Plain answers
Do I need a PAIA manual?
Almost certainly yes. Here is the short version, what it actually requires of you, and how to tell whether the one you have is worth anything.
The short answer
If your business is a legal entity operating in South Africa, it is a "private body" under PAIA, and section 51 requires it to have a manual. There is no turnover threshold. There is no exemption for having few employees. The exemption that used to cover small businesses lapsed on 31 December 2021.
What a PAIA manual is for
The Promotion of Access to Information Act gives people a route to request records — including records held by private companies, not only government. The manual is the map: it tells someone what kinds of records you keep, who to ask, how to ask, what it costs, and when you may say no.
It is not a document you write once for a filing cabinet. Section 51(3) expects it to be available — on your website, at your premises, and to the Regulator on request.
Who carries the risk
This is the part that surprises people. Under POPIA the head of a private body is automatically its Information Officer. If you own or run the business, that is you. You were not appointed, you cannot decline, and the duty does not move to your accountant or your web developer because they handle the paperwork.
The Regulator can impose administrative fines up to R10 million. Failing to comply with an enforcement notice is an offence that carries a fine of up to R2 million or imprisonment of up to two years — and that liability attaches to the Information Officer as a person, not only to the company.
How to tell whether yours is any good
Most businesses that have a manual downloaded it. Open yours and check these five things — it takes about two minutes.
- Does it name a person? A manual with "[Insert name]" or a job title instead of a named Information Officer is not a manual. It is a form somebody stopped filling in.
- Does it describe your records, or generic ones? If the categories could describe any business in the country, it does not describe yours, and it does not do the job section 51 asks of it.
- Is the Regulator's address current? They have moved since POPIA commenced. A manual still pointing at the old Braamfontein address tells a reader exactly how long it has been since anyone looked at it.
- Can the public actually reach it? A manual sitting on a laptop is not available. It needs to be reachable — a link on your website is the ordinary way to do that.
- Does it agree with your website? If your policy says tracking only runs with consent, and your site loads Google Analytics before anyone clicks anything, the document is now evidence against you rather than for you.
What else POPIA expects
The manual is one obligation among several. The others that catch small businesses most often:
- Register your Information Officer — with the Information Regulator, through their eServices portal. It is free.
- Have a privacy policy that matches reality — stating purpose and retention per category, not in general terms.
- Get consent before tracking — and be able to show what was consented to, by whom, and when.
- Have written contracts with your operators — anyone processing personal information on your behalf, which section 21 requires in writing.
- Do not send unsolicited marketing email — section 69 prohibits it without consent or an existing customer relationship. This one is widely ignored and increasingly enforced.
Do you need us to fix it?
Not necessarily. If you have the time and the patience, the Acts are public and the Regulator publishes guidance. Plenty of businesses put together a workable manual themselves.
What most cannot easily do alone is the second half — keeping the documents current as the business changes, holding tracking scripts until a visitor agrees, and keeping a consent record that still means something when somebody disputes it a year later. That is the part we built.
If it turns out you do not need this, we will tell you so. That has cost us a sale before and it will again.
This page is general information about published legislation, not legal advice, and Terroirsbookings is not a law firm. For an opinion on your particular circumstances, speak to an attorney who does POPIA work.
Founding client pricing
Send your existing manual — or tell us you have not got one. You will get a written list of what is missing, and nothing else unless you ask for it.