What is a PAIA manual?
Is a PAIA manual legally required in South Africa?
“Section 51(1) requires the head of a private body to make a manual available containing, among other things, the postal and street address, phone and fax number and email address of the head (s 51(1)(a)(i)); a description of the guide referred to in section 10 and how to obtain access to it (s 51(1)(b)(i)); the categories of records available without a person having to request access (s 51(1)(b)(ii)); a description of the records available in accordance with any other legislation (s 51(1)(b)(iii)); a description of the subjects on which the body holds records and the categories of records held on each subject (s 51(1)(b)(iv)); and the POPIA personal-information particulars (s 51(1)(c)). Section 51(2) requires the head to update the manual on a regular basis. No private body is exempt since the small-body exemption lapsed on 31 December 2021.”
“The Constitutional Court held that "access to information is fundamental to the realisation of the rights guaranteed in the Bill of Rights", and that the importance of the right of access to information "in a country which is founded on values of accountability, responsiveness and openness, cannot be gainsaid". PAIA is the legislation enacted to give effect to that constitutional right.”
“The Constitutional Court confirmed that PAIA is the national legislation contemplated by section 32(2) of the Constitution and must give effect to the right of access to information held by the state and by another person where that information is required for the exercise or protection of rights, reinforcing that PAIA’s access machinery — including the manual regime — is constitutionally grounded.”
When you need a PAIA Manual
- When you run any company, close corporation, trust, non-profit or body corporate — every existing or former juristic person is a "private body" under PAIA, so since 1 January 2022 you need a section 51 manual regardless of how small you are.
- When you trade as a sole proprietor, partnership or professional practice — a natural person carrying on a trade, business or profession is also a private body, so consultants, freelancers and small firms are now caught too once the small-body exemption lapsed.
- When you process personal information under POPIA — the Information Regulator widened section 51 so the PAIA manual must also describe your data subjects, the categories of personal information, recipients, cross-border transfers and security safeguards, making the manual and your POPIA programme one integrated document.
- When you must submit your annual PAIA report to the Information Regulator (the reporting window runs to 30 June each year) — the Regulator expects a published, current manual to sit behind the report on access requests received, granted and refused.
- When you set up a new business, change information officers, move premises, or materially change the records you keep — section 51(2) requires the manual to be updated on a regular basis, so it is not a once-off task but a living document.
What a PAIA Manual should contain
The head of the private body and information officer details
State who the head of the private body is and give the full contact details — postal and street address, phone, and email — of the information officer (and any deputy) who deals with PAIA requests. Section 51(1)(a)(i) requires the head’s postal and street address, phone and fax number and email address, and they are the single most important practical element: a requester must know exactly who to send a request to and where.
How to use the PAIA Guide and the manual
Include a description of the Guide on how to use PAIA published by the Information Regulator, where to obtain it, and how the manual itself is structured. Section 51(1)(b)(i) requires a reference to the Guide so that a member of the public who has never used PAIA can orient themselves before making a request.
Records available without a formal request
List the categories of records you make available automatically — voluntarily, by publication, or under another law — without a person having to lodge a formal PAIA request. Section 51(1)(b)(ii) requires this so that requesters do not waste a formal application (and a fee) on information you already publish or readily hand over.
Subjects and categories of records held
Give a description of the subjects on which the body holds records and the categories of records held under each subject — for example HR and payroll, customer and supplier records, financial and tax records, contracts, statutory and governance records, and IT logs. Section 51(1)(b)(iv) requires this record schema; it is the heart of the manual and must reflect the records you actually keep, not a generic list.
Records available under other legislation
Describe the records of the body that are available in terms of any other legislation — for instance the Companies Act, the Tax Administration Act, the Labour Relations Act or the Consumer Protection Act. This signposts where a requester’s rights may flow from a different statute rather than from a PAIA request, and is part of the section 51 content set.
The request procedure, forms and fees
Set out how to make a request — the prescribed request form, the request and access fees, the deposit, and the time periods for a decision — and the routes available if access is refused (internal remedies, complaint to the Information Regulator, or court). PAIA prescribes the forms and a fee structure, and a usable manual translates that machinery into plain steps.
Grounds on which access may be refused
Explain the mandatory and discretionary grounds on which a private body may or must refuse access — protection of third-party privacy, commercially sensitive and confidential information, legal privilege, and records that would endanger life or property. PAIA’s Chapter 4 sets these grounds out; flagging them in the manual manages requester expectations and protects third parties.
POPIA personal-information particulars
Since the Information Regulator widened section 51, the manual should set out the categories of data subjects and personal information you process, the recipients to whom it may be supplied, any planned cross-border (transborder) flows, and a general description of your information-security safeguards. This is where the PAIA manual and your POPIA compliance programme converge into a single notice.
PAIA manual (private body) vs public-body manual vs POPIA notice
| Feature | PAIA manual — private body | PAIA manual — public body | POPIA notice (PAIA Form / privacy notice) |
|---|---|---|---|
| Governing section | PAIA section 51 | PAIA section 14 | POPIA (esp. ss 18, 51) and PAIA manual |
| Who must publish it | Every private body — companies, CCs, trusts, partnerships, sole proprietors | The state and organs of state | Every responsible party processing personal information |
| Core purpose | Tell the public what records you hold and how to request access | Same access road-map for state-held information | Tell data subjects how their personal information is processed |
| Languages | At least one official language (practical norm: English) | At least three official languages | No fixed minimum; plain and accessible |
| Exemption history | Small-body exemption lapsed 31 December 2021 — now compulsory | Never exempt | No general exemption from notice duties |
| Regulator | Information Regulator (from 30 June 2021) | Information Regulator (from 30 June 2021) | Information Regulator |
Common South African pitfalls
- Assuming you are still exempt because you are "small": the long-standing exemption for private bodies with fewer than 50 employees lapsed on 31 December 2021. From 1 January 2022 there is no general size exemption — a one-person company, a family trust or a sole trader all need a section 51 manual.
- Treating the manual as a once-off template: section 51(2) requires the head of the body to update the manual on a regular basis. A manual naming a former information officer, an old address, or record categories you no longer keep is non-compliant, and out-of-date contact details defeat the entire purpose.
- Copying a generic manual that does not match your real records: the manual must describe the subjects and categories of records you actually hold. A boilerplate list lifted from another company’s manual fails the section 51 content requirement and is exactly what a requester or the Regulator will test.
- Ignoring the POPIA integration: since the Information Regulator widened section 51, the manual must also cover your processing of personal information — data subjects, recipients, cross-border transfers and security. A PAIA manual drafted to the old SAHRC template, with no POPIA section, is incomplete.
- Publishing the manual but never making it accessible: the manual must be made available on the body’s website (if it has one) and at its principal place of business for public inspection, and a copy must go to the Information Regulator. Drafting it and leaving it in a drawer does not discharge the section 51 duty.
- Forgetting the annual PAIA report: a published manual is the foundation for the annual report on access requests that the Information Regulator expects from heads of private bodies (by 30 June each year). Having no manual makes the report exercise impossible and signals non-compliance.
Frequently asked questions
Does my small business really need a PAIA manual?
Almost certainly yes. The exemption that let private bodies with fewer than 50 employees skip the manual lapsed on 31 December 2021. Since 1 January 2022 every private body — including one-person companies, close corporations, trusts, partnerships and sole proprietors carrying on a trade or profession — must have a section 51 PAIA manual, regardless of size or turnover.
What must a PAIA manual contain under section 51?
It must contain the information officer’s contact details, a reference to the Information Regulator’s PAIA Guide, the categories of records available without a formal request, a description of the subjects and categories of records the body holds, records available under other laws, the request procedure and fees, the grounds for refusing access, and — since the requirements were widened — the POPIA particulars about how you process personal information.
Who enforces PAIA manuals now — the SAHRC or the Information Regulator?
The Information Regulator. On 30 June 2021 the Regulator took over PAIA from the South African Human Rights Commission under sections 110 and 114 of POPIA. The Regulator now publishes the PAIA Guide and manual templates, receives manuals and annual reports, handles complaints, and can act on non-compliance — so the single regulator now oversees both PAIA and POPIA.
What is the difference between a section 14 and a section 51 PAIA manual?
Section 14 applies to public bodies (the state and organs of state); section 51 applies to private bodies (businesses, trusts, NPOs and individuals carrying on a trade or profession). The content overlaps, but the public-body manual must be in at least three official languages, whereas a private body’s manual is, in practice, published in English. Most businesses need a section 51 manual.
Is a PAIA manual the same as a POPIA privacy policy?
No, but they overlap and should be aligned. A PAIA manual is the section 51 access-to-information document about the records you hold and how to request them; a POPIA privacy policy or notice tells data subjects how you process their personal information. Because the Information Regulator widened section 51 to include POPIA particulars, the manual now carries a personal-information section, so the two are usually drafted together.
Where must I publish my PAIA manual?
On your website if you have one, and at your principal place of business for public inspection during ordinary business hours, with a copy submitted to the Information Regulator. The point is accessibility — a requester must be able to find the manual easily so they can work out whether you hold a record they need and how to ask for it.
Can someone use PAIA to demand records from my private company?
Yes, within limits. Under section 50, a requester can demand access to a record held by a private body only if that record is required for the exercise or protection of any right, subject to the grounds of refusal in PAIA (such as third-party privacy, confidential commercial information and legal privilege). Your manual explains the procedure and the limits, but it does not, on its own, force you to hand over protected records.
What happens if I do not have a PAIA manual?
You are in breach of section 51 of PAIA. The Information Regulator can act on the non-compliance, a requester can complain to the Regulator or approach a court, and the absence of a manual undermines your ability to file the annual PAIA report. Beyond the legal exposure, it signals weak information governance — which matters to clients, auditors and regulators alike.
Sources & authority
- Promotion of Access to Information Act 2 of 2000 (PAIA), ss 14, 50 and 51
- Protection of Personal Information Act 4 of 2013 (POPIA), ss 110 and 114
- Brümmer v Minister for Social Development and Others [2009] ZACC 21
- My Vote Counts NPC v Minister of Justice and Correctional Services and Another [2018] ZACC 17
This guide is general information, not legal advice. It reflects the law as at June 2026.