Most organisations associate the Promotion of Access to Information Act (PAIA) with government — the idea that a member of the public can request a record from a state department. Fewer realise that PAIA applies just as directly to private companies, and that it carries an obligation almost nobody has actually implemented: the Section 51 manual.
What the manual actually is
Section 51 of PAIA requires every private body — which includes companies, close corporations, trusts, and partnerships, regardless of size — to compile and make available a manual describing how someone can request access to the records it holds. It isn't a policy about your internal data handling; it's a practical guide for an outside requester, covering things like what categories of records you hold, who the Information Officer is, and the process and fees for lodging a request.
The exemption that used to apply no longer does
For a number of years, organisations below a certain size were exempt from the Section 51 obligation. That exemption lapsed on 1 January 2022 and has not been reinstated. In practice, this means the manual obligation now applies uniformly — a five-person consultancy and a listed company carry the same legal requirement, even though what goes into the manual will look very different in scale.
What belongs in it
At minimum, a compliant manual sets out:
- The organisation's contact details and the Information Officer's details
- A description of the categories of records the organisation holds (client records, financial records, HR records, and so on)
- How to request access to a record, and the applicable fees
- The grounds on which a request might lawfully be refused
- How a requester can take the matter further if a request is refused or ignored — which, since the oversight function moved from the South African Human Rights Commission, now sits with the Information Regulator
Where it needs to sit
The manual has to be reasonably accessible — in practice, that almost always means published on the organisation's website, alongside a Privacy Policy or Data Protection Policy, not filed away internally where no requester could ever find it. For an example of how one is published, see the PAIA Manual for this website.
The practical starting point
If your organisation doesn't currently have a PAIA manual, or has one that hasn't been reviewed in some time, the fix isn't complicated — it just requires someone to sit down, map out what records the organisation actually holds, confirm who the Information Officer is, and publish the result somewhere a requester can find it. That's a half-day to few-day exercise for most mid-market organisations, not a major project.
Related reading: