Last reviewed: 7 October 2026
Who needs one?
Every private body: companies, close corporations, partnerships and sole proprietors running a business. Smaller businesses were exempt until 31 December 2021. Since 1 January 2022 there is no size exemption.
The manual is required by section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). It tells people which records you hold and how to ask for them.
Required contents
- Contact details. Street and postal address, phone number and email address of the head of the business, plus the Information Officer and any deputies.
- The PAIA guide. A description of the Information Regulator's guide on how to use PAIA, and how to get a copy.
- Records available without a request. Any categories you make available automatically, if you have any.
- Records held under other laws. For example the Companies Act, tax legislation and labour legislation.
- Subjects and categories of records. Enough detail for someone to make a request: company records, finance, staff, client files, IT and so on.
- How to request access. The procedure, the prescribed request form and the fees.
The POPIA section
Since POPIA took effect, the manual must also describe how you process personal information:
- The purposes you process personal information for
- The categories of people whose information you hold, and what you hold on each
- Who you share it with, by recipient or category of recipient
- Any planned transfers of personal information outside South Africa
- A general description of your information security measures
Where it must be available
- On your website, if you have one
- At your principal place of business, for inspection during office hours
- To any person who asks for a copy, for which you may charge a reasonable fee
- To the Information Regulator, on request
You do not have to submit the manual to the Regulator. You do have to keep it up to date.
Common mistakes
- A downloaded template that still lists someone else's record categories
- No POPIA section at all
- An Information Officer who was never registered, or who has left. See how to register an Information Officer.
- Written once and never updated
- A finished document that sits in a folder and is not on the website
The annual PAIA report
The Information Regulator also requires private businesses to submit an annual PAIA report through its eServices portal between 1 April and 30 June each year, even if nobody requested a record.
The manual is item 2 on the POPIA checklist for small businesses.
This is practical guidance, not legal advice. For a legal opinion on a specific situation, speak to an attorney.
All guides