POPIA and PAIA deadlines every responsible party needs on a calendar

POPIA has fewer fixed calendar dates than most compliance regimes, but it has hard running clocks: an Information Officer may only start acting once registered with the Information Regulator, a PAIA manual must be kept available at all times, a data subject request calls for a response within a reasonable time, and a security compromise must be reported to the Regulator as soon as reasonably possible after it is discovered.

Reviewed by TefCo Compliance Research — last verified 15 September 2026.

In short

The Information Officer of a public or private body must be registered with the Information Regulator before taking up those duties (POPIA section 55).
A PAIA manual must be available at all times, not filed once and forgotten (PAIA section 51).
There is no fixed number of days in POPIA itself for a data subject access request — access must be given within a reasonable time (POPIA section 23).
A security compromise must be reported to the Regulator and, subject to limited exceptions, to affected data subjects, as soon as reasonably possible after discovery (POPIA section 22).

Information Officer registration is a precondition, not a formality

Section 55 of the Protection of Personal Information Act 4 of 2013 provides that an Information Officer may only carry out the duties and responsibilities in the Act once registered with the Information Regulator. The head of a private body is automatically the Information Officer unless someone else is delegated, but that delegation still has to be registered before the appointee acts in the role.

Registration is done on the Regulator's e-Services registration portal, and deputy information officers are added on the same application. There is no annual renewal date — the obligation is to register before the Information Officer starts acting, and to update the Regulator whenever the appointee changes.

Running obligations under POPIA and PAIA
Obligation	Trigger / timing	Source
Information Officer registration	Before the Information Officer takes up duties	POPIA section 55
PAIA manual availability	Continuous — must be available at all times	PAIA section 51
Data subject access request response	Within a reasonable time of the request	POPIA section 23
Security compromise notification to the Regulator and data subjects	As soon as reasonably possible after discovery	POPIA section 22

The PAIA manual is a standing document, not an annual filing

Section 51 of the Promotion of Access to Information Act 2 of 2000 requires every private body to compile a manual describing its structure, the categories of records it holds, and how to make a request for access, and to make that manual available to the public at all times. The Information Regulator publishes manual templates for public and private bodies to work from.

There is no fixed annual re-submission date in the Act itself; the compliance point is that the manual must be kept current and accessible, on the body's website where it has one.

Data subject access requests run on a reasonable-time standard

Section 23 of POPIA gives a data subject the right to be told, free of charge, whether a responsible party holds their personal information, and to request the record itself within a reasonable time, at a prescribed fee if any, and in a reasonable manner and format. POPIA does not set a specific number of days for this response; the request is processed through the machinery of PAIA where the requester wants a formal record rather than mere confirmation.

Because the standard is 'reasonable time' rather than a fixed period, an Information Officer should acknowledge every request immediately and keep a dated log — a request answered five weeks later with no acknowledgement is far harder to defend than one answered in the same time frame with regular contact.

Readers relying on a specific day count for access requests (such as '30 days') should confirm that figure against the current PAIA regulations or their own written request-handling policy before quoting it to a data subject — POPIA's own text sets a reasonable-time standard rather than a fixed number.

Security compromise notification: 'as soon as reasonably possible'

Section 22 of POPIA requires a responsible party to notify both the Information Regulator and affected data subjects as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person, taking into account the legitimate needs of law enforcement and any steps needed to determine the scope of the compromise and restore the integrity of the system.

The Regulator's guidelines require the notification to be made using the prescribed Security Compromise Notification Form, and since 2025 all security compromise reports must be submitted through the Information Regulator's eServices Portal.

POPIA sets no reporting threshold based on risk — every security compromise must be reported, regardless of how minor it may appear.

Frequently asked

Does every business need to register an Information Officer, even a small one?

Yes. The head of any private body is automatically the Information Officer under POPIA and PAIA, and registration with the Information Regulator is required before that person (or a delegate) takes up the duties, regardless of the size of the business.

Is there a grace period before a data breach has to be reported?

No formal grace period exists in the Act. The standard is 'as soon as reasonably possible after the discovery of the compromise' — delay is only excused to the extent needed to establish the scope of the breach or where law enforcement or the Regulator asks for a delay to protect an investigation.

Can a small, low-risk data breach be left unreported?

No. The Information Regulator has stated explicitly that POPIA sets no risk threshold for reporting — all security compromises must be reported irrespective of their perceived severity.

Sources

TefCo Corporate Compliance (Pty) Ltd is a compliance management platform, not a legal, tax or advisory firm. This guide is general information, not advice. Fees, dates and thresholds change — confirm current figures with the regulator before you rely on them.