Legalese has launched a COVID-19 specific page for legal resources and assistance during this unprecedented time. CLICK HERE

Back to Home

PAIA Compliance: What you need to know!


In this blog we’ll be tackling the basics of PAIA – The Promotion of Access to Information Act. Although we’ve all had POPI on our minds these last few months, please don’t get them confused. POPI is the Protection of Personal Information Act and whilst they’re related, POPI and PAIA cover different areas of law.

Background to PAIA

PAIA was enacted to give effect to section 34 of the Constitution, which is the right of access to information. PAIA recognises that the Apartheid regime resulted in a secretive culture in public and private bodies which often led to an abuse of power and human rights violations. PAIA aims, by giving effect to the Constitutional right of access to information, to move towards a culture of transparency and accountability

Access to information and overall transparency is also relevant in our current culture where people are alive to the value and importance of information and demand more transparency in government and in business.

Following the structure of the Constitution, PAIA differentiates between public and private bodies. When applying for access to information, the right of access to records of public bodies is unconditional however the right of access to records of private bodies only arises if the records are necessary for the exercise or protection of any right or rights.

For our purposes, we are going to focus on private bodies and the aspects related thereto.

Section 50 of PAIA – Access to Information of Private Bodies

Under PAIA, “Private body” is defined to exclude a public body and to mean (i) a natural person who carries on or has carried on any trade, business, or profession, but only in such capacity; (ii) a partnership which carries or has carried on any trade, business, or profession; or (iii) any former or existing juristic person.

A request for access to information under section 50 of PAIA involves 3 aspects:

  1. exercise or protection of any rights;
  2. complies with the procedural requirements in the PAIA;
  3. access to that record is not refused in terms of any ground for refusal.

Exercise or Protection of any right

A requester must only be given access to a record if that record is needed for the exercise or protection of any rights. But what does this mean? Unfortunately, there is no definitive answer on what this means.

The Constitutional Court has said that “required” does not denote absolute necessity. It means “reasonably required”. The person seeking access to the information must establish a substantial advantage or element of need. The standard is accommodating, flexible and in its application fact-bound.’

Although this is a very legal and opened response as to what the term means, we do know what it doesn’t mean.

First, it’s not a phishing expedition. A PAIA application is not an opportunity for a competitor to go deep diving into your records or information.

Secondly, it’s not an opportunity for revenge. The exercise of any right does not include the right to exact ultimate revenge on a company by bombarding them with PAIA requests and hoping to find information to hold against them.

Thirdly, the exercise of any right does not include mere curiosity. Knowledge is power but not in every circumstance.

Complies with Procedural Requirements

A request must be made on a form that corresponds substantially to that of Form 2 of the Regulations. This means that either the exact Form 2 attached to the regulations must be used or an application must contain the same information as that of Form 2.

PAIA applications are not free!

A PAIA application to a public body will cost R100 per application. Whilst an application to a private body will cost R140 per application.

Not Refused

A private body has the right to refuse a PAIA request based on one of the grounds of refusal in PAIA. There are 6 mandatory grounds for refusal and one optional ground.

There is also what’s known as a “deemed refusal”. Under section 58 of PAIA, if the head of a private body fails to give the decision on a request for access to the requester concerned within 30 days’ the head of the private body is regarded as having refused the request.

What happens if a request is refused?

The requester has the right to complain to the Information Regulator. The Information Regulator may investigate the complaint or assist in resolving the issue amicably between the parties or make a decision on the compliant in favour of either party.

Updates to PAIA and its Regulations

PAIA was amended by The Protection of Personal Information Act (“POPI”) to include, amongst other things, the powers and functions of the Information Regulator.

Who is the Information Regulator?

The Information Regulator is the body tasked with monitoring and enforcing compliance with POPI as well as PAIA.

PAIA Regulations

On 27 August 2021, new regulations were published for PAIA. These new regulations repeal and replace the previous regulations that were issued and include a few updates that are relevant to private bodies.

What’s new?

  • The Information Regulator must publish a PAIA guide and both the Information Regulator and the head of a private body must make it available for the public.
  • Private bodies can voluntarily disclose certain records and make them automatically available.
  • Bodies must inform requesters of a decision and if applicable, the fees regarding a request.
  • Various forms for requesting, informing of the outcome of request
  • Fees for requests
  • Dispute resolution

Compliance – What is required of Private Bodies?

The head of a private body MUST make a PAIA MANUAL available –

  • on its Website (if it has one)
  • at its business premises
  • to any one who requests a copy (if they pay a reasonable amount)
  • to the Information Regulator when they request

Who is the head of a Private Body?

In the case of a company, it’s the CEO or someone authorised by them.

What is a PAIA Manual?

Section 51 of PAIA states that the head of a private body must compile a manual.

What’s in a PAIA manual?

  • Company Information and contact information
  • Information on the PAIA Guide
  • A description of any records which are freely available
  • Information on processing personal information
  • Availability of the PAIA Manual

Exemption for Private Bodies to Compile a Manual

Private bodies have since the enactment of PAIA been exempt from compiling a PAIA Manual…

BUT, that’s all changed…

In terms of a Government Gazette published on 30 June 2021, the exemption for private bodies is coming to an end on 31 December 2021.

As of 01 January 2022, ALL private bodies MUST have a PAIA Manual published on their website and available at their offices.

What Happens if You Don’t Comply?

A person who, with intent to deny a right of access in terms of this Act,-
(a) destroys, damages or alters a record;
(b) conceals a record; or
(c) falsifies a record or makes a false record
A fine or imprisonment for a period not exceeding two years
The head of a private body who, wilfully or in a grossly negligent manner, fails to comply with the provisions of section 51 of PAIAA fine, or imprisonment for a period not exceeding two years
Non-compliance with an Enforcement NoticeA fine or imprisonment for a period not exceeding three years or to both such a fine and such imprisonment


PAIA compliance is not as daunting it seems. Although this has seemed like a magnitude of information there are a handful of matters we can assist with to get you compliant.

Lauren van der Byl

Have any questions? Drop us a message below and we’ll be in touch!

Contact Us

190A Buitengracht St
Bo Kaap
Cape Town
Contact us
close slider