The Compliance Document Most South African Businesses Have Heard Of — But Few Have Sorted Out
Ask most small business owners if they have a PAIA manual, and you will get one of three answers.
The first: “A what?”
The second: “We’re supposed to have one of those, aren’t we? I keep meaning to sort it out.”
The third: “Yes — actually, I think our lawyer drafted one years ago. I’m not sure if it’s still current.”
None of these are great answers. But the third is actually the most common, and arguably the most problematic — because a PAIA manual that was accurate in 2019 does not reflect South Africa’s current information governance framework, and specifically does not account for the Protection of Personal Information Act (POPIA), which has been fully operational since 2021.
Here is what your business needs to know about PAIA manuals, POPIA, and the compliance framework that ties them together.
What Is PAIA?
PAIA stands for the Promotion of Access to Information Act 2 of 2000.
It gives effect to Section 32 of the South African Constitution — the constitutional right of access to information. In plain terms: any person (or organisation) has the right to request access to records held by a public or private body, where that access is required for the exercise or protection of any right.
An employee who wants to access their personnel file can make a PAIA request. A journalist investigating a company can make a PAIA request. A customer who wants to know what personal data a business holds about them can use PAIA to compel disclosure.
The PAIA manual is the mechanism through which these rights are exercised. It tells anyone who wants to make a PAIA request exactly how to do it — which records the business holds, who handles requests, what fees apply, and what recourse exists if a request is refused.
Who Oversees PAIA?
PAIA was originally administered by the South African Human Rights Commission (SAHRC) for private bodies. Since the establishment of the Information Regulator under POPIA, the Information Regulator now handles PAIA enforcement for private bodies.
This matters because the Information Regulator is an active enforcement body — not a passive one. It receives and investigates complaints, issues enforcement notices, and can refer matters for prosecution. The days of PAIA being a largely theoretical compliance obligation are over.
Who Needs a PAIA Manual?
All Private Bodies (Regardless of Size)
Under Section 51 of PAIA, private bodies — which includes all companies, close corporations, partnerships, and sole traders — are all legally required to compile and make available a PAIA manual. Since 1 January 2022, when the previous general exemptions lapsed, no private body is exempt from this requirement, regardless of its number of employees or turnover.
This is not optional. Failure to compile a Section 51 manual is a criminal offence under PAIA, punishable by a fine or imprisonment.
Smaller Businesses: The Exemption Has Ended
The SAHRC historically issued general exemptions that relieved private bodies with fewer than 50 employees from the Section 51 manual requirement, but those exemptions lapsed on 31 December 2021 and were not renewed. Since 1 January 2022, every private body must have a manual. However:
- This exemption ended on 31 December 2021 — since 1 January 2022 no private body is exempt from the Section 51 manual requirement
- The exemption applies only to the formal manual requirement — it does NOT exempt smaller businesses from responding to PAIA requests
- Any person can still submit a PAIA request to your business, and you are legally obliged to respond, whether you have a manual or not
- The Information Regulator can investigate your data governance practices under POPIA regardless of your PAIA manual status
In practical terms: every private body — regardless of size — is now legally required to have a PAIA manual, and there are further compelling reasons to get it right. Here is why.
Why Every South African Business Should Have a PAIA Manual
1. It Is Required for Enterprise and Government Business
Many large companies, parastatals, and government entities require their suppliers to demonstrate PAIA compliance as part of tender or supplier onboarding processes. A business without a PAIA manual may be excluded from these opportunities.
2. It Demonstrates POPIA Readiness
PAIA and POPIA are closely connected. Your Information Officer has responsibilities under both Acts. A PAIA manual that includes your POPIA processing activities demonstrates that your business takes data governance seriously — which matters to corporate clients, potential investors, and increasingly to South African consumers.
3. It Protects You When Requests Come In
Requests for access to records do come in — from employees, from customers, from competitors, from journalists. Without a PAIA manual, you have no framework for handling them, no published fees, and no documented process for the requester to follow. This leaves your business exposed to informal demands and the risk of accidental disclosure.
4. It Is an Information Governance Foundation
The process of compiling a PAIA manual requires you to catalogue the records your business holds, the subjects they cover, and who is responsible for them. This is exactly the kind of information governance exercise that POPIA also requires. Completing one well goes a long way toward completing the other.
PAIA and POPIA: Understanding the Connection
This is the most important thing to understand about PAIA manuals in 2026: you cannot treat PAIA in isolation from POPIA.
Before POPIA, a PAIA manual was primarily a procedure document — it told people how to request access to your business records. After POPIA, the same Information Officer who manages PAIA requests is also responsible for your business’s data protection compliance.
The Information Officer Role Under Both Acts
Under PAIA, every private body must designate an Information Officer — typically the head of the organisation (CEO, MD, or sole proprietor). The Information Officer is responsible for:
- Receiving and processing PAIA requests
- Compiling and updating the PAIA manual
- Responding to requesters within the prescribed timeframes
Under POPIA, the same Information Officer has additional responsibilities:
- Ensuring the organisation complies with POPIA’s eight conditions for lawful processing
- Compiling a processing register (a record of all personal data the business processes)
- Registering with the Information Regulator
- Handling data subject access requests (SARs) under POPIA
- Notifying the Information Regulator and data subjects of any security compromises
Critically: your Information Officer must be registered with the Information Regulator under POPIA. This is not optional for any business that processes personal data — which means virtually every business in South Africa.
What a Modern PAIA Manual Should Include
A PAIA manual that was compiled before POPIA came into effect is incomplete. A current PAIA manual for a South African business should address both frameworks:
Section 1: Details of the Information Officer
- Full name and contact details of the Information Officer
- Full name and contact details of any Deputy Information Officers
- Confirmation of registration with the Information Regulator
Section 2: Guide on How to Request Access to Records
- Reference to the SAHRC and Information Regulator guides on how to use PAIA
- Where requesters can find these guides (on the SAHRC website, in all official languages)
Section 3: Records Available Without a PAIA Request
- Some records are available automatically — describe what your business makes publicly available and how to access them
- Under POPIA, data subjects have a right to access their personal data without necessarily going through the full PAIA process
Section 4: Records Available With a PAIA Request
- A description of the categories of records your business holds
- The subjects on which records are held (examples: employee records, client contracts, financial records, supplier agreements, legal correspondence, POPIA processing records)
- How to submit a formal PAIA request — the prescribed Form 2 (under the PAIA Regulations, 2021)
Section 5: Fees
- The request fee (currently R140 per PAIA request, payable before processing begins)
- The access fee (charged per page, format, or time for searching and preparing records — prescribed by regulation)
- Circumstances in which fees may be waived (for example, for personal records, or for requests clearly in the public interest)
Section 6: Grounds for Refusal
- A plain-language description of the grounds on which your business may refuse a PAIA request — confidential commercial information, third-party personal information, legally privileged records, etc.
- The requester’s right to lodge a complaint with the Information Regulator (for private bodies there is no internal appeal step — the requester complains to the Regulator or applies to court)
Section 7: POPIA Processing Activities
- A description of the categories of personal data your business processes and for what purposes
- Who data is shared with (third parties, operators)
- How data is secured
- Data subject rights under POPIA and how to exercise them
Section 8: Availability of the Manual
- Where the manual is published (typically on your website, in PDF form)
- That it is available in English and, if feasible, in other official languages
The Consequences of Non-Compliance
Under PAIA
- Failure to compile and make available a Section 51 manual is a criminal offence
- Failure to respond to a PAIA request within the prescribed period is deemed a refusal, entitling the requester to lodge a complaint with the Information Regulator
- Wilfully obstructing access to a record to which a requester is entitled carries criminal penalties
Under POPIA
- Failure to appoint and register an Information Officer exposes your business to enforcement action by the Information Regulator
- Failure to respond to data subject access requests (which overlap significantly with PAIA requests for personal data) is a POPIA violation
- Administrative fines under POPIA can reach R10 million
- Criminal liability applies in cases of intentional non-compliance
Reputational Consequences
Beyond the legal penalties, a business that cannot handle a legitimate information request professionally — or that has no documented process for doing so — signals to clients, partners, and regulators that it does not take governance seriously. In a competitive environment where enterprise procurement processes increasingly assess supplier compliance, this matters.
What to Do Right Now
Step 1: Appoint Your Information Officer
The head of your organisation (or a senior person they designate) should be formally appointed as Information Officer and registered with the Information Regulator at inforegulator.org.za.
Step 2: Compile or Update Your PAIA Manual
If you do not have a PAIA manual, compile one. If you have one that pre-dates POPIA (i.e., before July 2021), update it to include the POPIA processing activities sections.
Step 3: Publish It
Your PAIA manual should be available on your website in PDF form. It should be easily findable — typically linked in the footer alongside your Privacy Policy and Terms and Conditions.
Step 4: Keep It Current
Your PAIA manual is a living document. Update it whenever your Information Officer changes, whenever you add new categories of record or processing activity, or whenever the Information Regulator issues new guidance.
Get a Professionally Drafted PAIA Manual Today
Contracts4Biz offers a PAIA manual template drafted by SchoemanLaw Inc. — a South African commercial law firm with more than 20 years’ experience in information law, data protection, and business compliance. The template:
- Covers all Section 51 requirements under PAIA
- Includes current POPIA processing activities sections
- Reflects the Information Regulator’s current requirements for Information Officer registration
- Is written in plain, accessible language — not dense legislative text
- Is updated in real time as PAIA and POPIA requirements evolve
- Takes minutes to personalise and publish
Download your PAIA Manual template →
Also need a compliant Privacy Policy for your website? Browse our Website T&Cs and Privacy Policy template →
Not sure whether your business is fully POPIA and PAIA compliant? Take our free business risk assessment for a personalised compliance review or setup a free 30-minute consultation with our law firm partners SchoemanLaw Inc.
Frequently Asked Questions
Does every South African business need a PAIA manual? Yes. Under Section 51 of PAIA every private body must compile a manual. The general exemption that previously relieved smaller private bodies lapsed on 31 December 2021, so since 1 January 2022 no body is exempt, regardless of size or turnover. Importantly, all businesses — regardless of size — must still respond to PAIA requests, and all businesses that process personal data must comply with POPIA, which includes appointing and registering an Information Officer.
What is the difference between PAIA and POPIA? PAIA (Promotion of Access to Information Act) gives people the right to request access to records held by businesses and public bodies. POPIA (Protection of Personal Information Act) governs how personal data is collected, processed, stored, and protected. The two Acts overlap — particularly around the Information Officer role and data subject access rights — and a modern PAIA manual should address both.
Who should be the Information Officer? Typically the head of the organisation — the CEO, managing director, or sole proprietor. The Information Officer must be registered with the Information Regulator. Larger organisations may designate deputy Information Officers for specific business units or locations, but the head of the body remains the primary Information Officer.
What records must a business disclose under PAIA? Not all records are automatically disclosable. PAIA sets out specific grounds on which a business may refuse access — including third-party personal information, confidential commercial information, legally privileged records, and records whose disclosure would be unreasonable. Your PAIA manual should describe the categories of records you hold and the grounds for refusal that may apply.
Is a PAIA manual the same as a Privacy Policy? No. A Privacy Policy (required under POPIA for any website or business that collects personal data) explains how you collect, use, protect, and share personal data, and is primarily directed at your customers and website visitors. A PAIA manual is a formal governance document that explains how any person can request access to your business records under the Promotion of Access to Information Act. Both documents are required, and they serve different purposes — though a modern PAIA manual should cross-reference your POPIA compliance framework.
