Privacy and data

PAIA Manual (Private Body)

The manual that a private business must have under the Promotion of Access to Information Act. It tells people what records you hold, how to ask for access, and includes the POPIA information about how you process personal information.

Starting point, not legal advice. It is general information and not legal advice. Have it reviewed by a South African attorney before you rely on it. Status: compiled from public sources, not reviewed by a lawyer. Wording last checked 2026-10-31.

1. Fill in your details

The person who is the head of the private body, for example the CEO or sole owner.

List the real categories, separated by commas.

A general description is enough. Do not include details that would weaken your security.

2. Download

17 fields still empty. They show highlighted in the document so you can finish them in Word.

Sign up free to download

Already have an account? Log in.

Preview

PAIA Manual: [Organisation name]

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA"). Date: [Date of this manual].

1. About the business

[Organisation name] (registration number [Registration number]) is a private body. [What the business does]

2. Contact details

  • Head of the private body: [Head of the business]
  • Information Officer: [Information Officer (if different)]
  • Physical address: [Physical address]
  • Postal address: [Postal address]
  • Phone: [Phone]
  • Email: [Email for requests]
  • Website: [Website]

3. The Information Regulator's guide

The Information Regulator (South Africa) has published a guide on how to use PAIA, including how to make a request. You can get it from the Regulator's website at inforegulator.org.za or by contacting the Regulator directly. Questions about this guide can also be sent to the Regulator.

4. Records we hold

We hold the following categories of records: [Categories of records you hold].

A record is not automatically available because it is listed here. Records may be refused on the grounds PAIA allows, for example to protect the privacy of another person, commercial information of a third party, confidential information, or the safety of people or property.

5. Records available without a request

Information on our website at [Website] and our published marketing material is available without a formal request. No notice has been published under section 52(2) of PAIA unless stated otherwise.

6. How to request access to a record

  1. Complete the request form prescribed under PAIA. Copies are available from the Information Regulator's website or from us.
  2. Give enough detail to identify the record and the requester, say which form of access you want, and say how you want to be informed of our decision. If you ask on behalf of someone else, attach proof of your authority.
  3. Send the form to the Information Officer or head of the business at the email or address above.
  4. We will decide and tell you within the time PAIA allows. If we need more time or more information, we will tell you.
  5. A request fee and an access fee may apply, as prescribed under PAIA. We will tell you the amount and any deposit before we continue.
  6. If we refuse, we will give you the reasons and tell you how to complain to the Information Regulator or apply to court.

7. Processing of personal information (POPIA)

  • Purpose: we process personal information to run our business, provide our services, meet our legal duties and manage our relationships with customers, employees and suppliers.
  • Whose information: [Whose personal information you process]
  • Categories of information: [Personal information you process]
  • Who we share it with: [Who you share it with]
  • Transfers outside South Africa: [Countries information may be sent to]
  • Security: [Security measures]

People can ask us to correct or delete their personal information, or object to its processing, through our Information Officer. See our privacy notice for more.

8. Updates

We review this manual at least once a year and whenever our records or processing change.

When to use it

  • You are a private company, close corporation, partnership or sole proprietor and do not yet have a PAIA manual
  • Your existing manual is out of date or has no POPIA section
  • A client, tender or auditor asks for your PAIA manual

Before you use it

  • Walk through your business and list the real categories of records you hold. A generic list is easy to spot and not helpful
  • The manual should be available at your offices, and on your website if you have one. Keep a copy for the Information Regulator
  • The Information Regulator publishes a guide on how to use PAIA. Link to it, and check its current wording and any model manual it provides
  • Refusal grounds in the Act are limited. Do not add grounds that the Act does not allow
  • Have an attorney review the manual, especially the sections on request fees and grounds for refusal

Related laws and frameworks

Sources

Keep this policy current and acknowledged

Store it in ComplianceDesk, track versions and collect staff acknowledgements.

Start free trial