Do you want to lodge a PAIA complaint or POPIA complaint with the Information Regulator in South Africa? Has someone infringed your privacy or failed to give you access to information? In this article, we’ll help you know how to lodge a complaint with the regulator. This article is for data subjects – the person to whom the information relates.

The Information Regulator will take action on your behalf

Any person can lodge a complaint but it must be in writing and you must do it in the prescribed manner. It is a very effective method because the regulator will take action, which means you don’t need to.

It is not for responsible parties looking at being efficient at resolving data protection complaints.  It is also not for responsible parties wanting to know the POPIA rules of procedure for complaints. Before submitting a complaint, try to first sort out the issue with the relevant organisation.

How to file a POPIA complaint with the regulator

You can lodge a POPIA complaint if an organisation or person:

  1. has violated or infringed your privacy,
  2. failed to protect your personal information (like your name and telephone number).

You must use and complete the prescribed POPIA form 5 and lodge your PAIA complaint with the regulator.

How to lodge a PAIA complaint in South Africa

You can lodge a PAIA complaint if the information officer of a body or organisation:

  1. does not respond to your access to information request,
  2. denies your request and you have exhausted the internal appeal procedure against the decision.

You must use and complete the prescribed PAIA form 5 and lodge your PAIA complaint with the regulator.

What action will the regulator take after receiving your POPIA complaint?

The regulator can take various actions.

  1. Investigate the complaint in the prescribed procedure.
  2. Refer the complaint to the Enforcement Committee.
  3. Decide to take no action if the case requires no further action.

The regulator must as soon as reasonably possible after receipt of a complaint, advise the complainant and the information officer of the organisation to whom the complaint relates what course of action the regulator will take.

Other actions you can take

You can take various other actions if your information rights are infringed.