PAIA deals with a person’s constitutional right of access to any information held by public and private bodies that is required for the exercise or protection of any rights subject to justifiable limitations. Accordingly, PAIA attempts to foster a culture of transparency and accountability in public and private bodies by giving effect to this right of access. POPIA and PAIA are intrinsically linked as the “information” laws in South Africa the one protecting freedom of information and the other protecting the unwarranted exposure of personal information.

Importantly, as of 1 July 2021, the Information Regulator has replaced the South African Human Rights Commission as the responsible body for the regulatory mandate functions relating to PAIA and its Regulations. As a result of that change in responsibility, new Regulations in terms of section 92 of PAIA were published on 27 August 2021.

In summary, private bodies are now required to:-

• publish a PAIA manual in terms of section 51(1) of PAIA by 31 December 2021 on the website of the private body and a copy thereof must be made available at its principal place of business for public inspection during normal business hours; and
• in terms of Regulation 2, the information officer of a private body must have a copy of the guide, in at least two official languages, available at his or her registered head office for public inspection during normal business hours. No fees may be charged for making copies of the guide or for the inspection thereof.

The “guide” refers to the guide contemplated in section 10 of PAIA which was compiled by the South African Human Rights Commission for the purposes of assisting persons who wish to exercise any right in terms of either PAIA or POPIA. It is likely that the Information Regulator will update the current guide in due course however the most recent guide, in all official languages, can be requested from the Information Regulator. The relevant request forms can be obtained from the website of the Information Regulator.

Previously, as of 11 December 2015, all private bodies were exempt from compiling a PAIA manual as contemplated in section 51(1) of PAIA except any company which was not a private company as defined in section 1 of the Companies Act 71 of 2008 as amended (“Companies Act”) or which was defined in section 1 of the Companies Act as a private company and operated within any one of the listed sectors which included, inter alia, the Agriculture, Mining, Construction and Manufacturing sectors and either had 50 or more employees in its employment or had a total annual turnover that was equal to or more than the amounts listed in the Government Notice 1222 GG 39504 for each sector. This exemption initially operated from 1 January 2016 to 31 December 2020 but it was extended on two occasions to 30 June 2021 and finally to 31 December 2021.

Section 51(4) of PAIA however states that certain private bodies may still be exempted from compiling a PAIA manual for a certain period for security, administrative or financial reasons but any such further exemptions may only be published after 31 December 2021.

The Information Regulator has also recently published a template of a PAIA manual on its website which can be utilised by private companies to compile their manuals. The PAIA manual must also deal with certain provisions of POPIA such as, amongst others, the purpose of processing, the categories of personal information processed, planned transborder flows of personal information as well as a general description allowing a preliminary assessment of information security measures adopted by the private body.

A further important consideration for those private bodies who have already published PAIA manuals is that the fees which may be charged by private bodies for certain requests have been amended and those changes are set out in Annexure B to the Regulations dated 27 August 2021. For example, the initial request fee has increased from R50.00 to R140.00 in respect of private bodies.

In view of the recent amendments, we encourage private bodies to deal with both of the requirements prescribed by PAIA and POPIA as soon as possible. The policies and procedures implemented by employers in respect of POPIA should of course also be mirrored in the employer’s PAIA manual.

Please feel free to contact us for assistance.