PAIA Compliance - What Every Business Owner Needs to Know

Category: Technology Law

Access to information is a cornerstone of transparency and accountability in South Africa. The Promotion of Access to Information Act 2 of 2000 (“PAIA”)1 gives effect to section 32 of the Constitution,2 which guarantees everyone the right of access to information held by the State and by private bodies when that information is required to exercise or protect a right. 

While this may sound like an abstract constitutional ideal, for businesses, PAIA imposes very real and practical obligations, including the requirement to have a PAIA Manual. Understanding and complying with PAIA is not optional. It is a legal duty, and failure to do so can expose a business to complaints, investigations by the Information Regulator, and reputational harm. 

What is PAIA? 

PAIA was enacted to promote transparency, accountability, and good governance by giving individuals and organisations the right to request access to records held by public and private bodies. 

The Act seeks to balance this right with the need to protect certain types of information, such as personal, confidential, or commercially sensitive data. In essence, PAIA allows access to information unless there is a valid ground for refusal.3  

Who Must Comply with PAIA? 

PAIA applies to both public and private bodies. 

• Public bodies include government departments, state-owned entities, and municipalities. 

• Private bodies include all companies, close corporations, partnerships, and even sole proprietors that hold records relating to their business activities. 

Under section 51 of PAIA,4 every private body is required to compile and publish a PAIA Manual. This manual must describe: 

• The structure and contact details of the company; 

• The types of records it holds; 

• The process for requesting access to records is straightforward. 

• Applicable fees; and 

• Other relevant information prescribed by the Information Regulator.5  

Why a PAIA Manual Matters? 

For many years, smaller private companies were exempted from preparing PAIA manuals. However, those exemptions have since expired, and the Information Regulator now expects all private bodies to comply. 

Having a proper PAIA manual demonstrates that your business operates lawfully and transparently. It also provides a straightforward process for handling requests, ensuring your company responds correctly if any client, employee, or regulator requests access to information.6  

Non-compliance can result in: 

• Administrative investigations by the Information Regulator.7  

• Civil liability where rights are infringed; and 

• Negative publicity that affects the reputation of your business. 

How to Request Access to Information? 

Any person (individual or organisation) may request access to a record held by a private or public body. The request must: 

1. Be made in writing using the prescribed form (Form C for private bodies); 

2. Include sufficient details to identify the record and the requester; and 

3. Be submitted with the prescribed request fee, where applicable. 

The body receiving the request must respond within the statutory period, generally 30 days, either granting access, refusing access with reasons, or requesting an extension. 

When Access May Be Refused? 

Although PAIA promotes access to information, it also recognises that certain information must be protected.  

A private body may lawfully refuse access if, for example: 

• The record contains confidential information of a third party. 

• Disclosure would prejudice commercial interests. 

• The information relates to ongoing legal proceedings; or 

• The record contains personal information that would breach privacy rights. 

Each refusal must be adequately motivated with reference to the applicable sections of PAIA (for example, sections 63–69).8  

The Role of the Information Regulator? 

The Information Regulator of South Africa9 oversees compliance with both PAIA and the Protection of Personal Information Act (POPIA).10 The Regulator has authority to: 

• Receive and investigate complaints about non-compliance; 

• Issue enforcement notices; and 

• Monitor publication of PAIA manuals and other obligations. 

Businesses are encouraged to submit their updated PAIA manuals to the Regulator’s office and make them accessible on their websites and premises. 

How Businesses Can Ensure Compliance? 

• Prepare and publish a PAIA Manual in accordance with section 51; 

• Designate an information officer responsible for handling requests; 

• Train staff on how to identify and process PAIA requests; 

• Review internal policies to ensure that requests are handled promptly and lawfully; and 

• Align PAIA processes with POPIA compliance, since both Acts deal with information governance.11  

Conclusion 

PAIA is more than an administrative requirement; it’s part of South Africa’s commitment to openness and accountability. Every business, regardless of size, has a legal duty to comply. Taking the time to prepare a proper PAIA manual and understand the access-to-information framework protects your business and upholds the constitutional right of access to information. 

If your company needs assistance with drafting, reviewing, or updating its PAIA Manual, our team can provide expert legal guidance to ensure full compliance. 

For further assistance, consult an attorney at SchoemanLaw.  

Anastacia Willemse | SchoemanLaw Inc   

Candidate Attorney

https://schoemanlaw.co.za/our-services/commercial-law/