POPIA Complaint to the Information Regulator

Your ID number, photo, address, medical or financial data was leaked, published, or used without permission.

Forum: The Information Regulator — Protection of Personal Information Act 4 of 2013 · Your case file: R249 · preview free

How this works

Describe the information, how you found out it was mishandled, and what harm followed.
First send the organisation a POPIA notice (this pack includes it) — the Regulator wants to see you tried.
If they ignore you or you're unsatisfied, submit the Form 5 to the Information Regulator (online portal, email, or post).
The Regulator investigates, can fine (administrative penalties) and order remedial action; separately you may claim damages in court (s99).

POPIA gives you the right to complain when an organisation (the 'responsible party') processes your personal information unlawfully — a data breach, a leak, wrong information, or ignoring your deletion request. Complaints are lodged on Form 5, free, in writing or online. This pack drafts your Form 5 with the processing-condition arguments.

Your full name

Contact number

Email (for your receipt) (optional)

Your address

The organisation that mishandled your information (registered name if known)

Their address / website

Did you contact their Information Officer/DPO first? Date + what happened (write 'not answered' if none)

e.g. 'emailed info@company.co.za on 3 Aug, no reply'

When did the mishandling/breach happen or when did you discover it?

What went wrong?

What happened, in order, with evidence (links, screenshots, the post, the message, the leak report).

What was the impact? (fraud attempts, defamation, distress, account takeovers)

What do you want? (deletion, takedown, fine, damages, compliance order)

Your answers are used only to draft your case file on our own servers. We never sell or share them (POPIA-compliant — and we can draft your POPIA complaint too).

No lawyers. No jargon. Citations included.