PAIA Requests - Think Twice Before Sharing Information

The Promotion of Access to Information Act 2 of 2000 (“PAIA”) gives legislative effect to the constitutional right of access to information, as provided under section 32 of the Constitution. It creates a procedure within which both public and private bodies may be compelled to disclose records in their possession. PAIA therefore applies far beyond government: a public body includes any department of state or administration in the national, provincial or local sphere, and any other functionary or institution exercising a power or performing a function under the Constitution or a public power or function under legislation. A private body is any natural person carrying on a trade, business or profession, or any juristic person that is not a public body, which means every company, close corporation, trust, partnership, non-profit organisation and sole proprietor in South Africa falls within its scope. The distinction matters: a requester may obtain records from a public body in order to exercise or protect any right or simply because the record is held by the state, whereas access to a private body's records may be sought only where the record is required for the exercise or protection of a right. 

However, PAIA is frequently misunderstood as imposing an automatic obligation to disclose information upon request. It does not. PAIA establishes a structured decision-making process in which disclosure is conditional and, in many instances, lawfully restricted. 

Responding to a PAIA request is not an administrative exercise, but rather a legal assessment. The most significant exposure arises not from refusing access, but from disclosing where refusal was justified. 

The Interaction with Privacy Law 

PAIA must be read alongside the Protection of Personal Information Act 4 of 2013 (“POPIA”), which gives effect to the constitutional right to privacy by regulating the lawful processing of personal information. 

Requests for access to personal information under section 23 of POPIA must still be made through PAIA procedures. PAIA governs access, while POPIA restricts the disclosure of personal information. 

Accordingly, any disclosure under PAIA that involves personal information must also satisfy POPIA’s lawfulness requirements, which materially raises the risk profile of the decision. 

Disclosure Is Not Absolute 

PAIA's general duty to provide access to records is expressly qualified. Access may, and in some cases must, be refused where specific statutory grounds exist. 

These grounds, for private bodies, are provided in Chapter 4 of Part 3 of PAIA and include, inter alia: 

• mandatory protection of personal information of third parties; 

• protection of commercial and confidential information; 

• mandatory protection of third-party confidential information; 

• mandatory protection of safety of individuals, and protection of property; 

• mandatory protection of legally privileged records; 

• protection of the commercial information of the private body; 

• mandatory protection of research information of a third-party and research information of the private body; and 

• mandatory disclosure in public interest. 

Think Twice Before Disclosing Information 

The commercial question is therefore often not whether information can be disclosed, but whether it should be disclosed. Five scenarios warrant heightened scrutiny before disclosure: 

• Personal information. Any identifiable personal information engages POPIA. Disclosure without a lawful basis may expose the private body to regulatory sanction and civil liability, and even permissible disclosure may require redaction or partial refusal. 

• Commercially valuable information. Pricing models, financial data, trade secrets and commercially sensitive arrangements should not be disclosed without first assessing their value to the parties concerned. PAIA protects third-party commercial information where disclosure would cause harm, and allows the private body to refuse access to its own; once disclosed, the competitive disadvantage may be irreversible. 

• Third-party rights. Records containing information provided by clients, suppliers, investors or counterparties may be subject to confidentiality or contractual undertakings, which PAIA protects. Failing to assess those rights before disclosure may result in contractual liability and reputational harm. 

• Legal privilege. Attorney-client communications, legal opinions and litigation strategy are strongly protected under PAIA. Improper disclosure may waive privilege irreversibly, prejudicing proceedings and the position of the person to whom the privilege attaches, so any record with potential legal content must be reviewed carefully before disclosure. 

• Pending litigation or regulatory action. Where the private body faces ongoing or anticipated litigation, arbitration or regulatory investigation, PAIA permits refusal where disclosure would prejudice those proceedings or enforcement processes. Premature release may compromise strategy or hand an evidentiary advantage to opposing parties, so disclosure decisions must align with the broader litigation strategy. 

Public Interest 

PAIA is not intended to facilitate fishing expeditions. Requests that are vague, excessively broad, or impose a substantial and unreasonable diversion of resources may be refused. 

However, the head of a private body must grant access to a record if its disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious risk to public safety or the environment. 

This is a balancing requirement, namely that the public interest in disclosure must clearly outweigh the harm protected by the relevant exemption. 

The Correct Approach to PAIA Compliance 

Over-disclosure is often irreversible. Once information is released under PAIA, control over it is effectively lost: it may be disseminated, relied upon, or used in ways that cannot be undone. 

Accordingly, effective PAIA compliance requires a disciplined, legally informed approach. Each request must be assessed against: 

• the nature of the information requested; 

• the rights of the requester (particularly for private bodies); 

• the applicability of statutory refusal grounds; and 

• the potential consequences of disclosure. 

Where necessary, partial disclosure through redaction should be considered to balance transparency with risk mitigation. 

PAIA responses should be escalated where legal, commercial, or regulatory sensitivities are identified. Delegating such decisions to purely administrative functions materially increases risk. 

Conclusion 

PAIA is a transparency mechanism, but it is not absolute. It balances access to information against competing rights and interests, including privacy, commercial integrity, legal privilege, and public interest. 

The central discipline in PAIA compliance is restraint. The question is not simply whether information can be disclosed, but whether disclosure is appropriate in the circumstances. 

A PAIA request can land on your desk at any time, and a wrong decision cannot be undone once the information is out. Before you release a single record, get the advice you need. Contact an expert at SchoemanLaw Inc today. 

https://schoemanlaw.co.za/services/commercial-law/  

https://schoemanlaw.co.za/services/contract-drafting/  

https://schoemanlaw.co.za/services/technology-law/

Nicolene Schoeman-Louw | SchoemanLaw Inc         

Specialist Technology, Commercial and Contract Law