South Africa
PAIA compliance, made simple
16 yes/no questions on the duties of a private business under the Promotion of Access to Information Act: your PAIA manual, who handles requests, how you respond, and how it links to POPIA. You get a score for each area and a list of gaps with what to do about each one.
ComplianceDesk gives you 7 pre-built PAIA controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving PAIA compliance stops being a spreadsheet exercise.
Take the free self-assessment: a score for each area and a list of gaps to close.
What is PAIA?
16 yes/no questions on the duties of a private business under the Promotion of Access to Information Act: your PAIA manual, who handles requests, how you respond, and how it links to POPIA. You get a score for each area and a list of gaps with what to do about each one.
- Official name
- PAIA Self-Assessment (Access to Information)
- Status
- In force. Shown as in force as we understand it. Check the current text with the regulator or an attorney, since provisions can be amended or commence at different times.
Who it applies to
- Whether it applies to you depends on your size, activities and licences. Use the free "Which laws apply to me?" checker, or read the first section of the self-assessment.
- Every private body must have a manual. The final exemption for small private bodies ended on 31 December 2021, so the manual now applies to all businesses. You do not have to send it to the Information Regulator unless they ask.
What you have to do
Your PAIA manual
A business should be able to show that it can answer yes to these: Do you have a current PAIA manual for your business? Does the manual give the head's postal and street address, phone number and email, and any other prescribed contact details? Does it describe the guide to PAIA published by the Information Regulator and how to get it? Does it list the subjects on which you hold records and the categories of records on each subject, and the records available under other laws? Does it set out how you process personal information: the purpose, the categories of data subjects and their information, who receives it, planned transfers outside South Africa, and a general description of your security measures? Is the manual on your website (if you have one) and available at your principal place of business for inspection during business hours? Can you give a copy to anyone who asks, for a reasonable fee, and to the Information Regulator on request? Do you update the manual regularly, and whenever your records or processing change?
Who handles requests
A business should be able to show that it can answer yes to these: Is the head of the business (for a company, the chief executive officer) clear that they are responsible for PAIA, and have they appointed an Information Officer? Is your Information Officer registered with the Information Regulator? Have you named deputy information officers where you need them, so a request is not missed when the Information Officer is away?
Handling a request
A business should be able to show that it can answer yes to these: Do you have a simple procedure for receiving a PAIA request on the prescribed form and passing it straight to the Information Officer? Do you decide a request and tell the requester within 30 days of receiving it, and keep a log of requests and decisions? When you refuse a request, do you give adequate reasons and the Act provisions you rely on, and tell the requester how to complain to the Information Regulator or apply to court? Do you know the grounds on which you may or must refuse access, such as protecting another person's privacy or confidential commercial information? Do you charge only the fees allowed by the prescribed fee notice for a request and for reproducing a record?
How to comply, step by step
- Your PAIA manual. Compile the manual using the template. Add the contact details of the head of the business and the Information Officer. Add a section describing the guide and where to find it on the Information Regulator's website. Write a records schedule by department (HR, finance, clients, suppliers, company secretarial) and mark which are available without a formal request. Add the POPIA processing section and keep it consistent with your privacy notice. Publish the manual on your website and keep a printed copy at reception. Decide who sends copies and set a standard fee, in line with the fee notice. Set a yearly review date and record the version. The Act sets no fixed interval, so a yearly review is a sensible practice.
- Who handles requests. Record the appointment of the Information Officer. Register on the Information Regulator's portal and keep the confirmation. Name at least one deputy, in writing, and record the delegation.
- Handling a request. Write a one-page procedure: where requests go, who logs them, and the due date. Log each request with the date received, the due date and the outcome. Use a standard refusal letter that includes reasons, the grounds relied on and the next steps open to the requester. Train the Information Officer on the refusal grounds. Take advice before refusing a request. Check the current fee notice and put the fees in the manual.
Sources and review status
Compiled from the public sources below. It is not legal advice and has not been reviewed by a lawyer. Last researched 2026-10-31. This is general information, not legal advice. Laws change, so check the current text and the regulator's notices before relying on it.
Every PAIA control, organised for you
The real control library ComplianceDesk seeds the moment you activate PAIA — 7 controls across 3 categories.
Information Officer & Manual
- PAIA-1.1 Information officer designated and registered
- PAIA-1.2 Deputy information officers appointed where applicable
- PAIA-1.3 PAIA manual compiled and kept up to date
Request Handling
- PAIA-2.1 Access request intake and response process
- PAIA-2.2 Grounds for refusal documented and applied consistently
- PAIA-2.3 Internal appeal process for refusals
Proactive Disclosure
- PAIA-3.1 Proactive disclosure of records
Frequently asked questions
How can I check where my business stands on PAIA Self-Assessment (Access to Information)?
Take the free self-assessment. It scores each area, lists your gaps with what to do about each one, and does not say you are compliant. You can save the result to ComplianceDesk to turn each gap into a task with an owner and a due date.
Is this guide written by a lawyer?
No. It was assembled from the public sources listed below and has not been reviewed by a lawyer. Treat it as a starting point and check the current law before relying on it.
How many controls does ComplianceDesk track for PAIA?
7, organised into 3 categories, ready to assign to an owner as soon as you activate the framework.
Can I track PAIA alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up PAIA in ComplianceDesk?
Activating PAIA instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Other South Africa frameworks
See your full compliance picture
193 frameworks, one system of record.