29/05/2026
PAIA Compliance in South Africa: What Businesses Need to Know
The Promotion of Access to Information Act 2 of 2000 (“PAIA”) remains a key pillar of transparency and accountability in South Africa. PAIA empowers all types of stakeholders to request access to records held by both public and private businesses when access is required to protect their rights.
Every business is required to maintain a PAIA manual setting out how information requests may be submitted and processed. Once a request is received in the prescribed format, the organisation must respond within the prescribed statutory timeframe by either granting or refusing access. In addition, organisations must comply with annual PAIA reporting obligations to the Information Regulator, even where no requests were received during the reporting period. The report covers the financial period from 1 April to 31 March annually.
The annual report records whether access was either granted or refused, reasons for refusal, extensions of timeframes, the number of requests received, appeals, and complaints lodged with the regulator. Businesses should therefore ensure that appropriate processes are in place to receive, record, and manage all PAIA requests.
PAIA should not be confused with Protection of Personal Information Act 4 of 2013 (“POPIA”). While PAIA governs access to information, POPIA regulates the processing and protection of personal information. Even though the same regulator regulates both pieces of legislation, they serve distinct legal purposes and operate independently.
Therefore, for businesses, PAIA compliance is not only an administrative exercise. It reflects a broader commitment to sound governance, transparency, and responsible information management.
