Frequently Asked Questions

PAIA and POPIA are key compliance requirements for South African businesses. Below are answers to the most common questions to help you understand your obligations.

What is PAIA?

PAIA (Promotion of Access to Information Act) is a South African law that gives people the right to access information held by government bodies and private organisations, while protecting certain confidential information.

Who must comply with PAIA?

All public and private organisations in South Africa must comply if they hold information about individuals or organisations. This includes companies, sole proprietors, NGOs and government departments.

Why is PAIA compliance important?

PAIA ensures that people can access information they are legally entitled to and promotes transparency, accountability and responsible governance.

What is a PAIA Manual?

A PAIA Manual explains how your organisation handles information requests, including who to contact, what records are held and how requests are processed.

Do all businesses need a PAIA Manual?

Yes. Almost all South African organisations are required to have a PAIA Manual. Only limited exemptions apply and these may change.

How can my business become PAIA compliant?

We assist businesses with creating a PAIA Manual, submitting the PAIA Annual Report and implementing the correct procedures for handling information requests.

Do I need an Information Officer?

Yes. Every organisation must appoint an Information Officer who oversees PAIA and POPIA compliance, manages requests and handles reporting to the Information Regulator.

What information must be included in a PAIA Manual?

• Organisation contact details
• Information Officer details
• Categories of records held
• PAIA request procedures
• Applicable fees
• POPIA-related information

What is a PAIA Annual Report?

The PAIA Annual Report records how many information requests your organisation received and how they were handled. It must be submitted to the Information Regulator.

What happens if my business does not comply with PAIA?

Non-compliance may result in fines, legal consequences and reputational damage, as well as loss of trust with clients and stakeholders.

What information can be accessed through PAIA?

Information needed to exercise or protect a right may be requested, subject to exclusions for confidential, private or security-sensitive records.

How long do we have to respond to a PAIA request?

You must respond within 30 days. Extensions may apply in certain circumstances.

How do I submit a PAIA request?

Requests must be submitted in writing, electronically or on paper, to the organisation’s Information Officer and must clearly describe the information requested.

What information cannot be accessed?

• Privileged or confidential information
• National security information
• Personal information that violates privacy

Where must my PAIA Manual be published?

Your PAIA Manual must be available at your registered office and published on your website.

Does PAIA apply to electronic information?

Yes. PAIA applies to all formats, including emails, digital files, databases and paper records.

Are there fees for PAIA requests?

Yes. A request fee and access fee may apply depending on the information requested.

Can a PAIA request be refused?

Yes. Requests may be refused if they do not meet legal requirements or involve restricted information.

Can someone appeal a PAIA decision?

Yes. A requester may submit an internal appeal or lodge a complaint with the Information Regulator.

What is POPIA?

POPIA (Protection of Personal Information Act) is South Africa’s data protection law that regulates how personal information is collected, used, stored and shared.

Who must comply with POPIA?

Any organisation that processes personal information must comply, including businesses of all sizes, NGOs and government bodies.

What does POPIA compliance involve?

Compliance includes proper policies, secure systems, an appointed Information Officer and respect for data subject rights.

What are the penalties for non-compliance?

Penalties may include fines of up to R10 million, possible imprisonment, civil claims and reputational damage.

What is a POPIA compliance certificate?

A POPIA compliance certificate confirms that your business meets the requirements for handling personal information responsibly.

How do I get a POPIA compliance certificate?

We assess your data protection practices, identify gaps and assist you in achieving compliance.

What rights do individuals have under POPIA?

• Access to their personal information
• Correction of inaccurate information
• Objection to certain processing
• Deletion when information is no longer required

What is personal information?

Personal information includes names, contact details, ID numbers, financial data, biometric data and online identifiers.

What is a data breach?

A data breach occurs when personal information is lost, stolen or accessed without authorisation.

What must we do in the event of a data breach?

The organisation must notify affected individuals and the Information Regulator as soon as reasonably possible.

Are you PAIA and POPIA compliant?

PAIA gives people access to information. POPIA protects personal data. Non-compliance can result in fines, penalties and reputational damage. We make compliance simple so you can focus on growing your business.