A PAIA manual is a document every South African business must have under section 51 of the Promotion of Access to Information Act (PAIA). It tells the public what records your business keeps, how to ask for access to them, and how you handle personal information. Most small businesses don’t have one, often because they remember a time when they didn’t need to.
Does your business need one?
Almost certainly yes. PAIA applies to every private body, which includes:
- a sole proprietor, or anyone carrying on a trade, business or profession;
- a partnership;
- a company or close corporation, including a non-profit company.
For years, private bodies with fewer than 50 employees and turnover below set thresholds were exempt. That exemption was extended several times and finally ended on 31 December 2021. Since 1 January 2022, no private body has been exempt, whatever its size.
The person responsible is the head of the business, who is also its Information Officer by default.
A PAIA manual is not a privacy policy
The two are often confused, and many businesses have one and think it covers both.
| PAIA manual | Privacy policy | |
|---|---|---|
| Law | PAIA, section 51 | POPIA (openness and notification) |
| Answers | What records do you hold, and how can someone formally request them? | What personal information do you collect, why, and what are people’s rights? |
| Who reads it | Anyone wanting access to your records, and the Information Regulator | Your customers, staff and website visitors |
You need both. The PAIA manual does include a section on personal information (below), but it doesn’t replace the notice people get when you collect their information.
What a PAIA manual must contain
Section 51(1) of PAIA, as amended by POPIA, sets out the contents. In plain language:
1. How to reach you
- The postal and street address, phone number and email address of the head of the business.
2. How access to your records works
- A description of the Information Regulator’s guide on how to use PAIA, and how to get a copy of it.
- Any records you make available without a formal request.
- Records you keep because other laws require them (for example tax, employment and company law).
- The subjects you hold records on, and the categories of record under each, in enough detail for someone to know what to ask for.
3. How you process personal information
- Why you process personal information.
- Whose information you hold (customers, staff, suppliers) and what kinds.
- Who you share it with.
- Whether you plan to send it outside South Africa.
- A general description of the security measures that keep it confidential, accurate and available.
The Information Regulator publishes a PAIA manual template for private bodies that follows this structure. Our own PAIA manual uses it, if you want to see a finished one for a small business.
Where it must be available
Under section 51(3), you must make your manual available:
- on your website, if you have one;
- at your main place of business, for anyone to inspect during normal business hours;
- to anyone who asks for a copy (you may charge a reasonable fee for a printed copy);
- to the Information Regulator, when it asks for it.
You don’t routinely lodge it with the Regulator. A manual in a drawer that nobody can find doesn’t meet the requirement either.
Keep it current
Section 51(2) requires the head of the business to update the manual on a regular basis. A practical rule: review it at least once a year, and update it whenever your contact details, the records you keep, the reasons you process personal information or the people you share it with change.
The manual is separate from the PAIA annual report submitted to the Information Regulator each year, which records the access requests you received.
Getting yours done
- Drafted for you by a specialist. We work with an accredited POPIA and PAIA specialist firm that writes your PAIA manual and privacy notice around your business, for R4 100. They can also register your Information Officer for R2 000. Book the specialist.
- Do it from a template. A ClearComply Business Account (R99/month) includes a PAIA manual template and a privacy policy template, alongside reminders for your PAIA, POPIA, CIPC and COIDA deadlines. See the Business Account.
Not sure where you stand? The free PAIA self-assessment takes a few minutes and tells you which pieces you are missing.
Questions people ask
Does a small business need a PAIA manual?
Yes. Small private bodies used to be exempt, but that exemption ended on 31 December 2021. Since 1 January 2022 every private body must have a PAIA manual, including sole proprietors, partnerships, companies and close corporations.
Is a PAIA manual the same as a privacy policy?
No. A privacy policy tells people how you use their personal information. A PAIA manual explains what records your business holds and how someone can formally request access to them, and it includes a section on how you process personal information. You need both.
Do I have to send my PAIA manual to the Information Regulator?
Not routinely. Section 51 requires you to make it available on your website if you have one, at your main place of business, to anyone who asks, and to the Information Regulator when it asks for it.
How often must a PAIA manual be updated?
The Act says the head of the business must update it on a regular basis. In practice, update it whenever something in it changes: contact details, the records you keep, why you process personal information, or who you share it with.
Sources: Promotion of Access to Information Act 2 of 2000, section 51, as amended by the Protection of Personal Information Act 4 of 2013; Information Regulator, PAIA manual template for private bodies. This article is general information, not legal advice.