The Promotion of Access to Information Act imposes mandatory obligations on all private bodies with 50 or more employees. Many businesses remain unaware of these obligations and face significant exposure. Here is what you must do.
What is PAIA?
The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information held by the State and by private bodies. It creates a framework for requests for information, prescribes the grounds on which such requests may be refused, and imposes mandatory compliance obligations on both public and private bodies. Despite being in force for over two decades, PAIA compliance among private bodies remains inconsistently observed.
Who Must Comply?
Every private body — defined broadly to include companies, close corporations, trusts and other juristic persons — that employs 50 or more employees must compile a PAIA Manual and make it available to the public. However, all private bodies regardless of size are obligated to respond to valid PAIA requests for information that is required for the protection of any right. This means even small businesses can receive and must respond to PAIA requests.
The PAIA Manual: Mandatory Content
A PAIA Manual must contain: the contact details of the Information Officer (who for private bodies is the CEO or equivalent); a description of the records held by the organisation; a description of the subjects on which the organisation holds records; the procedure for requesting access to records; and the fees payable. The manual must be submitted to the South African Human Rights Commission (SAHRC) and made available to the public, either on the organisation's website or at its principal place of business.
Responding to PAIA Requests
Upon receipt of a valid PAIA request, a private body must respond within 30 days (extendable in defined circumstances to 60 days). The grounds for refusing access are prescribed exhaustively by the Act and include: protection of commercial information, protection of confidential information received in confidence from a third party, protection of the safety of individuals, legal privilege, and protection of personal information of a third party. Refusal on grounds not listed in the Act is unlawful.
Consequences of Non-Compliance
Failure to compile and submit a PAIA Manual is an offence attracting criminal sanctions. The SAHRC has increased its enforcement activities, and non-compliant organisations face reputational damage in addition to legal exposure. Courts have also ordered organisations to pay costs where PAIA requests were refused without adequate justification.
How Mashiane Attorneys Can Assist
We provide a complete PAIA compliance service: Information Officer designation and SAHRC registration; PAIA Manual compilation and submission; request response protocols and training; and appeal handling. Contact us at hello@mashiane.law for a PAIA compliance assessment.