PAIA, from the manual to the request that has a deadline
PAIA is the other half of the information officer's job, and the half most organisations under-resource. It requires a published manual, a route for requests, decisions made on stated grounds within statutory periods, and an annual return to the Information Regulator. Dimeri tracks all of it.
What PAIA requires
The Promotion of Access to Information Act 2 of 2000 gives effect to the constitutional right of access to information held by the state, and to information held by another person where it is required for the exercise or protection of any rights. It applies to public bodies and to private bodies, which includes most companies, and it is enforced by the Information Regulator, which took over the function from the South African Human Rights Commission.
Three obligations do most of the work. Every body must compile and make available a manual: section 14 for public bodies and section 51 for private bodies, setting out what the body does, what records it holds, how to request access and how to contact the information officer. Every body must handle requests for access according to the Act, which means acknowledging them, deciding within the statutory period, and where access is refused, giving adequate reasons and identifying the provision relied on. And bodies must report annually to the Information Regulator on the requests received and how they were dealt with.
The practical difficulty is that PAIA requests arrive infrequently and unpredictably, usually to a general address, and then run on a statutory clock that does not care how busy the organisation is. A request that sits unrecognised for three weeks has already consumed most of the period available to decide it. Deemed refusal follows from inaction, and that is an appealable outcome the organisation did not choose.
The obligations Dimeri tracks
PAIA is a small number of obligations with hard dates attached. Dimeri holds the dates, the owners and the reasoning behind each decision.
The PAIA manual
A manual compiled, updated and made available, setting out the body's structure, the records it holds, the request procedure and the information officer's contact details.
- Manual held with its version and review date
- Record categories maintained as the body changes
- Publication and availability evidenced
- Review cycle with a named owner
Information officer and deputies
An information officer with statutory duties under both PAIA and POPIA, supported by deputy information officers where the body needs them.
- Role holders recorded with delegations
- Deputy designations held with their scope
- Registration status tracked
- Handover recorded when a role holder changes
Request intake and acknowledgement
Requests received in the prescribed form, recognised as PAIA requests, logged and acknowledged so the statutory period is being managed from day one.
- Single intake point with automatic logging
- Request classified as public or private body route
- Fees recorded where applicable
- Acknowledgement evidenced with its date
Decision within the statutory period
A decision taken and communicated within the period the Act allows, including where an extension is permitted and the requester is notified of it.
- Deadline calculated and counted down
- Extension recorded with its ground and notification
- Escalation before the deadline rather than after
- Deemed refusal exposure flagged early
Grounds for refusal
Where access is refused, the ground relied on must be identified and adequate reasons given, including mandatory protection of third party information and the public interest override.
- Refusal ground recorded against the specific section
- Third party notification and representations tracked
- Public interest consideration documented
- Internal appeal or complaint status followed
Annual reporting
Annual reporting to the Information Regulator on requests received, granted, refused and the grounds relied on.
- Return compiled from the live request register
- Statistics reconcile to the underlying records
- Submission evidenced with its date
- Trends reviewed for recurring request types
How Dimeri covers PAIA
PAIA and POPIA share an information officer, a set of records and most of their documentation. Dimeri treats them as one workload with two reporting lines.
One intake, two statutes
A request that arrives may be a PAIA access request, a POPIA data subject access request, or both. Dimeri classifies it at intake and applies the correct route and deadline rather than leaving that judgement to whoever opened the email.
Decisions with their reasoning attached
Where access is refused, the section relied on and the reasoning are recorded with the decision. If the matter goes to internal appeal or to the Regulator, the basis of the original decision exists as it stood at the time.
The manual kept current
The manual has to reflect the records the body actually holds. Dimeri holds it against a review cycle with an owner, so a restructure does not quietly leave the published manual describing an organisation that no longer exists.
Annual return as a report
The annual return to the Information Regulator is generated from the request register rather than reconstructed from correspondence, so the numbers reconcile to the underlying records by construction.
Getting PAIA coverage in place
- 1
Load the manual and the record categories
The current section 14 or section 51 manual is loaded with its review date, and the categories of records it describes are held so they can be maintained as the organisation changes.
- 2
Create a single intake route
One published route for requests, logged automatically, classified as PAIA or POPIA at intake, with the statutory deadline calculated from the date of receipt.
- 3
Set owners and escalation
Each request gets a named owner and an escalation path that triggers well before the deadline, because the cost of a deemed refusal is an appeal the organisation never chose to have.
- 4
Report annually from the register
The Regulator return is produced from live data, and the year's pattern of requests is reviewed so recurring request types can be addressed proactively.
PAIA questions
Does PAIA apply to private companies?
Yes. PAIA applies to public bodies and to private bodies, and a private body includes a juristic person carrying on a trade, business or profession. Private bodies must have a manual under section 51 and must deal with requests for records that a requester needs for the exercise or protection of a right. Exemptions from the manual requirement have applied to some categories of private body at various times, so confirm the current position with your legal advisers.
What happens if we do not respond in time?
Failure to decide within the statutory period is treated as a refusal of the request, which the requester can then take further by internal appeal in the case of a public body or by complaint or application. The organisation ends up defending an outcome it never actually decided, which is why deadline tracking matters more than the quality of the eventual answer.
How does PAIA interact with POPIA?
They share the information officer role and a great deal of the underlying record keeping. POPIA also amended parts of PAIA, including in relation to requests for personal information. In Dimeri both sit under the same information officer with a shared intake, and a request is classified to the correct route at the point it arrives.
Can Dimeri hold the actual records requested?
Dimeri holds the request, the decision, the reasoning and the evidence of what was provided. The underlying records stay in the systems where they live. The point is that the process around the request is tracked and defensible, not that the platform becomes a document repository.
Is this a substitute for legal advice?
No. Refusal grounds, exemptions and the public interest override involve legal judgement, and the position for private bodies has changed over time. This page describes how Dimeri structures PAIA obligations for tracking. Your legal advisers should confirm what applies to you.
Put PAIA on one register
Every requirement mapped to a control with a named owner, the evidence held against it, and one view of where you stand.