This guide explains exactly what a PAIA manual is, who needs one, what it must contain, and what happens if you do not have one. By the end, you will have a clear picture of your obligations under South African law and the straightforward steps you can take to become compliant.
What is PAIA?
PAIA stands for the Promotion of Access to Information Act 2 of 2000. It is a piece of South African legislation that gives effect to section 32 of the Constitution, which guarantees every person the right of access to information. The Act applies to both public bodies (government departments, municipalities, state-owned entities) and private bodies (companies, trusts, partnerships, non-profit organisations, sole proprietors).
The purpose of PAIA is twofold: to foster a culture of transparency and accountability, and to ensure that people can access information needed to exercise or protect their legal rights. Put simply, PAIA creates a framework under which any person can formally request access to records held by another entity — and that entity is legally required to respond.
What is a PAIA Manual?
A PAIA manual is a document that every private body in South Africa is required to compile and maintain in terms of Section 51 of the Act. It is sometimes called a Section 51 manual or an information manual. The manual serves as a public-facing guide that tells the world: who you are, what records you hold, and how someone can request access to those records.
Think of it as your business's transparency declaration. It answers questions like:
• Who is the person responsible for handling information requests at your organisation?
• What categories of records does your business hold?
• What is the procedure for submitting a formal request to access those records?
• What fees apply to such requests?
• On what grounds can a request be refused?
The manual must be made available to the public — typically on your website or in printed form at your offices. It is not simply an internal compliance document; it is a publication.
Who Needs a PAIA Manual?
Until recently, many small businesses were exempt from the requirement to compile a PAIA manual. Those exemptions have now ended. Following amendments to the PAIA Regulations, all private bodies in South Africa — regardless of size, industry, or annual turnover — are required to have a PAIA manual.
This means the following entities must have a compliant manual:
• Private companies (Pty Ltd)
• Public companies (Ltd)
• Close corporations (CC)
• Trusts
• Partnerships
• Sole proprietors (freelancers, independent contractors, consultants)
• Non-profit organisations (NPOs) and non-profit companies (NPCs)
• Section 21 companies
In short: if you conduct any form of business activity in South Africa and hold any records — which every business does — you need a PAIA manual.
What Must a PAIA Manual Include?
Section 51(1) of PAIA sets out the minimum content requirements. A compliant manual must include the following:
1. Contact Details of the Information Officer
Every private body automatically has an Information Officer. This is the CEO, managing director, or equivalent head of the organisation. The manual must include the full name, postal address, physical address, email address, and telephone number of the Information Officer.
2. Description of the Records Held
The manual must describe the categories of records that the organisation holds. This does not mean listing every individual document, but rather describing the types of records — for example, employee records, financial records, client contracts, marketing data, supplier agreements, and so on.
3. Description of Automatically Available Records
Some records must be made available to the public without a formal PAIA request. The manual must identify these records and explain where and how the public can access them.
4. Request Procedure and Forms
The manual must explain the procedure for submitting a formal PAIA request, including the prescribed form (Form C), where to submit it, and how the organisation will process it.
5. Access Fees
The manual must detail the fees payable when submitting and processing a PAIA request. These fees are set by regulation and include a request fee and reproduction fees depending on the format of the records provided.
6. Grounds for Refusal
PAIA sets out specific grounds on which a request for access to records may be refused — for example, where disclosure would prejudice commercial interests, violate personal privacy, or jeopardise legal proceedings. The manual must reference the relevant sections of PAIA that apply to your organisation.
7. Reference to the South African Human Rights Commission (SAHRC) Guide
The manual must refer requesters to the guide published by the South African Human Rights Commission (SAHRC) on how to use PAIA. This guide is available on the SAHRC website.
8. Remedies Available to a Requester
The manual must describe the internal and external remedies available to a requester if their request is refused — including internal appeal procedures and the right to approach a court.
PAIA and POPIA: How They Work Together
PAIA and POPIA (the Protection of Personal Information Act 4 of 2013) are closely linked and both fall under the jurisdiction of the Information Regulator. While PAIA gives people the right to access information, POPIA protects personal information from being processed or disclosed unlawfully.
Since POPIA came into full effect in July 2021, many organisations now combine their obligations into a single PAIA and POPIA manual. This approach is permitted and is increasingly the norm. A combined manual addresses both the information access requirements of PAIA and the data processing obligations of POPIA in one cohesive document.
What is the Information Regulator?
The Information Regulator is an independent body established under POPIA to oversee both PAIA and POPIA. It has the power to investigate complaints, conduct audits, issue enforcement notices, and impose administrative fines of up to R10 million for serious contraventions. The Regulator is actively enforcing both pieces of legislation, with several high-profile fines already issued against public and private bodies.
What Happens If You Do Not Have a PAIA Manual?
Failing to compile and publish a PAIA manual is a criminal offence. Under PAIA, an Information Officer who fails to comply with the requirements of the Act can face:
• A fine of up to R2 million
• Imprisonment for a period not exceeding two years
• Or both a fine and imprisonment
Beyond the criminal penalties under PAIA, the Information Regulator can issue compliance notices, enforcement notices, and administrative fines under POPIA for related data governance failures. Given the increasing enforcement activity from the Regulator in 2025 and 2026, the risk of non-compliance is real and growing.
There is also a reputational dimension. If a customer, employee, or business partner submits a PAIA request to your organisation and discovers you have no manual or no process in place, this can damage trust and expose you to formal complaints.
How to Respond to a PAIA Request Once Your Manual is in Place
Once your manual is published, any person can submit a formal PAIA request using the prescribed Form C. Once received, your Information Officer has 30 days to respond. Ignoring or failing to respond within 30 days is itself a contravention of the Act and is deemed a refusal, which the requester can then appeal or take to court.
Your response must either grant access to the records, refuse access on grounds specified in PAIA, or request an extension of time in exceptional circumstances.
How Often Should You Update Your PAIA Manual?
There is no specific legal provision prescribing how often a PAIA manual must be updated, but best practice is to review it at least once a year, or whenever there is a material change in your organisation — such as a change of Information Officer, a change in the categories of records you hold, new business activities, or changes to the PAIA Regulations.
Keeping your manual current is important because an outdated manual with incorrect contact details or an inaccurate description of your records can render it non-compliant.
Conclusion
A PAIA manual is not optional, and it is not only for large corporations. Every business operating in South Africa — from a one-person consultancy to a national retailer — is legally required to have one. The manual is your organisation's public commitment to transparency: it tells the world who holds your information, what you hold, and how it can be accessed.
Given the enforcement activity from the Information Regulator and the criminal penalties available under PAIA, getting compliant is not something to defer. The good news is that getting a professional PAIA manual drafted is straightforward and affordable.
Need a PAIA Manual for Your Business?
Access to Info specialises in generating fully compliant, professionally drafted PAIA manuals for South African businesses of all sizes. Our manuals meet all Section 51 requirements and are ready for immediate use.
Visit www.accesstoinfo.co.za to get your PAIA manual today.