responsible party to independently want to investigate them, you need not worry about this as much. Regardless of how the regulator gets involved, their ultimate goal will be to assess (section 89) or investigate (section 81) whether a responsible party’s processing activities comply with POPIA.

The information regulator may send an information notice to an organisation requiring it to report back that it is lawfully processing personal information.

Once the responsible party receives the information notice, the regulator will notify the complainant that the responsible party has received the information notice. What follows next can either mean a happy responsible party with no legal liability or one burdened by the weight of an investigation and possible sanctions from the regulator.

What does the information notice contain?

The information notice (section 90) requests certain information from the responsible party. The responsible party must supply the regulator with the information required within a 30-day period. In urgent matters, the regulator may require the information within three days. If this happens, the regulator will give the responsible party reasons for the urgency. The regulator may request:

  • a report, or some other formal document, from the responsible party proving that they are processing information lawfully,
  • other information showing that the responsible party complied with POPIA, and
  • details about the responsible party’s right to appeal the information notice.

What can the responsible party do in response?

  • The responsible party can appeal to the High Court to set aside or vary the information notice. The responsible party must lodge the appeal within a 30-day period (from when they received the information notice). The High Court may suspend or uphold the information notice.
  • The responsible party (or their legal representative) can request the regulator to assess if the responsible party’s processing activities comply with POPIA.
  • The regulator must inform the responsible party of the outcome of the assessment.

What information can the regulator request?

  • Full access to the responsible party’s officials or employees, to obtain information.
  • Access to documents, records, data, and other material under its control, including information held by the responsible party’s operators.

Is there anything that shouldn’t be in the information notice?

  • The regulator will not request privileged information like communications between an attorney and their client. For example, legal advice in respect of the client’s obligations, liabilities, or rights under POPIA.
  • The information notice cannot request a responsible party to supply the regulator with any information that could expose the responsible party to criminal proceedings. For example, if a party gives evidence about another offence other than an offence under POPIA.

What if a responsible party doesn’t comply with the notice?

There are consequences for failing to comply with the information notice. The scariest of these is that the regulator refers the matter to the South African Police Service for them to investigate you on a possible charge of obstruction of justice or some other charge. Another consequence is that the regulator may feel even more emboldened to continue with an investigation and possibly rule in favour of a complainant (assuming there is one) because the responsible party hasn’t stepped forward to justify why the investigation shouldn’t continue.

Actions for you to take