PAIA Manual Requirements: What Every South African Business Needs (2026)

What is a PAIA Manual?

A PAIA manual is a document required by section 51 of the Promotion of Access to Information Act, 2000 (PAIA). It tells the public what types of records your business holds and how someone can request access to them. PAIA gives effect to the constitutional right of access to information - and your manual is the roadmap that makes that right usable.

If POPIA governs how you protect personal information, PAIA governs how people can request access to information you hold. The two Acts work together, and both are enforced by the same body: the Information Regulator.

Who Needs a PAIA Manual? (Almost Certainly You)

Every private body must compile a PAIA manual. Under PAIA, a private body includes:

• Companies and close corporations, of any size
• Partnerships and trusts that carry on a business
• Sole proprietors - a natural person carrying on a trade, business, or profession

There is a persistent myth that small businesses are exempt. That was once partly true: for years, most private companies below certain employee and turnover thresholds enjoyed a blanket exemption. That exemption expired on 31 December 2021. Since 1 January 2022, the Information Regulator's position is that every private body needs a section 51 manual - from a one-person consultancy to a listed company.

What Must Be in a PAIA Manual?

Section 51, read with the PAIA Regulations of 2021 and the Information Regulator's published template, requires your manual to include:

• Contact details - the head of the body or your Information Officer, with a postal and physical address, phone, and email
• A reference to the section 10 Guide - the Regulator's plain-language guide on how to use PAIA, and where to get it
• Records available in terms of other legislation - for example, records you keep under the Companies Act, Income Tax Act, or employment laws
• Categories of records you hold - customer records, financial records, personnel records, operational records, and which of these are automatically available versus available only on request
• The request procedure - how to use the prescribed request form (Form 2), the fees involved, and the 30-day decision timeframe
• POPIA processing information - the Regulator's template folds in a description of the purpose of your processing, the categories of data subjects and personal information, recipients, planned cross-border flows, and your security measures

Where Must the Manual Be Available?

You no longer need to lodge your manual with anyone or pay a lodging fee. You must, however, make it available:

• On your website, if you have one
• At your principal place of business, for inspection during business hours
• On request, from your Information Officer

The most practical approach for a website owner: publish it as a page or downloadable document alongside your privacy policy.

What Happens If You Don't Have One?

Not having a manual puts you on the wrong side of a statutory obligation the Information Regulator actively enforces. In practice, the risks look like this:

• The Regulator can receive complaints about your non-compliance and take enforcement action
• If anyone ever makes a PAIA request against your business - a customer, an ex-employee, an opposing party in a dispute - the absence of a manual immediately undermines your handling of it
• It signals broader non-compliance: the manual is one of the first things checked in any POPIA/PAIA assessment, alongside your Information Officer designation

The POPIA Connection

Your PAIA manual and your POPIA compliance are intertwined. The same Information Officer is responsible for both. The Regulator's manual template requires your POPIA processing information inside the manual. And a data subject requesting their own personal information doesn't even pay the PAIA request fee. If you're working through a POPIA compliance checklist, the PAIA manual belongs on it.

How to Create Your PAIA Manual

You have three options:

• A lawyer - thorough, but expect to pay several thousand rand for what is largely a structured template
• DIY from the Regulator's template - free, but you'll need to work through the legislation to fill it in correctly
• Generate it - POPIA Ready creates a complete section 51 PAIA manual customised to your business as one of its 7 documents, alongside your privacy policy and other website legal documents. It's included in the R499 bundle, and the record categories and POPIA processing information are derived automatically from what you tell us about your business

Whichever route you choose: keep the manual updated. When your contact details, record categories, or processing activities change, the manual must change with them.