Who at the club is responsible for POPIA, and what about photographers we hire?

• Responsible party: the body that decides why and how the photos are processed (usually the club or school, not the individual volunteer) is the "responsible party". It must make sure all the conditions for lawful processing are met, both when it decides the purpose and throughout the processing (s1, s8).
• Information officer: a private body's information officer is its head, as defined in the Promotion of Access to Information Act. The information officer encourages and ensures compliance, deals with requests made under POPIA, and works with the Regulator on investigations. Information officers may only take up their duties once the body has registered them with the Regulator (s55). Deputy information officers can be designated (s56).
• Operators (hired photographers, media agencies, platforms): someone processing photos for the club under a contract or mandate is an "operator". They may only process the photos with the club's knowledge or authorisation and must keep them confidential (s20). The club must have a written contract requiring the operator to maintain proper security measures, and the operator must tell the club immediately if it believes the photos have been accessed by an unauthorised person (s21).

Source: POPIA (Act 4 of 2013) ss 1, 8, 20, 21, 55, 56.