A PAIA manual should guide the next request

A PAIA manual should help a requester find the correct route to an organisation's records. It should also help the receiving team recognise the request and pass it to the responsible person. Publishing a list of record categories does not, by itself, approve access to every record in those categories.

This guide concerns South African private bodies. The Information Regulator's private-body template describes a manual covering record categories, responsible contacts, access guidance and information about personal-information processing. It is a starting structure that needs the organisation's actual details. 1

A useful manual connects public information to a working request route. Keep automatically available records distinct from records requiring an access decision. Check the route when contacts or record systems change.

Use the Regulator's current PAIA page to locate its guidance, templates and prescribed forms. The page identifies Form 2 for a record-access request and explains that a requester seeking records from a private body needs to identify the right they intend to exercise or protect and why the records are required. 2

A practical manual should make the organisation and responsible contact unambiguous. A group brand with several entities may leave the reader unsure which body holds a record. Ask the responsible information function to verify the name, contact route and instructions before publication.

As an operational check, send a harmless test message through the advertised contact route. Label it clearly as a routing test rather than a legal request. Confirm that the receiving team knows where to direct a genuine request and has a deputy route when the usual contact is absent.

Use categories that a reader can recognise. “Operational information” may be too broad to help someone distinguish a contract, an inspection record and a customer communication. Ask record owners whether the descriptions reflect systems and records actually held.

The Regulator's template separates records available without a formal request, records available under other legislation and subjects with their associated record categories. It also includes sections about personal-information processing, recipients, cross-border flows and security measures. 1

Complete those sections against verified organisational facts. Avoid copying another body's recipient list or processing purpose merely because it appears in a finished manual. Describe security appropriately without exposing credentials or operational weaknesses.

Our suggested handling record captures the date received, requesting route, responsible decision-maker and records sought. Link it to the original correspondence and any clarification. Restrict access to the record according to its contents.

A receipt confirms that a message arrived; it should not promise that the requested information will be disclosed. The Regulator explains that refusal needs reasons grounded in PAIA's refusal provisions. The responsible person should assess the request under the applicable requirements and current guidance. 2

Agree how legal time limits will be identified and monitored for the actual request. This operational guide does not supply a universal deadline or decide whether an exception, extension or refusal applies.

Imagine a fictional South African service company whose manual lists an email address that became inactive after a restructure. A staff member receives a request through a general enquiry form but sends it to the old mailbox. The manual is available online, yet the route fails.

For this invented exercise, the company first corrects the responsible contact after verification. It identifies who will assess the received request and records the handover. The process owner then checks other public instructions and trains the enquiry team to recognise the route. None of these actions determines the requester's entitlement to the record.

Fictional routing-test record. A private body's manual names a general mailbox. An invented test message asks where a requester should send Form 2 for an archived service contract. It contains no real requester details or confidential records and is clearly marked as a test.

A successful test of the manual's mailbox does not validate every other public route. Check the website, forms and relevant staff instructions for conflicting contact details. Keep the action specific to the route that failed, with an owner and evidence of the corrected instruction.

For an actual request, preserve the original receipt and let the responsible function assess procedural requirements, time limits and the access decision. An internal handover should preserve the original receipt time for the responsible person’s deadline assessment. This exercise verifies routing, not entitlement, lawfulness of refusal or compliance with every PAIA requirement. Its entries are fictional rather than evidence of a test conducted by QSE Advisory.

Use it as a structure, then verify and complete the organisation-specific information. A template with placeholders or another body's details cannot describe your actual arrangements.

The template includes personal-information processing sections, but the organisation should assess its privacy and access-information duties separately. One document title does not establish that every duty has been met.

Our recommendation is to repeat it after relevant changes to contacts, entities, record systems or website navigation, with further checks proportionate to operational risk.

AI assisted research and drafting. Sources checked 7 October 2026. Obtain competent South African review of the manual and any consequential access decision.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.