Nominations/Applications: Appointment of Three (3) Information Regulator Candidates

South Africa has a law called the Protection of Personal Information Act, Number 4 of 2013 — most people know it as POPIA. This law was created to protect the personal information of South Africans, controlling how businesses, government departments, and other organisations may collect, store, use, and share your private details. To enforce this law and make sure organisations play by the rules, POPIA established an independent body called the Information Regulator. The Regulator has members who are appointed for fixed terms, and when those terms come to an end — or when vacancies arise — Parliament must run a process to find suitable replacements. That is exactly what is happening now: three seats on the Information Regulator need to be filled, and Parliament is opening the process to the public.

Ordinary South African citizens are affected because the Information Regulator is the institution that stands between them and organisations that might misuse their personal data — things like your ID number, address, medical history, or financial details. A strong, well-qualified Regulator means better protection for everyday people.

Professionals such as practising advocates, attorneys, and law professors are specifically mentioned as eligible and encouraged to apply, because POPIA requires that at least one member of the Regulator must come from a legal practice or academic law background.

Other professionals with relevant qualifications or experience — for example in data protection, information technology, human rights, governance, or related fields — are also eligible to apply or be nominated, as the remaining positions can be filled by people with broader expertise that fits the Regulator's purpose.

Organisations such as civil society groups, professional bodies, law firms, universities, and community organisations can also participate — either by nominating a suitable candidate on someone's behalf, or by commenting on the suitability of candidates once their CVs are published on Parliament's website.

The Portfolio Committee on Justice and Constitutional Development — the parliamentary committee responsible for overseeing justice matters — is calling on individuals and organisations to submit nominations or applications for three positions on the Information Regulator. Two of these positions are full-time and one is part-time. Successful candidates will serve for a period of five years.

To be considered, a candidate must be a South African citizen who is appropriately qualified, and must be a fit and proper person. At least one of the three people appointed must have experience as a practising advocate, a practising attorney, or a professor of law at a university. The other positions can be filled by people with other qualifications, skills, or experience that relates to what the Regulator does — protecting personal information.

People who want to apply or be nominated must submit a Curriculum Vitae (CV) that includes their full name, ID number, and gender; contact details including a physical address, phone number, and email address; details of relevant previous experience with dates and the organisations involved; and their academic qualifications. If someone is being nominated by another person or organisation rather than applying themselves, the nomination must also include the full name and contact details of the person or organisation making the nomination, and must include a signed letter from the nominee confirming they accept the nomination. Candidates must also state whether they are available to serve full-time, part-time, or both.

All nominations and applications must be emailed to Mr Vhonani Ramaano at vramaano@parliament.gov.za by no later than Monday, 31 August 2026. Once received, the CVs will be published on Parliament's website — with personal details removed for privacy — so that members of the public can comment on whether they think the candidates are suitable. Shortlisted candidates will then go through a screening process before final appointments are made.

The Information Regulator is one of the most important watchdog bodies in South Africa when it comes to your privacy. In a world where data breaches, identity theft, and the misuse of personal information are growing problems, the Regulator is the institution that can investigate complaints, take action against organisations that break the rules, and ultimately hold powerful entities — including government departments and large companies — accountable for how they handle your personal information.

If the Regulator is filled with competent, independent, and experienced members, it can do its job properly. If the seats are filled by people who are not truly qualified or who lack the right expertise, ordinary South Africans lose out — their complaints may not be taken seriously, investigations may not be thorough, and organisations that misuse data may face little consequence.

This process also gives the public a real chance to have a say. Because CVs will be published online and public comment will be invited, any South African can look at who has applied and tell Parliament whether they think a candidate is suitable or not. This is civic participation in action — your voice can influence who ends up protecting your privacy rights for the next five years.

The deadline is 31 August 2026, so anyone who wants to apply, nominate someone, or simply keep an eye on the process needs to act quickly.