POPIA — POPIA Rules of Procedure: Rules of Procedure for the Handling of POPIA Complaints (source: https://inforegulator.org.za/wp-content/uploads/2020/07/20211012-InfoReg-RulesOfProcedure-HandlingPOPIAcomplaints-1.pdf)
INFORMATION REGULATOR
OCTOBER 2021
RULES OF PROCEDURE RELATING TO THE MANNER IN WHICH A
COMPLAINT MUST BE SUBMITTED AND HANDLED BY THE INFORMATION
REGULATOR
The Information Regulator intends to make the regulations set out in the Schedule, under
section 112(2)(g) of the Protection of Personal Information Act 04 of 2013
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
SCHEDULE
Arrangement of Rules
CHAPTER 1
1. Definitions
CHAPTER 2
2. Introduction
CHAPTER 3
3. Purpose of Rules
CHAPTER 4
4. LODGING OF A COMPLAINT
4.1 Who may lodge a complaint?
4.2 Manner of lodging complaint;
4.3 Submission of a complaint;
4.4 Information required when lodging complaint; and
4.5 Complaint which the Regulator may decide to take no action.
CHAPTER 5
5. PROCESSING OF COMPLAINT LODGED WITH THE INFORMATION REGULATOR
5.1 Delivery of documents and/or notices by the Regulator.
CHAPTER 6
6. ACTION TAKEN AFTER RECEIPT OF A COMPLAINT
6.1 Conducting a pre-investigation;
6.2 Period for concluding pre-investigation; and
6.3 Action taken after conclusion of pre-investigation.
CHAPTER 7
7. INVESTIGATION OF COMPLAINTS
7.1 Method of investigation;
7.2 Procedure for a Hearing;
7.3 Notice of proceedings;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.4 Failure to participate in proceedings;
7.5 Persons allowed to attend proceedings;
7.6 Legal assistance during investigation;
7.7 Nature of proceedings;
7.8 Procedures at the commencement of proceedings;
7.9 Procedures during proceedings;
7.10 Conditions for joining, substituting or adding parties to proceedings;
7.11 Consolidation of complaints;
7.12 Obligations of the responsible parties to co-operate with the Regulator; and
7.13 Refusal or failure to co-operate with the Regulator.
CHAPTER 8
8. GENERAL ASPECTS IN RESOLVING COMPLAINTS
8.1 Issuing of an Information Notice;
8.2 Cancellation or variation of the Information Notice;
8.3 Non referral of a complaint to the Enforcement Committee;
8.4 Referrals to the Enforcement Committee;
8.5 Issuing of an Enforcement Notice;
8.6 Cancellation or variation of the Enforcement Notice;
8.7 Appeal of the decision of the Regulator; and
8.8 Monitoring the implementation of an information, Enforcement and Infringement
Notice.
CHAPTER 9
9. GENERAL PROVISIONS
9.1 Recording of proceedings and investigation;
9.2 Language used during investigation proceedings;
9.3 Certificate of appointment of investigating officers; and
9.4 Security measures on integrity and confidentiality of personal information.
10. SHORT TITLE AND COMMENCEMENT
ANNEXURES
a) Form 20- Request for an Internal Review
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
CHAPTER 1
1. DEFINITIONS
1.1 In these Rules, any word or expression to which a meaning has been given in the
Protection of Personal Information Act, 2013, shall have that meaning and, unless
the context indicates otherwise-
1.1.1 "the Act" means the Protection of Personal Information Act, 2013 (Act No. 4
of 2013);
1.1.2 "Complainant" means any person who lodges a complaint with the
Information Regulator;
1.1.3 "Complaint" means-
a) a matter reported to the Information Regulator in terms of section 74(1)
and (2) of the Act;
b) a complaint referred to in section 76(1)(e) and 92(1) of the Act; and
c) a matter reported or referred to the Information Regulator in terms of
other legislation that regulates the mandate of the Information
Regulator;
1.1.4 "Constitution" means the Constitution of the Republic of South Africa, 1996;
1.1.5 "Day" means a calendar day, unless the last day of a specified period
happens to fall on a Sunday or on any public holiday, in which case the time
shall be calculated exclusive of that Sunday or public holiday in accordance
with section 4 of the Interpretation Act, 1957 (Act No. 53 of 1957);
1.1.6 “Investigating Officer” means a staff member or other suitable person
designated as investigating officer in terms of section 47(1)(b) of the Act;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
1.1.7 “Professional Legal Adviser” means any legally qualified person, whether
in private practice or not, who lawfully provides a client, at his or her or its
request, with independent, confidential legal advice;
1.1.8 "Office Hours"-
a) in respect of offices of the Information Regulator, means the hours
between 08:00 and 16:00 on Monday to Friday, excluding public
holidays; and
b) in respect of offices designated by the Information Regulator, means
the hours during which the offices are operating;
1.1.9 "Parties to a dispute" means the data subject and the responsible parties
involved in the complaint;
1.1.10 “Regulator” means the Information Regulator established in terms of section
39 of the Protection of Personal Information Act;
1.1.11 “Regulations” means the Protection of Personal Information Act:
Regulations: GG 42110, RG 10897, GoN 1383, 14 Dec 2018;
1.1.12 “Staff Member” means a staff member of the Information Regulator
appointed in terms of section 47(1)(b) of the Act;
CHAPTER 2
2. INTRODUCTION
The Protection of Personal Information Act (POPIA (2013)), Act No.4 of 2013 provided for
the establishment of an Information Regulator to exercise certain powers and to perform
certain duties and functions in terms of the POPIA (2013), as stipulated in section 40,
which includes-
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
2.1 receiving and investigating complaints about alleged violations of the protection of
personal information of data subjects and reporting to complainants in respect of
such complaints;
2.2 gathering such information as in the Regulator’s opinion will assist the Regulator in
discharging the duties and carrying out the Regulator’s functions under this Act;
2.3 attempting to resolve complaints by means of dispute resolution mechanisms such
as mediation and conciliation; and
2.4 serving any notices in terms of this Act and further promoting the resolution of
disputes in accordance with the prescripts of this Act;
CHAPTER 3
3. PURPOSE OF RULES
3.1 The purpose of these Rules is to-
3.1.1 promote and enhance access to the Regulator
3.1.1.1 by data subjects who are alleging interference with the protection of
their personal information;
3.1.1.2 by responsible parties who are aggrieved by the decision the
adjudicator
3.1.2 facilitate cooperation by Responsible parties and data subjects; and
3.1.3 enhance the efficiency and effectiveness of investigations by clarifying-
3.1.3.1 procedures for-
3.1.3.1.1 the lodging of complaints in terms of section 74(1) and
(2) of the Act with the Regulator;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
3.1.3.1.2 Mode of complaints to Regulator in terms section 75 of
the Act; and
3.1.3.1.3 Action on receipt of complaint in terms of section 76 of
the Act.
3.1.3.2 time frames for the taking of actions provided for in these Rules;
3.1.3.3 time frames for data subject and responsible party to respond to the
findings of the Regulator;
3.1.3.4 the steps the Regulator may take if any person or Responsible party
fails to comply or adhere to stipulated time frames in the Information
Notice or Enforcement Notice; and
3.1.3.5 the imposition of administrative fines as referred to in section 109(1)
of the Act.
CHAPTER 4
4. LODGING OF A COMPLAINT
4.1 Who may lodge a complaint
The following person may lodge a complaint-
4.1.1 A data subject whose personal information has been interfered with in terms
of section 73 of the Act;
4.1.2 Any person acting on behalf of data subject whose personal information has
been interfered with, as referred to in section 73 of the Act;
4.1.3 Any person with sufficient personal interest in the subject matter of the
complaint referred to in section 73 of the Act;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
4.1.4 A responsible party or data subject aggrieved by the determination of an
adjudicator in terms of section 63(3) of the Act; or
4.1.5 Any person acting in the public interest.
4.2 Manner of lodging a complaint
4.2.1 A complaint submitted to the Regulator must be in writing by completing-
4.2.1.1 online complaint form available on the website of the Regulator; or
4.2.1.2 the complaints form, Form 5 to the Regulations, which shall be
made available at the offices of the Regulator during office hours
and any office designated by the Regulator.
4.2.2 The Regulator will help any person who wishes to make a complaint, to put
that complaint in writing.
4.2.3 Should a complainant require assistance in a language other than English,
the Regulator will strive to provide a person competent in the language of the
complainant in order to assist to reduce the complaint to writing.
4.3 Submission of a complaint
4.3.1 A complaint may be submitted at-
4.3.1.1 the offices of the Regulator during office hours, preferably in the
area where the incident or conduct complained of took place;
4.3.1.2 any other office designated by the Regulator as a place where
complaints may be lodged.
4.3.2 The Regulator may transfer a complaint from the office where it was lodged
to any other office of the Regulator, if deems it fit.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
4.3.3 The Regulator shall, in writing, inform the complainant of any transfer in terms
of sub-rule 4.2.3, within fourteen (14) days of the transfer.
4.3.4 A complaint may also be submitted to the Regulator in the following manner:
4.3.4.1 by facsimile;
4.3.4.2 by post;
4.3.4.3 by courier, at the Regulator’s physical address; and
4.3.4.4 by e-mail to a designated email address.
4.3.5 The Regulator shall acknowledge receipt of the complaint and provide the
complaint with the reference number within fourteen (14) days after receipt
thereof.
4.4 Information required when lodging complaint
4.4.1 A complaint referred to in section 74(1) and (2) of the Act shall, subject to the
provisions of sub-rule 4.3.4 and 4.3.5, contain the following personal
information:
4.4.1.1 name(s) and surname/ registered name of Complainant;
4.4.1.2 unique Identifier / identity number/ company registration number of
the complainant, if required;
4.4.1.3 address of the complainant;
4.4.1.4 the telephone and facsimile numbers of the complainant and e-mail
address, if available;
4.4.1.5 reasons for complaint;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
4.4.1.6 name(s) and surname of responsible party / registered name of the
Responsible party;
4.4.1.7 address, of responsible party;
4.4.1.8 the telephone and facsimile numbers of the Responsible party and
e-mail address, if available.
4.4.2 A complaint referred to in section 74(2) of the Act shall, subject to the
provisions of sub-rule 4.4.4 and 4.4.5, contain the following personal
information:
4.4.2.1 If the complaint is regarding determination of Adjudicator in terms of
section 74(2) of the Act, Name(s) and surname of Adjudicator; and
4.4.2.2 any other information that identifies the complainant.
4.4.3 If a complaint is lodged on behalf of another person(s), it shall additionally
include proof that the person submitting the complaint is authorised to act on
behalf of another person.
4.4.4 A complaint may also contain any other relevant additional information about
the incident or matter concerned, which may include:-
4.4.4.1 the place and date of the occurrence;
4.4.4.2 particulars of the Information Officer concerned, if known;
4.4.4.3 the names and addresses of any person who could provide
information relevant to the complaint, if known; and
4.4.4.4 any other relevant information or documents that may be used
during the investigation.
4.4.5 If a complaint lodged with the Regulator contains any information which is
protected in terms of the Protected Disclosures Act No. 26 of 2000 (PDA),
the complainant will be protected by PDA;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
4.4.6 In the event the complainant wishes his or her identity not to be disclosed,
valid reasons must be submitted together with the complaint. The Regulator
will consider the reasons and inform the complainant of its decision as to
whether it accepts or rejects the request for non-disclosure of identity. The
complainant will then be able to either withdraw or proceed with the complaint
on this basis.
4.4.7 A staff member, duly designated by the Regulator, must render the necessary
assistance, free of charge, to enable any person to comply with this
regulation.
4.5 Complaint which the Regulator may decide to take no action
4.5.1 The Regulator may, in accordance with section 77(1) and (2) of POPIA,
decide to take no action or no further action in respect of the complaint.
4.5.2 The Regulator shall not accept any complaint in which the cause of action
arose before 01 July 2021.
4.5.3 The Regulator may not accept a complaint which is still pending before
another regulatory body/tribunal or which falls under the exclusive jurisdiction
of another regulatory body or tribunal.
4.5.4 The Regulator may not accept a complaint lodged after three (3) years have
elapsed from the date when the subject matter of the complaint arose and
the date when the complaint was made.
4.5.5 The Regulator shall, when making a decision regarding the late lodging of a
complaint provided for in section 77(1)(a) of the Act, consider-
4.5.5.1 the reasonableness of the explanation for the delay;
4.5.5.2 the extent and cause of the delay;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
4.5.5.3 whether the alleged interference with the protection of the personal
information is continuing;
4.5.5.4 the seriousness of the interference with the protection of the
personal information;
4.5.5.5 whether the outcome of an investigation could rectify a systemic
interference with the protection of the personal information;
4.5.5.6 the impact of the delay on the availability of information, evidence
and witnesses relating to the complaint;
4.5.5.7 any steps taken by the complainant to address the complaint; and
4.5.5.8 any other relevant special circumstances.
4.5.6 The Regulator shall, if it decides not to accept a complaint lodged after the
period mentioned in paragraph 4.5.4 above, inform the complainant in writing
of-
4.5.6.1 the decision and the reasons for the decision; and
4.5.6.2 the remedy available to the complainant in terms of sub-rule 4.5.7.
4.5.7 The Regulator may, in the interests of justice and fairness and upon receipt
of an application by the complainant, reconsider the decision, if there is new
and relevant information that was not previously known and that has a
material effect on the decision made.
4.5.8 The application referred to in sub rule 4.5.7 must be made in accordance with
Form 20 and within fourteen (14) days of receipt of the decision reviewed
against.
4.5.9 Upon receipt of an internal review referred to in sub rule 4.5.7 –
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
4.5.9.1 A written acknowledgement in relation to a review should be
communicated to the complainant within seven (7) days from
receipt;
4.5.9.2 The Regulator must inform the complainant in writing of the
decision, including the reason/s for the decision, within 30 days of
receipt of the application.
4.5.10 Should the Complainant still not be satisfied with the decision of the
Regulator, he or she or it may, within 180 days of receipt of the review
decision, approach any competent court with jurisdiction to review the
decision of the Regulator.
CHAPTER 5
5. PROCESSING OF COMPLAINT LODGED WITH THE REGULATOR
5.1 Delivery of documents and/or notices by the Regulator
5.1.1 A notice or document that is required to be delivered in terms of the Act or
these Rules is deemed to have been delivered on the intended recipient on
the date linked to the method in question, as indicated below:
5.1.1.1 Delivered by hand: during the normal business hours, shall be
deemed to have been delivered by a person duly authorised thereto
by the Regulator and received by the intended recipient at the time
and date specified on the Regulator’s Return of Service;
5.1.1.2 Registered post: shall be deemed to have been received by the
intended recipient within twenty (20) days after the date of posting;
5.1.1.3 Transmission by electronic communication (Fax, Email or
Short Message Service (SMS)): The provisions of the Electronic
Communications and Transactions Act, 2002, are applicable to all
forms, records, documents or any information, which are
electronically communicated;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
5.1.1.4 Service by Sherriff: shall be deemed to have been received by the
intended recipient on the date of service as reflected on the Sheriff’s
return of service.
5.1.2 Where such service has been effected in the manner prescribed by sub-rule
5.1.1.1, a person authorised to effect service shall indicate in the return of
service of the notices or documents:-
5.1.2.1 the name of the person to whom it has been delivered; and
5.1.2.2 the capacity of the person receiving the document on behalf
of the person to be served.
5.1.3 Where such service has been effected in the manner prescribed by sub-rule
5.1.1.1, a person authorised to effect service shall indicate or specify in the
return of service of the exact process followed to serve the notices.
5.1.4 Where the residence or place of business of the person to be served is
closed, thus preventing delivery, it shall be sufficient service to affix a copy
thereof to the outer or principal door or security gate of such residence or
place of business or to place such copy in the post box at such residence or
place of business.
5.1.5 A person authorised by the Regulator to effect service by hand shall, on
demand by the person upon or against whom process is served, produce
proof of identification issued by the Regulator.
CHAPTER 6
6. ACTION TAKEN AFTER RECEIPT OF A COMPLAINT
6.1 Conducting a pre-investigation
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
6.1.1 The Regulator shall, in respect of every complaint received, conduct a pre-
investigation for the purposes of determining how to proceed with a
complaint.
6.1.2 The Regulator shall inform the complainant, the data subject to whom the
investigation relates (if not the complainant) and any person alleged to be
aggrieved (if not the complainant) on Part I of Form 8, of the Regulator’s
intention to conduct the investigation within twenty-one (21) days from the
date of receipt of a complaint.
6.1.3 The Regulator must inform the responsible party to whom the investigation
relates on Part II of Form 8 of the complaint, or the subject matter of the
investigation, and must inform the responsible party of the right to submit a
written response to the complaint or the subject matter of the investigation
within twenty-one (21) days from the date of receipt of the notification.
6.1.4 The information referred to in sub-rule 6.1.2 and 6.1.3, must also include the
investigator’s name and his/her contact particulars.
6.1.5 Should the responsible party fail to respond to the notice referred to in sub-
rule 6.1.3, the Regulator may decide to conduct an investigation in
accordance with sub-rule 6.1.5.2.
6.2 Period for concluding pre-investigation
6.2.1 The Regulator shall conclude its pre-investigation within thirty (30) days of
receipt of a complaint.
6.2.2 In the event the pre-investigation cannot be concluded within the period
referred to in sub-rule 6.2.1, the Regulator shall, within fourteen (14) days of
expiry of this period, inform the complainant of the reasons for the delay and
the anticipated period within which the pre-investigation is likely to be
completed.
6.3 Action taken after conclusion of pre-investigation
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
6.3.1 After the conclusion of a pre-investigation, the Regulator may-
6.3.1.1 decide to take no further action on the complaint, in accordance with
section 77(1) and (2) and in writing inform the complainant and the
responsible party of the decision and the reasons for it within
fourteen (14) days of conclusion of the pre-investigation;
6.3.1.2 endeavour to resolve a complaint through mediation, conciliation,
negotiation or any other appropriate dispute resolution
mechanisms. If the Regulator intends to resolve a complaint through
any other appropriate dispute resolution, the Regulator must notify
the parties to whom the investigation relates of such intention on
either Form 6 or Form 9 of the Regulations. Any matter referred to
the dispute resolution mechanisms must be completed within thirty
(30) days of referral. The Regulator must issue a settlement
certificate on Form 10 within fourteen (14) days after the date of the
conclusion of the settlement meeting.
6.3.1.3 refer a complaint to another regulatory body established in terms of
any law, as referred to in section 78 of the Act, if the Regulator
considers that the complaint relates, in whole or in part, to a matter
that is more properly within the jurisdiction of that body. The
Regulator shall, in writing and within fourteen (14) days of the
transfer of a complaint, inform the complainant about-
6.3.1.3.1 the transfer and the reasons for the transfer of a
compliant; and
6.3.1.3.2 name and contact details of the regulatory body.
6.3.1.4 decide to conduct a full investigation of the complaint in terms of
section 76(1)(d) of the Act;
6.3.2 The Regulator may, in the interest of justice and fairness, and upon
application by the complainant within fourteen (14) days of receipt the
decision referred to in sub-rule 6.3.1.1 above, reconsider its decision, if there
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
is new and relevant information that was not previously known and that has
a material effect on the decision made.
6.3.3 If any of the parties to a dispute fail to honour the agreement or to comply
with any of their obligations in terms of the agreement, the Regulator may, on
application from the aggrieved party, refer the agreement to the Enforcement
Committee.
CHAPTER 7
7. INVESTIGATION OF COMPLAINTS
7.1 Method of investigation
7.1.1 The method of an investigation is within the discretion of the Regulator as
envisaged in section 81 of the Act and may include any of the following
information gathering methods:
7.1.1.1 communication by telephone, email or any other form of
correspondence;
7.1.1.2 research, inspections in loco, surveys or questionnaires;
7.1.1.3 meetings with affected parties or persons reasonably believed to
have information relevant to the investigation;
7.1.1.4 appearance of a person in a hearing before the Regulator for
purposes of obtaining or clarifying information, producing any
document or giving evidence in terms of section 81(a) to (c) of the
Act;
7.1.1.5 obtaining records or documents relevant to the investigation which
are in possession or under control of any person; and
7.1.1.6 conducting public enquiries to obtain relevant information on the
subject matter.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.2 Procedure for a Hearing
7.2.1 The Regulator may decide to conduct a hearing under the circumstances it
deems fit, including the following:
7.2.1.1 When prior attempts at resolving a dispute have failed or the
Regulator is of the opinion that such proceedings will enable it to
conclude an investigation or obtain an appropriate resolution of the
complaint;
7.2.1.2 if the Regulator deems it in the public interest to hold such
proceedings; or
7.2.1.3 if in the opinion of the Regulator the complaint cannot be fairly
decided only on the basis of documentary evidence or written
statements submitted by the parties to a dispute or by any other
person.
7.3 Notice of proceedings
7.3.1 The Regulator shall give the parties to a dispute and any other person whose
attendance before the Regulator is required, a notice of the intended
proceedings by means of –
7.3.1.1 A formal letter; or
7.3.1.2 Summons issued in terms of section 81(a) of the Act.
7.3.2 The notice referred to in sub-rule 7.3.1 shall be given at least fourteen (14)
days before the date of such proceedings, unless the Regulator and persons
concerned agree to a shorter period or the matter is extremely urgent.
7.3.3 The notice referred to in sub-rule 7.3.1 shall contain the following information:
7.3.3.1 the place where the proceedings will be held;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.3.3.2 the date and time of the proceedings;
7.3.3.3 the aspects in respect of which evidence will be required;
7.3.3.4 an invitation to the parties to the dispute to bring any person who
has personal knowledge about the issues in respect of which
evidence is to be given at the proceedings;
7.3.3.5 an indication whether or not a person who will attend the
proceedings shall bring any document to such proceedings; and
7.3.3.6 any other information which the Regulator deems necessary.
7.3.4 The notice or summons referred to in sub-rule 7.3.1 may be served to the
person concerned in any manner expedient in the circumstance, as referred
to in sub-rule 5.1.1, having regard to the date of the proceedings and ensuring
that the person receives the notice or information,
7.3.5 The Regulator shall keep proof of receipt of the notice referred to in sub-rule
7.3.1.
7.4 Failure to participate in proceedings
7.4.1 The Regulator may, if a party to a dispute is absent at proceedings-
7.4.1.1 continue with the proceedings; or
7.4.1.2 postpone the proceedings.
7.4.2 The Regulator may, if a party to a dispute or a person who has been notified
to be present at the proceedings in terms of sub-rule 7.3.1.1 is absent at the
proceedings without any valid reasons, issue a summons in terms of section
81(a) of the Act, to compel the person to attend such proceedings and to give
evidence or to produce a document during the proceedings.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.4.3 The Regulator may dismiss a complaint if the complainant fails to participate
in proceedings in accordance with the provisions of these Rules.
7.4.4 The Regulator shall, in writing, notify both parties to a dispute of the dismissal
and the reasons thereof.
7.5 Persons allowed to attend proceedings open proceedings vs closed
proceeings
7.5.1 The following persons may attend proceedings:
7.5.1.1 A person who lodged a complaint to the Regulator in terms of
section 74 of the Act;
7.5.1.2 the investigator or any person designated by the Regulator to lead
evidence during the proceedings;
7.5.1.3 a person appointed, in terms of section 47(7) of the Act, to provide
assistance to the Regulator;
7.5.1.4 a person authorised to conduct an investigation on behalf of the
Regulator in terms of section 47(1)(b) of the Act;
7.5.1.5 a person required to give evidence or to produce any document or
record to the Regulator;
7.5.1.6 professional legal adviser who is legally assisting the person
appearing before the Regulator; and
7.5.1.7 a person employed by a responsible party and authorised to
represent the responsible party.
7.5.2 Any person other than the persons referred in sub-rule 7.5.1 above may
attend proceedings with the permission of the Regulator.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.6 Legal assistance during investigation (a policy decision to be made on open
or closed proceedings and consequences of legal representation)
7.6.1 A person summoned or directed to appear in terms of section 81(a) of the Act
may not be assisted by a professional legal adviser at a hearing unless he or
she has applied to the Regulator to be so assisted and the Regulator has
approved the application in accordance with the process prescribed in sub-
rule 7.6.3.
7.6.2 Subject to sub-rule 7.6.3, the parties to a dispute may obtain legal assistance
for the purposes of the investigation to be conducted in terms of section 76(1)
(d) of the Act, but are obliged to personally provide any information,
documents or evidence requested from them by the Regulator.
7.6.3 Subject to sub-rule 7.6.2, parties to a dispute may be assisted by his or her
or its legal representative, who may accompany a party to any proceedings
of the Regulator with the permission of the Regulator and to the extent
determined by the Regulator.
7.6.4 The Regulator shall, in exercising its discretion in terms of sub-rule 7.6.3, take
into consideration the following factors:
7.6.4.1 the nature of the information, issues or the evidence to be provided
to the Regulator;
7.6.4.2 the complexity of the matter investigated or any specific aspect
thereof;
7.6.4.3 the seriousness of the matter investigated;
7.6.4.4 the extent to which allowing legal representatives will affect the
timeous conclusion of the investigation or any part thereof; and
7.6.4.5 any other factor which is, in the opinion of the Regulator, relevant to
the investigation.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.6.5 Any person appearing before the Regulator or professional legal adviser
assisting during the examination, may be entitled to peruse such of the
relevant documents or records of any evidence pertinent to the hearing and
which are in the possession of the Regulator obtained during an investigation
as reasonably necessary to refresh his or her memory.
7.7 Nature of proceedings
7.7.1 The Regulator shall conduct proceedings pertaining to an investigation in an
inquisitorial manner.
7.7.2 A party to a dispute may, with the permission of the Regulator and through
the Regulator, put questions to any witness at proceedings pertaining to an
investigation.
7.7.3 The parties to a dispute may, in respect of representations made to the
Regulator during the proceedings, ask questions in order to clarify any
uncertainties.
7.7.4 The Regulator’s duly authorised employee may at any stage of the
proceedings-
7.7.4.1 put any relevant question to a witness, and any party to a dispute;
7.7.4.2 rephrase a question put to a witness by a person or a party to a
dispute;
7.7.4.3 clarify any uncertainties in respect of any evidence given; or
7.7.4.4 in any other appropriate manner, elicit information from a witness or
a party to a dispute.
7.7.5 The parties to a dispute must act in good faith and refrain from any actions or
conduct that might be construed as disparaging, insulting or defamatory.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.8 Procedures at the commencement of proceedings
7.8.1 The Regulator shall explain to the parties to a dispute and witnesses, at the
commencement of the proceedings-
7.8.1.1 the purpose of the proceedings;
7.8.1.2 the inquisitorial nature of the proceedings; and
7.8.1.3 the procedures which will be followed at the proceedings.
7.8.2 any person acting on behalf of or under the direction of the Regulator,
including any person appointed or designated to record the proceedings of
an investigation in writing or mechanically, or employed / appointed to
transcribe the records of the proceedings, must preserve the confidentiality
of any matter or information that may come to his or her knowledge in the
performance of his or her duties, except in so far as the publication of such
matter or information is necessary or incidental to any report of the Regulator.
7.8.3 Any person whose presence is not required may be excluded from attending
the proceedings held in terms of section 81(a) of the Act.
7.8.4 At the commencement of the proceedings, the Regulator shall summarise the
complaint and narrow the issues to be investigated during such proceedings
and determine the order for the leading of evidence.
7.8.5 The Regulator may make a determination about any submission, declaration,
explanation, information, statement, and any other evidence to be disclosed
at the proceedings.
7.8.6 The Regulator may direct that any portion or all the evidence be given, or a
part or the whole of the proceedings be held behind closed doors, if the
Regulator determines that it is in the interest of the investigation to do so,
after having allowed the parties to the dispute a reasonable opportunity to
address the Regulator.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.8.7 The Regulator may give directions in respect of the disclosure or publication
of any information or evidence obtained behind closed doors.
7.8.8 The Regulator may give directions on any other aspect of the proceedings to
facilitate and promote co-operation by the parties to a dispute and to ensure
that the proceedings are conducted in an expeditious manner.
7.9 Procedures during proceedings
7.9.1 The Regulator may hear evidence from any person, in such manner as the
Regulator deems fit and at any place determined by the Regulator.
7.9.2 The Regulator may, if deems necessary and in accordance with section 81(b)
of the Act, administer an oath or an affirmation to any person appearing as a
witness.
7.9.3 The Regulator shall take any step it deems necessary to establish the truth,
correctness and relevance of any submission, declaration, explanation,
information, statement, affidavit or any other evidence.
7.9.4 The Regulator may receive or accept any evidence and other information,
whether on oath, by affidavit or otherwise, that the Regulator sees fit,
irrespective of whether or not such evidence is admissible in a court of law.
7.9.5 At any time during the proceedings, the Regulator may postpone, stand down
or adjourn the proceedings, where the Regulator deems it necessary do so.
7.9.6 The parties shall, subject to sub-rule 7.7, be given a reasonable opportunity
to respond to the evidence given at the proceedings.
7.9.7 A party may, in responding to the evidence given at the proceedings, provide
information or an explanation by giving evidence, calling witnesses and/or
handing in documents and/or submissions.
7.9.8 The Regulator may decide whether sufficient evidence has been given to
conclude the investigation and order that no further evidence shall be given.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.9.9 The parties to the dispute shall be given a reasonable opportunity to make a
closing statement and to present, if they so require, further arguments in
writing.
7.9.10 The Regulator shall conclude the proceedings by informing the parties to the
dispute of further steps to be taken in the investigation or the resolving of the
complaint.
7.9.11 If it appears to the Regulator during the course of an investigation that any
person is being implicated in the matter being investigated and that the
implications may be to the detriment of that person or result in an adverse
finding against that person, the Regulator must afford that person an
opportunity to reply in connection therewith in any manner that may be
expedient under the circumstances.
7.10 Conditions for joining, substituting or adding parties to proceedings
7.10.1 The Regulator may on its own accord or on the request in writing by a party
or any other person, join, substitute or add any number of persons as parties
in the proceedings-
7.10.1.1 If it is relevant and necessary to do so; and
7.10.1.2 if such parties so joined or substituted have a substantial interest
in the subject matter of the proceedings, and may give appropriate
directions as to further procedures for the proceedings.
7.10.2 A request to join, substitute or add a person as a party in the proceedings
must contain the following:
7.10.2.1 the grounds for the application;
7.10.2.2 full particulars of the person concerned; and
7.10.2.3 any additional documents as may be required by the Regulator.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.10.3 The Regulator shall on receipt of a request for the joining, substitution or
adding of any number of persons as parties, in writing inform all affected
parties of the request and give such parties the opportunity to make
representations.
7.10.4 The joining, substitution or adding of persons in the proceedings in terms of
these Rules must not affect any steps already taken in these proceedings,
except if the Regulator determines otherwise.
7.11 Consolidation of complaints
7.11.1 The Regulator may, on its own accord or on a request in writing by a party to
a dispute, consolidate two or more complaints and deal with these complaints
in the same proceedings, if the outcome of the complaints depends on
substantially the same question of law or fact; and it is in the interests of
justice to do so.
7.11.2 The Regulator shall, when deciding on the consolidation of complaints, in
writing inform all affected parties and give such parties the opportunity to
make representations.
7.12 Obligations of the responsible parties to co-operate with the Regulator
7.12.1 The responsible parties must-
7.12.1.1 allow the Regulator prompt and full access to its officials or
employees for purposes of obtaining information;
7.12.1.2 allow the Regulator prompt and full access to documents, records,
data and material under its possession or control or under the
possession or control of its officials or employees or Operators;
7.12.1.3 respond within the prescribed timelines, accurately and fully to the
enquiries of the Regulator in every complaint;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
7.12.1.4 attend meetings requested by the Regulator for purposes of an
investigation and resolving any dispute;
7.12.1.5 comply with a notice or directive issued by the Regulator in terms of
the Act; and
7.12.1.6 respect and comply with agreements reached through appropriate
dispute resolution processes.
7.13 Refusal or failure to co-operate with the Regulator
7.13.1 Where any person refuses to co-operate with the Regulator, or fail to comply
with a summons issued in terms of section 81 of the Act, the Regulator may
open a criminal case against such a person.
CHAPTER 8
8. GENERAL ASPECTS IN RESOLVING COMPLAINTS
8.1 Issuing of an Information Notice
8.1.1. The Regulator may, in accordance with section 90(1) of the Act, serve the
responsible party with an information notice requiring the responsible party
to furnish the Regulator with the following information, within a period of not
less than thirty (30) days and in a form specified in the notice–
8.1.1.1. a report indicating that the processing is taking place in compliance
with the provisions of the Act; or
8.1.1.2. such information relating to the request or to compliance with the
Act as is so specified;
8.1.2. In the event the information, referred to in sub rule 8.1.1, is required as a
matter of urgency, the Regulator may serve the responsible party with an
information notice together with a statement of its reasons for such urgency,
requiring the responsible party to furnish the Regulator with the information
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
within a period of not less than three (3) days from the date of receipt of the
notice.
8.1.3. The Regulator must inform the complainant of the information notice, referred
to in sub rule 8.1.1, within five (5) days of serving the notice to the responsible
party.
8.2 Cancellation or variation of the Information Notice
8.2.1 The Regulator may, on its own accord and on written notice to the responsible
party and the complainant, cancel an information notice as soon as is
reasonably practicable.
8.2.2 A responsible party on whom an information notice has been served, in
accordance with sub rule 8.1.1, may, in accordance with section 97(1) of the
Act and within 30 days of receiving the notice, appeal to the High Court having
jurisdiction for the setting aside or variation of the information notice.
8.2.3 An application, referred to in sub rule 8.2.2, does not suspend the Information
Notice, unless a High Court having jurisdiction determines otherwise.
8.3 Non referral of a complaint to the Enforcement Committee
8.3.1 The Regulator shall not refer a complaint to the Enforcement Committee, if
the Regulator finds after conducting an investigation that no interference with
the protection of the personal information of a data subject has taken place.
8.3.2 The Regulator must inform the complainant and the responsible party, within
five (5) days of its finding referred to in sub rule 8.3.1, of the closure of the
complaint and the reasons therefore.
8.4 Referrals to the Enforcement Committee
8.4.1 After completing an investigation of a complaint and as soon as reasonably
practicable, the Regulator may refer its investigation report to the
Enforcement Committee for consideration, a finding in respect of the
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
complaint and a recommendation in respect of the proposed action to be
taken by the Regulator.
8.4.2 The Regulator may refer any other matter to the Enforcement Committee for
consideration, a finding in respect of that matter and a recommendation in
respect of the proposed action to be taken by the Regulator.
8.4.3 The Regulator must, within seven (7) days from the date of the referrals,
referred to in sub-rule 8.4.1 or 8.4.2, inform the complainant and the
responsible party in accordance with Form 14 of the Regulations.
8.5 Issuing of an Enforcement Notice
8.5.1 The Regulator must, after having decided to issues an enforcement Notice in
terms of section 95 of the Act and within thirty (30) days from the date of
receipt of the recommendation from the Enforcement Committee, serve the
responsible party and the complainant with an Enforcement Notice in terms
of section 95 of the Act, in accordance with Form 15 of the Regulations.
8.5.2 The Enforcement Notice must be served using any of the methods stipulated
in sub-rule 5.1.1.
8.6 Cancellation or variation of the Enforcement Notice
8.6.1 A responsible party on whom an enforcement notice has been issued and
served may apply to the Regulator, at any time after the expiry of a period of
thirty (30) days from date of receipt of the Enforcement Notice and in writing
in accordance with Form 16, for the cancellation or variation of the
Enforcement Notice.
8.6.2 An application in terms sub rule 8.6.1 will only be heard by the Regulator
where as a result of a change in circumstances, all or any of the provisions
in the Enforcement Notice need not be complied with in order to ensure
compliance with the conditions for lawful processing of personal information.
8.6.3 The application referred to in sub rule 8.6.1 must set out:
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
8.6.3.1 the relevant change in circumstances and
8.6.3.2 those provisions in the Enforcement Notice that may
subsequently not require compliance with.
8.6.4 If the Regulator, when considering an application in terms of sub rule 8.6.1,
decides that all or any of the provisions of an enforcement notice need not be
complied with in order to ensure compliance with conditions for the lawful
processing of personal information, it may cancel or vary the Enforcement
Notice by written notice to the responsible party and complainant.
8.6.5 An application for cancellation or variation of the Enforcement Notice to the
Regulator does not suspend the Enforcement Notice, unless a High Court
having jurisdiction determines otherwise.
8.6.6 The Regulator must consider the cancellation or variation of the Enforcement
Notice within sixty (60) days of receipt of the application and inform the
responsible party and the complainant of its decision in accordance with
Form 16 of the Regulations.
8.7 Appeal of the decision of the Regulator
8.7.1 A responsible party on whom an information notice or enforcement notice has
been served may, within 30 days of receiving the notice, appeal to the High
Court having jurisdiction for the setting aside or variation of the notice.
8.7.2 A complainant, who has been informed of the Regulator’s decision to take no
action or no further action on a complaint in terms of section 77(3) of the Act,
may, within 180 days of receiving the decision, appeal against the decision
to the High Court having jurisdiction.
8.7.3 A complainant who is aggrieved by the Regulator’s decision to cancel or vary
an enforcement notice in terms of section 96 of the Act, may, within 180 days
of receiving the decision, appeal against the decision to the High Court having
jurisdiction.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
8.7.4 An appeal application, referred to in sub rules 8.7.1 to 8.7.3, must be served
in accordance with the applicable rules of the court, on all the parties to a
complaint, including the Regulator.
8.7.5 The Regulator must, within seven (7) days of receipt of the appeal
application, referred to in sub rules 8.7.1 to 8.7.3, inform the complainant and
the responsible party in accordance with Form 17.
8.7.6 An appeal application, referred to sub rules 8.7.1 to 8.7.3, does not suspend
the Regulator’s decision appealed against, unless a High Court having
jurisdiction determines otherwise.
8.7.7 The Regulator must, within seven (7) days of receipt of the court order in an
appeal application, inform the complainant and the responsible party on
either Form 18 of the Regulations.
8.8 Monitoring the implementation of an information, Enforcement and
Infringement Notice
8.8.1 The Regulator may monitor the implementation of an Enforcement Notice
issued in terms of section 95(1) of the Act, Information Notice issued in terms
of section 90 of the Act or Infringement Notice issued in terms of section
109(1) the Act.
8.8.2 The Regulator may, if a responsible party is alleged to have committed any
of the offence in terms of the Act-
8.8.2.1 hand over or refer the matter to the South African Police Service
and inform the responsible party and/or any known person who may
be criminally liable under the Act, within seven (7) days of such hand
over or referral; or
8.8.2.2 issue an Infringement Notice against the responsible party, in
accordance with section 109(1) of the Act;
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
8.8.3 The Regulator may, if an Infringement Notice is not complied with within the
prescribed time frame or the payment arrangement in terms of section
109(2)(d)(ii) of the Act is not adhered to-
8.8.3.1 proceed with recovery proceeding against the responsible party, in
accordance with section 109(5) of the Act, on ten (10) days written
notice of intention to proceed with recovery proceeding.
8.8.4 The recovery proceeding, referred to in sub rule 8.8.3, must be on ex parte
proceedings.
CHAPTER 9
9. GENERAL PROVISIONS
9.1 Recording of proceedings and investigation
9.1.1 Any proceedings in terms of this Act and any discussions held, oral
submissions made or evidence given as part of an investigation in terms of
section 81(a) of the Act shall be recorded by the Regulator in any manner
deemed fit.
9.1.2 The Regulator or the Enforcement Committee shall, before the
commencement of any recording, inform the persons present of the fact that
a recording will be made and of the manner of recording.
9.1.3 A person appointed or designated to record the proceedings referred to in
sub-rule 9.1.1, must at the outset take an oath or make an affirmation. in the
following form:
“I, AB, declare under oath or affirm that-
I shall faithfully and to the best of my ability record the proceedings and
related matters by using the method determined by the Regulator, and
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
In accordance with section 54 of the Act, I shall treat as confidential the
personal information which comes to my knowledge in the course of the
performance of my official duties, except if the communication of such
information is required by law or in the proper performance of my duties”
9.1.4 A person appointed or designated to transcribe the record of proceedings of
the Regulator, must upon completion of the transcription, certify as follows-
“I, AB, certify that I have fully and to the best of my ability transcribed the
whole of the record of the proceedings of the Regulator handed to me in
this matter and hereby certify that the attached documents are true,
accurate and complete transcripts of the proceedings of the Regulator
held on (specify dates).”
9.2 Language used during investigation proceedings
9.2.1 Investigations and proceedings in terms of the Act and these Rules may be
conducted in any of the official languages referred to in section 6 of the
Constitution.
9.2.2 The official language of record for the investigation or any of the proceedings
of the Regulator shall be in English.
9.2.3 A party who requires the services of an interpreter during any stage of the
proceedings in terms of the Act shall give reasonable notice to the Regulator
which shall make the necessary arrangements for an interpreter, free of
charge.
9.3 Certificate of appointment of investigating officers
9.3.1 Any person appointed by the Regulator to conduct an investigation on any
allegations of interference with the processing of personal information must
be issued with a certificate of appointment or Investigator’s Identity Card,
signed by the Chief Executive Officer of the Regulator.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
9.3.2 The certificate of appointment or Investigator’s Identity Card must set out the
following:
9.3.2.1 the Information Regulator’s logo;
9.3.2.2 the full names and employee number of the investigating officer;
9.3.2.3 a recent photograph of the investigating officer; and
9.3.2.4 the position held.
9.4 Security measures on integrity and confidentiality of personal information
9.4.1 The Regulator shall, as referred to in section 19 of the Act, secure the integrity
and confidentiality of personal information received as result of a complaint
lodged or an assessment conducted, by taking appropriate, reasonable
technical and organisational measures to prevent-
9.4.1.1 loss of, damage to or unauthorised destruction of personal
information; and
9.4.1.2 unlawful access to or processing of personal information.
9.4.2 Subject to sub-rule 9.4.3, the Regulator shall disclose information in its
possession or under its control, only to the extent necessary to-
9.4.2.1 carry out an effective investigation;
9.4.2.2 publish reports in terms of section 40(2) of the Act; or
9.4.2.3 resolve a dispute; or
9.4.2.4 give effect to constitutional right of access to information, as
regulated in the Promotion of Access to Information Act 2 of 2000.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
9.4.3 The Regulator shall not disclose information about the identity or personal
circumstances of the complainant, or information that could lead to the
identification of the complainant, without the written permission of the
complainant if-
9.4.3.1 the complainant requested that his or her personal particulars be
kept confidential;
9.4.3.2 the information is protected by the Protected Disclosures Act, 2000
(Act No. 26 of 2000), or any other legislation; or
9.4.3.3 the Regulator is of the opinion that confidentiality is required to
prevent imminent risk or serious harm to any person.
9.4.4 The Regulator shall, when the permission of the complainant is required in
terms of sub-rule 9.4.3, inform the complainant if there is a risk that the
complaint cannot be investigated or resolved without such consent.
10. SHORT TITLE AND COMMENCEMENT
These Rules are called the “Rules of procedure relating to the manner in which a complaint
must be submitted and handled by the Regulator, 2021,” and shall come into operation on
the date to be determined by the Regulator.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
FORM 20
REQUEST FOR AN INTERNAL REVIEW
Privacy statement
Please note that the Information Regulator (Regulator) is collecting your personal information
for resolving your complaint. The information will be provided to the relevant staff of the
Regulator to enable your complaint to be investigated, which may include the responsible
party. The information will not be disclosed by the Regulator to any third party without your
consent or unless authorised or required by law. If the Regulator asks for information and you
do not provide it, the Regulator may not be able to investigate your complaint.
CONTACT INFORMATION
Note – the internal review officer may need to contact you to discuss your request or clarify
any information you have provided
Full Names of Complainant
Identity / Passport Number
Postal Address
Physical Address
Cell phone Number
Landline Number, if any
Fax Number, if any
Email address, if any
COMPLAINT REFERENCE NUMBER
NB: please attach a copy of the complaint outcome we sent you.
Rules of procedure relating to the manner in which a complaint must be submitted and handled by the Information
Regulator
REASONS FOR SEEKING AN INTERNAL REVIEW
Please explain why you believe the original decision was incorrect, unreasonable or deficient.
If you need more space, you can attach additional information (up to a maximum of two (2)
pages).
Please note: an internal review cannot be requested simply because you disagree with the
original decision or process. It is your responsibility to explain why the original decision is
incorrect, unreasonable or deficient.
IS THERE ANY NEW AND RELEVANT INFORMATION THAT WAS NOT PREVIOUSLY
KNOWN AND THAT HAS A MATERIAL EFFECT ON THE DECISION MADE?
NB: Please note that if there is no new and relevant information, the Regulator will not
consider the application.
WHAT IS THE RELIEF SOUGHT?
Complainant’s signature: Date:
Use of Official Languages Act, 2012
