The PAIA Manual: What It Is, Who Needs One and How to Write It

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives people a right to request records held by public and private bodies. If you run a business in South Africa, you are a "private body", and PAIA expects you to explain what records you hold and how someone can ask for them. That explanation is the PAIA manual. Since POPIA took effect, the manual has also become the place where a business describes how it handles personal information, so it is checked more often than it used to be.

This guide is general information compiled from public sources, not legal advice. Rules, forms and exemptions change, so check the Information Regulator's website (inforegulator.org.za) for the current position before you publish.

Who needs a PAIA manual?

Section 51 of PAIA requires the head of a private body to compile a manual. A private body is any natural person who carries on a trade, business or profession, a partnership, or a company or other legal entity. In practice that is almost every business, from a sole proprietor to a listed company.

Exemptions have existed for some small private bodies and have been extended, narrowed and re-issued over the years. Do not rely on a memory of an old exemption. Check the Regulator's current notices, and if you are unsure whether yours applies, writing the manual is cheap compared with explaining its absence.

What the manual must contain

Section 51(1) lists the content. In plain terms, your manual should cover:

1. Who you are and how to reach you: the business name and registration number, the head of the business, the postal and street address, phone and email, and the details of your Information Officer.
2. The Information Regulator's guide: a note that the Regulator publishes a guide on how to use PAIA, and how to get it.
3. The records you hold, by subject and category. This is a list of types of records, such as company records, financial records, staff records and customer records, not an inventory of every file.
4. The records you make available without a formal request, for example your website content and published brochures.
5. How to make a request for access: the prescribed form, where to send it, what you need to identify the record, the fees that apply, and how long you will take to answer.
6. A description of how you process personal information under POPIA: the purposes, the categories of data subjects and of information, the recipients, any planned transfers outside South Africa, and a general description of your security measures.

How an access request works

A requester completes the prescribed request form and sends it to you. Check the Regulator's site for the current form, because the regulations were updated and old copies are still circulating. The form asks the requester to identify the record, say how they want access, and explain the right they are trying to protect if they ask for records that are not their own.

• Time: you must decide within 30 days of receiving the request. You can extend by up to a further 30 days in limited cases, such as a large volume of records or a search that cannot reasonably be done in time, and you must tell the requester.
• Fees: a request fee applies to requests for records about someone other than the requester, and an access fee covers reproduction, search and preparation. The amounts are prescribed in the regulations.
• Refusal: you may refuse on the grounds PAIA allows, for example to protect another person's privacy, a third party's commercial information, confidential information, or the safety of people or property. A refusal must give reasons and tell the requester how to complain.
• Silence: if you do not respond in time, the law treats it as a refusal. That is the worst way to refuse, because the requester has no reasons and may go straight to the Regulator or the courts.

What happens if someone disagrees with your answer

A requester who is refused (or ignored) by a private body can complain to the Information Regulator or apply to court. Public bodies have an internal appeal; private bodies do not. The Regulator can investigate, issue an enforcement notice and, in some cases, an infringement notice with a fine. The practical lesson is that it is far better to answer every request in time, even with a considered refusal.

Writing the manual step by step

1. Collect the facts: registration number, who the head of the business and the Information Officer are, how people can contact you.
2. List your record categories. Walk through your teams (finance, people, sales, support, technical) and name what each keeps.
3. List your systems that hold personal information and what each is for. A record of processing is the best source for the POPIA section of the manual, and it is also something POPIA expects you to be able to produce.
4. Decide what you will not publish. Public manuals should describe security measures in general terms only.
5. Decide which address to publish. The Act asks for a postal and a street address. If the business operates from a home, think before publishing it, and look at what the Regulator's current guidance accepts, such as a registered office or a postal box. The registered office is usually already public through the CIPC.
6. Write it in plain language, date it, and have the head of the business approve it.

Publishing, keeping and reviewing it

• Keep a copy at your offices and make it available on request.
• Put it on your website if you have one, with a footer link so it is easy to find.
• Check the Regulator's current instructions for whether a copy must be submitted to it or simply held. These steps have changed, so do not assume.
• Review it at least once a year and whenever your records or processing change, such as a new payment provider, a new product that holds personal information, or a change in who the Information Officer is. Save each dated version.

Common mistakes

• Copying another company's manual and leaving its name, address or systems in it.
• Listing every file instead of categories of records.
• Leaving the POPIA section generic and out of step with what the business actually does, for example saying no information goes abroad when the cloud provider's servers are overseas.
• Publishing a home address by accident.
• Writing it once and never reviewing it.

ComplianceDesk includes a PAIA manual template for private bodies, and a calendar reminder so the yearly review does not get missed. Pair it with a record of processing so the POPIA section of the manual stays accurate.