PAIA Self-Assessment (Access to Information)

1. Do you have a current PAIA manual for your business?

(PAIA s51)

2. Does the manual give the head's postal and street address, phone number and email, and any other prescribed contact details?

(PAIA s51(1))

3. Does it describe the guide to PAIA published by the Information Regulator and how to get it?

(PAIA s51(1))

4. Does it list the subjects on which you hold records and the categories of records on each subject, and the records available under other laws?

(PAIA s51(1))

5. Does it set out how you process personal information: the purpose, the categories of data subjects and their information, who receives it, planned transfers outside South Africa, and a general description of your security measures?

These POPIA items were added to the manual by POPIA. A manual written before POPIA needs to be updated. (PAIA s51(1))

6. Is the manual on your website (if you have one) and available at your principal place of business for inspection during business hours?

(PAIA s51(3))

7. Can you give a copy to anyone who asks, for a reasonable fee, and to the Information Regulator on request?

(PAIA s51(3))

8. Do you update the manual regularly, and whenever your records or processing change?

(PAIA s51(2))

1. Is the head of the business (for a company, the chief executive officer) clear that they are responsible for PAIA, and have they appointed an Information Officer?

(PAIA, POPIA s55)

2. Is your Information Officer registered with the Information Regulator?

(POPIA s55(2))

3. Have you named deputy information officers where you need them, so a request is not missed when the Information Officer is away?

(PAIA s17, POPIA s56)

1. Do you have a simple procedure for receiving a PAIA request on the prescribed form and passing it straight to the Information Officer?

(PAIA ss 18, 53)

2. Do you decide a request and tell the requester within 30 days of receiving it, and keep a log of requests and decisions?

The 30-day period is stated for public bodies in section 25. Private bodies have an equivalent deadline in the Act's private-body provisions. Check the section when you set your procedure. (PAIA s25, s56)

3. When you refuse a request, do you give adequate reasons and the Act provisions you rely on, and tell the requester how to complain to the Information Regulator or apply to court?

(PAIA s25(3), s56)

4. Do you know the grounds on which you may or must refuse access, such as protecting another person's privacy or confidential commercial information?

(PAIA Chapter 4)

5. Do you charge only the fees allowed by the prescribed fee notice for a request and for reproducing a record?

(PAIA s54)