Does Your Business Have a PAIA Manual? Here’s Why It Matters More Than You Think

Most South African small business owners have heard of POPIA — the Protection of Personal Information Act.

Many are still working on their POPIA compliance.

Fewer have given serious thought to PAIA, its older legislative sibling.

That is a mistake that is becoming more expensive as enforcement steps up.

What Is PAIA?

PAIA stands for the Promotion of Access to Information Act — the legislation that gives effect to every South African’s constitutional right to access information.

It allows any person to formally request access to records held by a government body or a private business, where that access is required to exercise or protect a legal right.

An employee can use PAIA to access their personnel file.

A journalist can use it to investigate a company.

A customer can use it to find out what personal data a business holds about them.

A PAIA manual is the document that explains how to make that request — and demonstrates that your business is ready to respond to one.

Who Is Required to Have a PAIA Manual?

Under Section 51 of PAIA, any private business with 50 or more employees is legally required to compile and make available a PAIA manual.

Failing to do so is a criminal offence.

Businesses with fewer than 50 employees are currently exempt from the formal manual requirement under a general exemption — but the exemption only covers the formal manual obligation.

It does not exempt smaller businesses from:

Responding to PAIA requests when they are received

Their POPIA obligations (including appointing an Information Officer)

Demonstrating information governance to corporate clients or during tender processes

Many larger businesses now require PAIA compliance from their suppliers.

Without a PAIA manual, you may be excluded from these opportunities regardless of your size.

The PAIA and POPIA Connection

The same person responsible for your PAIA manual — your Information Officer — is also responsible for your POPIA compliance.

Under POPIA, every South African business that processes personal data must:

Appoint an Information Officer (typically the CEO or MD)

Register that officer with the Information Regulator

Compile a processing register

Respond to data subject access requests

A modern PAIA manual addresses both Acts — documenting not just how to request access to your business records, but also how your business processes personal data and what rights data subjects have.

If your PAIA manual predates 2021 (when POPIA came into full effect), it needs to be updated.

What a PAIA Manual Must Include

Information Officer details and contact information

Categories of records the business holds (employee files, client contracts, financial records, etc.)

How to submit a formal PAIA request and what fees apply

The grounds on which a request may be refused

A description of the business’s POPIA processing activities

Where the manual is published (your website)

The Contracts4Biz PAIA Manual Template

The Contracts4Biz PAIA Manual is drafted by SchoemanLaw Inc., covers all Section 51 requirements, includes current POPIA processing activity sections, and is written in plain language.

Personalise it with your business details, publish it on your website, and your PAIA and POPIA obligations are significantly advanced.

Learn more about the PAIA Manual on the Contracts4Biz website.

It is one of the most overlooked compliance documents in South African business.

Getting it in place today is far easier — and far cheaper — than dealing with the Information Regulator later.