This manual helps members of the public to:

1. 2.1
   Check which categories of records are available without submitting a formal PAIA request.
2. 2.2
   Understand how to request access to a record, including the subjects and categories of records held.
3. 2.3
   Know which records are available under other legislation.
4. 2.4
   Access the contact details of the IO and DIO who assist with records requests.
5. 2.5
   Know how to obtain the Regulator's guide on how to use PAIA.
6. 2.6
   Know whether personal information is processed, why, and who the affected data subjects are.
7. 2.7
   Know the recipients or categories of recipients personal information may be supplied to.
8. 2.8
   Know whether personal information is transferred outside South Africa, and to whom.
9. 2.9
   Know whether appropriate security measures protect the confidentiality, integrity and availability of that information.

1. 4.1
   The Regulator has, under section 10(1) of PAIA, published a revised guide on how to use PAIA, in an easily comprehensible form.
2. 4.2
   The guide is available in every official language and in braille.
3. 4.3
   The guide describes:

   1. 4.3.1
      The objects of PAIA and POPIA
   2. 4.3.2
      Postal, physical, phone and email details of every IO and DIO
   3. 4.3.3
      The manner and form of a request — for public or private body records, internal appeals, Regulator complaints, and court applications
   4. 4.3.4
      The duty to compile a manual under sections 14 and 51, and how to access one
   5. 4.3.5
      Voluntary disclosure of record categories under sections 15 and 52
   6. 4.3.6
      Fee notices under sections 22 and 54
   7. 4.3.7
      Regulations made under section 92
   8. 4.3.8
      Assistance available from an IO under PAIA and POPIA
   9. 4.3.9
      Assistance available from the Regulator under PAIA and POPIA
   10. 4.3.10
       All legal remedies available, and how to lodge them
4. 4.4
   Members of the public may inspect or copy the guide at the offices of public and private bodies, including the Regulator, during normal working hours.
5. 4.5
   The guide can also be requested from the IO, or downloaded from justice.gov.za/inforeg.
6. 4.6
   A copy is available for inspection in each official language:

   Afrikaans

   Ndebele

   Xhosa

   isiZulu

   Swati

   Sepedi

   SeSotho

   Tswana

   Venda

   Tsonga

1. 5.1
   A guide to PAIA, published under section 10 of PAIA, explains how to access information under the Act.
2. 5.2
   It contains the information an individual needs to exercise their PAIA rights.
3. 5.3
   A copy can be requested from the IO using the contact details above.
4. 5.4
   It can also be inspected at the company's offices during ordinary working hours.
5. 5.5
   Or requested directly from the Information Regulator:

   Information Regulator

   P O Box 31533, Braamfontein, Johannesburg, 2017
   +27 (10) 023-5200
   inforegulator.org.za
   PAIACompliance.IR@justice.gov.za

At this stage, no notices have been published on categories of records available without requiring a formal PAIA request.

7.1 — Categories available without a formal request:

7.2 — Records available under other legislation:

Additional legislation that may apply per the Section 51 manual: Administration of Estates Act · Attorneys Act · Arbitration Act · Auditing Profession Act · Banks Act · Close Corporations Act · Competition Act · Criminal Procedure Act · Copyright Act · Currency and Exchanges Act · Debt Collectors Act · Designs Act.

7.3 — Records held for PAIA and POPIA purposes:

• PAIA: PAIA Manual, PAIA guides, PAIA records, submission records, awareness training
• POPIA: IO Registration Certificate, data breach records, retention records, awareness training
• Further information may be made available on request

1. 8.1
   Requesters must follow all procedures laid down in PAIA.
2. 8.2
   Complete PAIA Form 2 and submit it to the IO.
3. 8.3
   Submit the form, request fee, and deposit (if applicable) via the postal address, physical address, fax, or email on record.
4. 8.4
   The form must clearly identify:

   • The record(s) requested
   • The identity of the requester
   • What form of access is required
   • The requester's postal address or fax number
5. 8.5
   The requester must state which right they are exercising or protecting, and why the records are needed for that purpose.
6. 8.6
   Requests are handled within 30 days of receipt, unless special grounds justify a faster response.
7. 8.7
   The 30-day period may be extended by up to 30 further days for large volumes or records held elsewhere — the IO notifies the requester in writing.
8. 8.8
   The IO responds using PAIA Form 3, covering:

   • The decision
   • Fees payable
9. 8.9
   If search and preparation would exceed six hours, the requester is asked for a deposit of up to one-third of the total fee.
10. 8.10
    Requesters who need help with the form or process should contact the IO.
11. 8.11
    Requesters unable to complete the form due to illiteracy or disability may request orally; the IO completes it on their behalf and provides a copy.
12. 8.12
    POPIA Form 2 — request correction or deletion of inaccurate, outdated, incomplete, or unlawfully obtained personal information (s.24(1) POPIA).
13. 8.13
    POPIA Form 3 — an industry body applies for a Code of Conduct under s.61(1)(b) POPIA.
14. 8.14
    POPIA Form 4 — request a data subject's consent for direct marketing under s.69(2) POPIA.
15. 8.15
    POPIA Form 5 — lodge a complaint with the Regulator about unlawful interference with personal information.

Subject to the exceptions in Chapter 4 of PAIA, a request may be refused on these grounds:

1. 9.1
   Mandatory protection of a third party's privacy — including a deceased person — where disclosure would be unreasonable.
2. 9.2
   Mandatory protection of a third party's commercial information, where the record contains:

   1. 9.2.1
      Trade secrets of that third party
   2. 9.2.2
      Financial, commercial, scientific or technical information whose disclosure could cause harm
   3. 9.2.3
      Information disclosed in confidence that could disadvantage the third party commercially
3. 9.3
   Mandatory protection of confidential third-party information protected by agreement.
4. 9.4
   Mandatory protection of the safety of individuals and of property.
5. 9.5
   Mandatory protection of records privileged in legal proceedings.
6. 9.6
   Protection of the company's own commercial information, which may include trade secrets, financial/commercial/scientific/technical information, negotiation-sensitive information, or copyrighted computer programs.
7. 9.7
   Research information whose disclosure would seriously disadvantage the research or researcher.
8. 9.8
   Requests that are clearly frivolous, vexatious, or an unreasonable diversion of resources.

1. 10.1
   Phandu Communications has no internal appeal procedure — a decision by the IO is final.
2. 10.2
   Under sections 56(3)(c) and 78 of PAIA, the requester may apply to a court for relief within 180 days of being notified of the decision.

12.1 — Purpose of processing:

1. 12.1.1
   Providing HR, labour relations, payroll, skills development, health & safety, and related business support services, which requires processing personal information of employees, clients, contractors, and service providers.
2. 12.1.2
   Complying with applicable law — BCEA, LRA, Skills Development legislation, OHS Act, EE Act, and POPIA — which require retention, use, and disclosure of certain categories of information.
3. 12.1.3
   Legitimate business purposes: client and employee records, contract administration, payroll and benefits, compliance monitoring, audits, training, risk management, security, and stakeholder communication.

12.2 — Categories of data subjects and information processed:

Phandu Communications uses cloud-based platforms and service providers to store and process personal information. This may involve cross-border transfers to jurisdictions with adequate data protection laws, such as EU member states and the United States.

Information that may be transferred includes:

• Customers/clients: contact information, registration numbers, financial details, contractual records
• Service providers: business registration details, VAT numbers, banking details, contracts
• Employees: HR records, payroll and tax information, demographic data, training and development information

14.1 — Security measures protecting confidentiality, integrity and availability:

1. 14.1.1
   Technical safeguards

   1. ·
      Data encryption in transit and at rest
   2. ·
      SSL/TLS protocols for secure communications
   3. ·
      Role-based access control, strong passwords, multi-factor authentication
2. 14.1.2
   Administrative safeguards

   1. ·
      Policies governing data processing, retention, and disposal
   2. ·
      Confidentiality agreements signed by employees, contractors, and third parties
   3. ·
      Regular training and awareness programs on POPIA and internal security policy
3. 14.1.3
   Physical and monitoring safeguards

   1. ·
      Physical access controls — security personnel, access cards, CCTV
   2. ·
      Anti-virus, anti-malware, and intrusion detection, regularly updated
   3. ·
      Regular backups and disaster recovery planning

1. 15.1
   A copy of the manual is available:

   1. 15.1.1
      At Phandu Communications' office for public inspection during business hours, by appointment
   2. 15.1.2
      To any person on request, on payment of a reasonable prescribed fee
   3. 15.1.3
      To the Information Regulator on request
2. 15.2
   A fee, as set out in Annexure B of the Regulations, is payable per A4-size photocopy.

1. 16.1
   A data subject objecting to processing under s.11(3)(a) or (b) of POPIA may submit the objection at any time during office hours, free of charge.
2. 16.2
   Objections use a form substantially similar to POPIA Form 1, submitted free of charge by hand, fax, post, email, SMS, WhatsApp, or any manner convenient to the data subject.
3. 16.3
   When collecting personal information, Phandu Communications notifies the data subject of their right to object, per s.18(1)(h)(iv).
4. 16.4
   Telephonic objections are electronically recorded and, on request, made available to the data subject — including a transcription.

1. 17.1
   A data subject may, under s.24 of POPIA, request correction, destruction, or deletion of their personal information.
2. 17.2
   Correction or deletion may be requested at any time, free of charge, if information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained (s.24(1)(a)).
3. 17.3
   Destruction or deletion of a record may be requested at any time, free of charge, if the company is no longer authorised to retain it under s.14 (s.24(1)(b)).
4. 17.4
   Requests use a form substantially similar to POPIA Form 2, submitted free of charge by hand, fax, post, email, SMS, WhatsApp, or any convenient manner.
5. 17.5
   Telephonic requests are recorded and made available to the data subject on request, free of charge, including a transcription.
6. 17.6
   The company notifies the data subject in writing of the action taken, within 30 days of the outcome.

The head of Phandu Communications will update this manual on a regular basis.

PAIA Forms

POPIA Forms