Search for “PAIA compliance South Africa” and much of the advice you will find focuses on a single document. For many South African businesses, PAIA compliance starts and ends with a document saved somewhere called the “PAIA Manual”.
Unfortunately, that is also where much of the confusion around PAIA begins.
The Promotion of Access to Information Act is not simply a requirement to create a manual. It establishes a framework through which people can request access to records held by public and private bodies, while placing corresponding responsibilities on those bodies to know what information they hold, who is responsible for dealing with requests and how those requests should be handled.
For a business, PAIA compliance therefore needs to be treated as an ongoing compliance process rather than a document-generation exercise.
Does PAIA apply to private businesses?
Yes.
The previous exemptions that allowed certain private bodies to avoid the requirement to compile a PAIA Manual came to an end, which means businesses should no longer assume that being small, owner-managed or below a particular turnover threshold removes the requirement.
This is particularly important for smaller companies because many still work from outdated advice that PAIA Manuals are only required by larger organisations.
A business should therefore establish its PAIA obligations based on the current regulatory framework rather than relying on an exemption that may have applied several years ago.
In other words, when it comes to PAIA compliance South Africa does not offer small businesses a blanket exemption.
The PAIA Manual is the starting point
Section 51 of PAIA deals with the manual required from a private body.
The purpose of the manual is not simply to prove that a business has one. It is intended to explain what records the organisation holds, which records may be available without a formal request, how someone can request access to other records and who within the organisation is responsible for dealing with that request.
The manual also needs to reflect relevant information relating to the organisation’s processing of personal information under POPIA.
This is one reason generic PAIA Manual templates have limitations. Two businesses may have similar company details, but their employees, customers, suppliers, systems, records and processing activities can be very different.
A useful PAIA Manual needs to reflect the organisation it belongs to.
Your Information Officer forms part of the picture
PAIA compliance also has a human component.
Every organisation needs clarity about who carries the responsibility for dealing with information access matters. The Information Officer role is also closely connected with POPIA, making this one of the areas where the two pieces of legislation intersect in practice.
It is not enough for everyone in the organisation to assume that “someone in compliance” deals with it.
The relevant officer needs to be identified, the required records need to be maintained and the appropriate registration with the Information Regulator needs to be dealt with.
This becomes especially important when the person responsible for the role leaves the organisation or changes position. A PAIA Manual containing the details of somebody who left the business two years ago is a good example of why compliance cannot be treated as a once-off project.
What happens when somebody requests information?
This is where the operational side of PAIA becomes much more obvious.
If a request for access to records is received, the organisation needs to know that the request exists, when it was received, what information has been requested and what has happened to it.
There are prescribed forms and procedures dealing with requests for access to records, as well as circumstances in which access may be granted or refused.
From a compliance-management perspective, the important point is that the request becomes a workflow.
Someone needs to own it. Dates need to be recorded. Supporting documents and correspondence need to be retained. The eventual outcome needs to be recorded.
Trying to reconstruct all of that months later when preparing regulatory information is considerably harder than capturing it properly when it happens.
PAIA also has an annual reporting component
The Information Regulator calls on public and private bodies to report information relating to access requests received and processed during the relevant reporting period.
For a company that received no requests, the exercise may be relatively straightforward. For an organisation that dealt with several requests during the year, the quality of the underlying records suddenly matters.
This is another reason PAIA compliance should operate throughout the year.
If every request, response and outcome is recorded as part of the compliance process, annual reporting becomes an output of information the organisation already maintains rather than an annual exercise in searching through inboxes.
It is also the part of PAIA compliance South Africa’s businesses are most likely to forget, simply because it only comes around once a year.
PAIA and POPIA should not live in separate universes
Businesses often speak about PAIA and POPIA as though they are unrelated compliance projects.
Operationally, that makes little sense.
Both deal with information. Both involve the Information Regulator. The Information Officer role connects the two regimes, and the PAIA Manual itself includes information relating to the processing of personal information.
The practical question for a business is therefore not simply whether it has a POPIA file and a PAIA file.
The better question is whether the organisation has a coherent information compliance process.
What should a business be able to see?
When it comes to PAIA compliance South Africa’s legislation expects more than a manual sitting in a shared folder.
A sensible PAIA compliance process should allow a business to establish, without beginning another internal investigation, whether its PAIA Manual has been completed and remains current, whether the relevant Information Officer information is in place, whether any access requests are outstanding and whether the information required for annual reporting has been maintained.
For accounting, company secretarial and compliance practices managing this work for multiple clients, that requirement becomes even more important.
A spreadsheet containing a column marked “PAIA Manual: Yes” tells you very little about the actual compliance position of the client.
The underlying workflow and evidence matter.
PAIA compliance South Africa: moving from documents to an ongoing process
This is the distinction we have tried to make inside Intersect.
The objective is not simply to generate another compliance document. Intersect’s PAIA compliance software provides a structured environment in which the relevant company information, Information Officer process, PAIA Manual and associated compliance work can be managed as part of the organisation’s broader compliance record.
For accounting practices and company secretaries managing PAIA compliance South Africa-wide on behalf of clients, the same principle can then be applied across a portfolio of clients rather than maintaining disconnected documents, spreadsheets, emails and reminders for every entity.
PAIA compliance becomes considerably easier to manage when you can see the work, the responsibility and the supporting evidence in one place.
Learn more about Intersect’s PAIA compliance software and how the PAIA workflow fits into the broader compliance record of your business or client portfolio.
