Who needs a PAIA manual in South Africa? If you have been running a business here for a while, you may remember being told that your company was too small to need one.
At the time, that advice may even have been correct.
The problem is that the exemptions that created this distinction did not continue indefinitely, while the idea that “small companies don’t need PAIA Manuals” has proved surprisingly difficult to kill off.
For businesses reviewing their compliance position today, the starting point should therefore be the current requirements rather than the rules they remember from several years ago. So, who needs a PAIA manual today? The short answer is that it covers far more businesses than many owners assume.
What is a PAIA Manual?
The Promotion of Access to Information Act gives effect to the constitutional right of access to information.
In the context of a private body, this does not mean that anybody can simply demand any company record and automatically receive it. PAIA establishes a regulated process for requesting access to records, together with the circumstances in which access may be granted or refused.
The Section 51 PAIA Manual helps explain that process.
Among other things, it identifies the organisation and its relevant contact details, provides information about the records held by the organisation, explains the procedure for requesting access and contains information relating to the processing of personal information.
It effectively gives someone seeking information a map of how access to records works within that organisation.
What happened to the small-business exemption?
This is the source of much of the confusion.
Historically, exemptions meant that certain private bodies did not have to compile a PAIA Manual. This created the understandable impression that PAIA Manuals were primarily a large-company requirement.
The final exemption expired on 31 December 2021.
From 1 January 2022, the previous exemption could no longer be relied upon as the reason for a private body not having its PAIA Manual available.
Businesses that last asked who needs a PAIA manual several years ago should therefore revisit the position.
Who needs a PAIA manual: does this only affect companies?
PAIA uses the concept of a “private body”, which is broader than the everyday use of the word company.
That distinction matters because a business owner should not assume that operating through a different legal form automatically removes PAIA from consideration.
The appropriate PAIA obligations should be considered in relation to the body concerned and its circumstances. The Information Regulator’s PAIA guidance confirms that private bodies are expected to make their PAIA manuals publicly available.
Does having a PAIA Manual make the business PAIA compliant?
This is where the conversation needs to move beyond templates.
Having the manual is an important part of compliance, but it is not the complete PAIA process.
The organisation also needs to know who is responsible for information access matters, maintain the relevant Information Officer information, make its manual appropriately available, deal correctly with requests for access to records and maintain sufficient information to deal with its PAIA reporting obligations.
A beautifully formatted PDF sitting in a forgotten folder cannot perform those functions by itself.
The manual needs to form part of an operating compliance process.
What if the business already has a PAIA Manual?
Finding an existing manual is a good start, but the next question should be when somebody last looked at it.
Businesses change constantly.
Directors and employees change. Information Officers change. Physical addresses and contact details change. New software is introduced. New categories of personal information are collected. Suppliers change. Businesses start operating in new countries and information begins moving across borders.
Some of those changes can affect the information contained in the PAIA Manual.
This means an existing manual should not automatically be treated as a current manual.
PAIA and POPIA have become closely connected
One of the most important developments for businesses reviewing older PAIA Manuals is the relationship with POPIA.
PAIA Manuals now need to include relevant information concerning the processing of personal information.
That makes an old manual particularly worth reviewing because a document prepared before the organisation properly considered POPIA may no longer accurately describe its current information environment.
This also explains why PAIA should not simply be delegated to whoever happens to maintain company documents.
The information contained in the manual needs to correspond with what the organisation actually does.
What should businesses do now?
Once you have answered who needs a PAIA manual within your group of entities, the sensible approach for most organisations is to establish the current position of each one first.
Check whether a PAIA Manual exists, when it was last revised, whether the company and Information Officer details remain correct and whether the description of the organisation’s records and processing activities still reflects reality.
Then consider the operational side of PAIA.
Who would receive a request for access to information? How would it be recorded? Who would be responsible for responding? Where would the supporting documentation be stored? Would the business be able to report on requests received during the year?
Those questions tell you considerably more about PAIA compliance than simply asking whether there is a PDF on the website.
Managing PAIA compliance in Intersect
Intersect approaches PAIA as part of an organisation’s ongoing compliance environment rather than as a once-off document exercise.
The PAIA workflow allows businesses and professional firms to maintain the relevant company information, manage the Information Officer process, prepare and maintain the PAIA Manual and keep the supporting compliance record connected to the organisation.
For accounting and compliance firms managing PAIA across many clients, this also means the status of each organisation can be managed within the same compliance environment rather than through separate spreadsheets, folders and annual reminders.
See how Intersect’s PAIA compliance software helps businesses and professional firms manage PAIA as an ongoing compliance process.
