Eye spy with my little eye… Template PAIA Manuals published by the Information Regulator

Updated PAIA Manual templates for private bodies

To kick off the beginning of Access to Information month, the Information Regulator published its updated PAIA Manual templates for private bodies on its website. This follows the Information Regulator gazetting the amended Regulations relating to the Promotion of Access to Information Act, 2021 (“PAIA Regulations“) on 27 August 2021 and discussed in the Werksmans Legal Brief dated 1 September 2021. The templates have been published to assist responsible parties to develop their own PAIA Manuals, as is required in terms of Section 51 of the Promotion of Access to Information Act No. 2 of 2000 (“PAIA“).

What is a PAIA Manual?

A PAIA Manual serves as a template that responsible parties can rely on and/or reference in compiling a company specific PAIA Manual as is required in terms of Section 51 of PAIA. A PAIA Manual details the processes for data subjects requesting information from a private body and indicates what type of records are held by the particular company. In line with Section 51 of PAIA, as amended by the Protection of Personal Information Act No. 4 of 2013 (“POPIA“), a PAIA Manual must also contain details regarding the data collection and processing methods of a responsible party. This includes, amongst others, details regarding:

1. the categories and types of personal information collected by a responsible party;
2. how the personal information collected is processed and what the purpose is for such processing;
3. the recipients or categories of recipients to whom the personal information collected may be supplied;
4. any planned transborder flows of personal information; and
5. the security measures undertaken by a responsible party to ensure the confidentiality, integrity and availability of the information to be processed.

PAIA Manual availability

According to the Regulations Relating to the Protection of Personal Information, 2018 and the Information Regulator’s Guidelines, it is the responsibility of the Information Officer of an entity to develop, monitor, maintain and make available the entity’s PAIA Manual. The PAIA Manual, as prescribed in section 51 of PAIA, must be made available:

1. on the entity’s website, if applicable;
2. at the entity’s principal place of business during office hours;
3. to any person upon request and upon payment of a reasonable amount; and
4. to the Information Regulator upon request.

Also, in line with the PAIA Regulations the PAIA Manual must include a reference to the guide on how to use PAIA, as prescribed by Section 10(1) of PAIA (“Guide“). However, an updated Guide is yet to be published by the Information Regulator and at this stage the only guide available remains the South African Human Rights Commission’s “Guide on how to access the Promotion of Access to Information Act 2 of 2000“.

Conclusion

The publication of the PAIA Manual templates by the Information Regulator constitutes a major step towards ensuring all entities comply with the provisions of Section 51 of PAIA. Information Officers must take advantage of the templates provided and must ensure that their entity’s PAIA Manual is made available, as prescribed, before the 1 January 2022 deadline.

[1]  A template has also been provided for public bodies. However, this article focuses on private bodies.

Read more about POPIA: A Guide to the Protection of Personal Information Act of South Africa.

by Ahmore Burger-Smidt, Director and Head of Data Privacy and Cybercrime Practice and member of Competition Law Practice and Rebecca Hill, Candidate Attorney