Do I need a PAIA manual for my business?

Yes. Every private body in South Africa must compile a manual under the Promotion of Access to Information Act 2 of 2000 (PAIA), make it available to anyone who asks for it, and publish it on its website if it has one. A private body includes a company, a close corporation, a partnership, a trust and a sole proprietor who carries on a trade or profession. There is no floor based on turnover or staff numbers written into the duty itself.

You may have read that small businesses are exempt. Be careful with that. Exemptions from the manual requirement have been granted and extended by notice from time to time, and their status changes. A notice that was in force two years ago may have lapsed, been narrowed or been replaced. The safe approach for a small business is to check the current position on the Information Regulator's website before deciding you are excused, and to compile the manual anyway because the exercise costs you an afternoon and produces a document you can hand to anyone who asks.

This guide explains what a PAIA manual actually is, what goes into it, and how to produce one without paying a drafting fee.

What a PAIA manual is for

PAIA gives effect to the constitutional right of access to information. It covers two kinds of body. Public bodies are government departments and organs of state. Private bodies are everyone else, including your business. A person may ask a private body for a record it holds if that record is required for the exercise or protection of any right.

The manual is the map. It tells a member of the public who you are, who to contact, what categories of records you keep, which of those records are already freely available, and how to lodge a request. Without it, a person who needs a copy of something you hold has no idea where to start.

The manual is not a privacy notice and it is not a POPIA compliance document, although the two sit side by side. Your privacy notice under the Protection of Personal Information Act 4 of 2013 (POPIA) tells people what you do with their information. Your PAIA manual tells them how to ask you for records. The same Information Regulator enforces both Acts, and the same person in your business, the Information Officer, handles both. If you have not yet dealt with that appointment, read how to register an Information Officer with the Information Regulator.

What must go in the manual

Work through these headings. The Regulator's free template follows the same order.

1. Who you are. Registered name, trading name, registration number if you have one, physical address, postal address, phone number, email address and website.
2. Your Information Officer. Name, position and contact details. In a small business this is the head of the business, unless you have formally designated a deputy.
3. A note on the PAIA guide. The Regulator publishes a guide for the public on how to use PAIA. Your manual should say that the guide exists and where to get it.
4. Records held by category. Group them by subject: company and statutory records, financial and tax records, employee records, customer and supplier records, contracts, insurance, marketing, and information technology records. You do not list individual documents. You list the buckets.
5. Records available without a formal request. Anything you are happy to hand over on the spot, such as a product brochure or a standard price list, goes here.
6. Records available in terms of other legislation. A short list is enough: records kept under the Companies Act 71 of 2008, tax records kept for the South African Revenue Service, employment records kept under labour law.
7. How to make a request. The prescribed form, where to send it, the fees payable, and how long you will take to respond.
8. Grounds for refusing a request. PAIA sets out the grounds, which include protecting someone else's privacy, commercially sensitive information and legally privileged material. Summarise them and say a requester will be told the reason in writing.
9. Remedies. Say that a requester who is unhappy with your decision may complain to the Information Regulator or approach a court.
10. How you handle personal information. Many templates now include a short POPIA section describing the purposes for which you process personal information and the categories of people affected.
11. Availability and updates. State where the manual is available and that you will review it periodically.

Illustrative example: a plumbing business with three vans

The example is illustrative only.

Mzansi Plumbing Works is a private company with an owner, an office administrator and four plumbers. It has a simple website with a contact form. It keeps job cards, quotes, invoices, staff files, payroll records, vehicle records and a supplier list.

The owner opens the Regulator's template, fills in the company details, names herself as Information Officer, and lists seven record categories: statutory and company records, financial records, tax records, employee and payroll records, customer job records, supplier and subcontractor records, and vehicle and insurance records. She notes that quotes and standard rate sheets are available on request without a formal application. She copies the request procedure and the grounds of refusal straight from the template. She saves the document as a PDF, puts it on a page of the website called "PAIA manual", and saves a printed copy in the office file.

That is the whole job. It took an afternoon. When a former subcontractor later asks for a copy of a signed job sheet to support a payment claim, she has a process to follow instead of a panic.

What to do this week

1. Check the current exemption position on the Information Regulator's website. Do not rely on a blog post or an old article.
2. Download the free template the Regulator publishes.
3. List your record categories. Walk through your filing cabinet, your accounting software and your cloud storage and write down the buckets.
4. Fill in the contact and Information Officer details. Use an email address you actually monitor.
5. Decide what is freely available and say so, because it reduces formal requests.
6. Publish it. If you have a website, put the manual on it as a downloadable file and link to it from the footer.
7. Keep a copy at your business address so you can hand it over if someone asks in person.
8. Diarise a yearly review and update it whenever your address, Information Officer or record categories change.

Documents and records to set up

• The PAIA manual itself, in an editable file and a published PDF.
• A record of where it is published, including the website URL and the office location of the printed copy.
• A request register listing each PAIA request received, the date, what was asked for, your decision and the date you responded.
• The prescribed request form kept on file so you can send it to a requester.
• A fee note setting out what you charge for copies, based on the prescribed fees rather than a figure you invent.
• Your Information Officer registration confirmation, filed with the manual.
• Your information inventory from your POPIA work, which feeds directly into the record categories.

Realistic timeline

• Day one: check the exemption position, download the template and list your record categories.
• Day two: complete the template, proofread it and convert it to PDF.
• Week one: publish it on your website and file the printed copy.
• Within a month: brief whoever answers your phone and email so they recognise a PAIA request and pass it to the Information Officer.
• Annually: review and update.

If you have a complicated group structure, several trading names or records held offshore, allow a few weeks and consider getting the manual checked.

Common mistakes and what they cost

• Assuming you are exempt. Exemptions have come and gone by notice. If yours has lapsed and you have no manual, you have a straightforward contravention that is easy for the Regulator to confirm.
• Drafting it and never publishing it. If you have a website, the manual belongs on it. A manual in a folder is not available.
• Copying another business's manual without changing it. Wrong contact details and record categories that do not match your business make the document useless and embarrassing.
• Naming an Information Officer who has left. Requests go to a dead mailbox and you miss the response deadline.
• Ignoring a request because it looks like a nuisance. PAIA requires a written decision with reasons. Silence is itself a refusal you cannot justify, and it invites a complaint to the Regulator.
• Paying a consultant several thousand rand for a template job. A quote of R5 000 for a document the Regulator gives away free is worth questioning. Compare what compliance actually costs in what small business and POPIA compliance costs.

If you cannot afford an attorney

You almost certainly do not need one for a manual. The Information Regulator publishes free guidance, a free PAIA manual template and the free Information Officer registration portal. The Companies and Intellectual Property Commission's own portal gives you the company details you need for the front page. The Small Enterprise Development Agency offers free and subsidised business support that covers compliance basics. University law clinics in most major centres help small businesses at low or no cost. If your question is really about a customer who will not pay rather than about records, read how to recover a debt from a customer who will not pay. For individuals with legal problems, Legal Aid South Africa is the starting point.

Frequently asked questions

Does a sole proprietor need a manual? A sole proprietor carrying on a trade is a private body, so the duty applies. Check the current exemption notices, and compile the manual anyway because it is short and free.

Do I need a website to publish it? No. If you do not have a website, you must still compile the manual and make it available at your business address on request.

Can I charge for copies? Fees for requests and copies are prescribed and change, so quote the prescribed fee rather than inventing an amount.

Must the manual be in more than one language? The Act contemplates availability in the official languages the Regulator prescribes. A small business usually publishes in English, and should be able to explain the process to a requester in a language they understand.

Does the manual replace my privacy notice? No. The manual is about access to records. Your privacy notice under POPIA is a separate document. Start from the POPIA privacy notice template.