It has sneaked up on us, but it looks like the long-delayed PAIA manuals must finally be compiled.

POPIA is also clamouring to be included in the manuals.

End of Exemption from Compiling a PAIA Manual

The Promotion of Access to Information Act No. 2 of 2000, better known as PAIA, commenced in March 2001. The Act regulates access to records held by both public and private bodies.

Amongst other provisions, the Act requires public and private bodies to compile a manual setting out the records held by that body, how it can be accessed, along with other prescribed information.

Shortly after the commencement of the Act, the Minister exempted various bodies from having to compile manuals for a limited period. In the case of private bodies, the exempted bodies include limited companies that have 50 or more employees or have a turnover exceeding a certain figure (which differs depending on the sector concerned).

The current exemption lapses on 31st December 2020.

While in the past the Minister has on several occasions extended the exemption at the last moment, be aware that as the law stands now, if you operate a regular (Pty) Ltd for example, then you will have to publish a manual before the end of this year.

This also applies to a natural person carrying on a trade, to partnerships and to all other private bodies.

The Effect of POPIA

Assuming that the exemption is not renewed, and you need to undertake the exercise of compiling a manual under PAIA, bear in mind that the Protection of Personal Information Act No. 4 of 2013 (“POPIA”) has amended PAIA and in particular the requirements for the PAIA manual. While POPIA’s transitional period ends on 30 June 2021 and you will only have to comply with those amendments from that date, it would be worthwhile to comply with the new requirements under POPIA if you have to compile your PAIA manual for the first time anyway.

The most important of these changes are as follows:

  • Responsibility for PAIA will be shifted from the South African Human Rights Commission (“SAHRC”) to the Information Regulator which is established in terms of POPIA. Hence manuals will have to be made available to the Regulator and not the SAHRC from the 30th of June 2021.
  • Manuals must now also include a section on personal information, including what personal information the body holds, who it relates to, the purpose for which it is processed, and the security measures taken to ensure that the personal information is not compromised.

The second point in particular is worth noting, as providing this information requires the body concerned to undertake an audit of what personal information it holds and how it processes it. In essence, this is a POPIA gap analysis. As such an exercise is part of any POPIA compliance exercise anyway, we suggest that all businesses make compiling their PAIA manual part of the initial stages of POPIA compliance.

We all have to comply with POPIA – you may as well start now while you are in the process of compiling your PAIA manual.