How to Complain to the Information Regulator (Form 5)

If you believe an organisation has mishandled your personal information, the Information Regulator is the body that hears your complaint under POPIA. This guide explains who can complain, how to lodge a complaint, the timelines the Regulator works to, and what it can and cannot do for you.

Information last verified on 23 July 2026. This page provides general legal information about South African data protection law and does not constitute legal advice in an individual case.

Who Can Complain, and What the Regulator Will Not Accept

Any data subject, meaning the person (or, where it is applicable, the identifiable existing juristic person) whose personal information is involved, can lodge a complaint with the Information Regulator about interference with the protection of their personal information under POPIA.

The Regulator's own published position sets out when it will not accept a complaint. It will not accept a complaint:

• whose cause of action arose before 1 July 2021;
• that is already pending before another regulatory body or tribunal;
• lodged more than three years after the claim arose;
• that is purely personal or household in nature;
• against the Cabinet;
• against the judicial functions of a court; or
• about a bank's processing, unless you have first lodged it with the bank itself under the Code of Conduct for the banking industry.

If your complaint falls into one of these categories, the Regulator will decline to take it further, so it is worth checking this list before you lodge.

How to Lodge a Complaint

POPIA complaints go to the Information Regulator through one of four channels, all published on the Regulator's own website:

• Form 5, "Complaint Regarding Interference With the Protection of Personal Information", completed under Regulation 7 of the Regulations Relating to the Protection of Personal Information, 2017.
• The Regulator's online complaint portal at eservices.inforegulator.org.za.
• Email to the Regulator's designated complaints address, popiacomplaints@inforegulator.co.za (note the .co.za domain, which is how the Regulator itself publishes it).
• In person, at the Regulator's premises during its operating hours.

Whichever channel you use, be ready to identify yourself, name the responsible party you are complaining about, and set out the facts of what happened in enough detail for the Regulator to assess whether it can accept the complaint.

What Happens After You Lodge a Complaint

The Information Regulator's Rules of Procedure set out day by day timelines for handling a complaint. The Regulator must acknowledge your complaint and give you a reference number within 14 days of receiving it.

It then has 30 days from receipt to conclude a pre investigation into the complaint. If it cannot finish within that time, it must tell you why, and when it expects to finish, within a further 14 days.

Before the pre investigation is concluded, the Regulator must also give notice of its intention to investigate: within 21 days of receiving your complaint to you, as the complainant, and within a further 21 days to the responsible party, giving it a right to respond.

At the end of the pre investigation, the Regulator can do one of four things: take no further action (giving you its decision and reasons in writing within 14 days), attempt mediation, conciliation or settlement between you and the responsible party (to be completed within 30 days of the referral to mediation, with a settlement certificate on Form 10 issued within 14 days of the settlement meeting if you reach agreement), refer your complaint to another regulatory body (with 14 days' notice to you), or proceed to a full investigation.

A full investigation can lead to an enforcement notice against the responsible party. A party that disagrees with an enforcement notice can appeal it to the High Court within 30 days of receiving it.

What the Information Regulator Can and Cannot Do

The Information Regulator can accept your complaint, mediate it, issue an enforcement notice requiring a responsible party to stop or change its processing, and impose an administrative fine on the responsible party of up to R10 million.

What it does not do is award you money directly. Section 99 of POPIA allows a data subject, or the Regulator acting on the data subject's behalf, to bring a civil claim for damages in a court with jurisdiction. It is the court that decides whether to award damages and how much, not the Regulator. If you are hoping for compensation rather than a change in how your information is handled, a section 99 court claim, not a Regulator complaint on its own, is the route that can deliver it.

If Your Complaint Is About Direct Marketing

Unwanted marketing messages are one of the most common reasons people complain to the Information Regulator. Before you lodge that kind of complaint, gather:

• screenshots or exports of the SMS, WhatsApp, email or call logs showing the marketing, with dates and times;
• copies of the message text or any recording, and any marketing links included;
• proof that you never consented, or that you withdrew consent;
• proof of any attempt you made to opt out, and how the sender responded;
• copies of any correspondence asking the sender to stop; and
• if you are lodging the complaint on someone else's behalf, proof of your identity and your authority to act for them.

Having this ready when you lodge the complaint, rather than gathering it afterwards, speeds up the Regulator's pre investigation.

Recent Enforcement Notices

The Information Regulator publishes the enforcement notices it issues. Notices on the Regulator's own record include ones against the National Police Commissioner and the South African Police Service (24 May 2023), the Department of Justice and Constitutional Development (10 May 2023), Dis-Chem Pharmacies Limited (5 February 2024), WhatsApp (16 April 2025), and the Department of Basic Education (20 November 2024). These give a sense of the range of organisations the Regulator has acted against, from government departments to large private companies.

Related Reading

For what POPIA requires in the first place, see POPIA explained. For an overview of data protection law in South Africa, see South Africa data protection law and the South Africa data privacy overview. The South Africa Laws hub links the wider site.

This guide is general legal information about South African law and is not legal advice. For advice on your own situation, consult an attorney, or contact Legal Aid South Africa (0800 110 110) if you cannot afford one.

Frequently Asked Questions

How do I lodge a complaint with the Information Regulator?

You can use Form 5, the Regulator's online portal at eservices.inforegulator.org.za, email to popiacomplaints@inforegulator.co.za, or lodge it in person at the Regulator's premises.

Can I complain about something that happened before 2021?

No. The Regulator will not accept a complaint whose cause of action arose before 1 July 2021, the date its complaints jurisdiction opened.

What happens after I lodge a complaint with the Information Regulator?

The Regulator must acknowledge your complaint within 14 days and complete a pre investigation within 30 days. It can then take no further action, attempt mediation over 30 days, refer your complaint elsewhere, or proceed to a full investigation that can lead to an enforcement notice.

Can the Information Regulator award me compensation directly?

No. Under section 99 of POPIA, a civil claim for damages goes to a court, which decides whether to award damages and how much. The Regulator may institute that claim on your behalf, but it does not award the money itself.

What should I gather if my complaint is about unwanted marketing messages?

Keep your message logs with dates and times, copies of the marketing itself, proof you did not consent or withdrew consent, records of any opt out attempts and the sender's response, and any correspondence asking them to stop.

Has the Information Regulator taken action against any organisations?

Yes. Its published enforcement notices include the South African Police Service, the Department of Justice and Constitutional Development, Dis-Chem Pharmacies, WhatsApp and the Department of Basic Education.