PAIA and POPIA are two different laws that often land on the same desk. POPIA (the Protection of Personal Information Act) is about how you look after the personal information of people you deal with. PAIA (the Promotion of Access to Information Act) is about who can ask to see the records you hold, and when you can say no. One protects privacy, the other opens up access. A well-run business needs to understand both.
Key takeaways
- POPIA governs how you collect, use, store and delete personal information. PAIA governs how people request access to records you hold.
- The two laws are designed to balance each other: PAIA lets you refuse a request that would unfairly expose someone’s personal information.
- Every public and private body, including small businesses and sole proprietors, is expected to have a PAIA manual, and that manual must cover how you process personal information under POPIA.
- One person in your business, the Information Officer, sits at the centre of both laws and must be registered with the Information Regulator.
- Treat both as part of running a credible business, not as paperwork to file away.
Table of Contents
- The short answer: two laws, two different questions
- PAIA and POPIA side by side
- What POPIA asks of your business
- What PAIA asks of your business
- Where the two laws meet
- Two business scenarios
- Getting both in place: a practical order of work
- Putting the right foundations in one place
- What if someone makes a PAIA request to you?
- Common misunderstandings
- FAQ
- Sources
The short answer: two laws, two different questions
Imagine Naledi runs a small design studio in Johannesburg with four employees and about sixty clients. On Monday, a former client emails to ask what personal details she holds about him and whether she can delete them. On Thursday, a competitor’s lawyer sends a letter asking for a copy of a supplier contract she signed last year.
Those are two different questions, and two different laws answer them.
- The client asking what you hold about him is a POPIA matter. He is a data subject exercising rights over his own information.
- The lawyer asking for a record is a PAIA matter. A third party wants access to something you hold.
The Department of Forestry, Fisheries and the Environment explains the split this way: PAIA gives effect to the constitutional right of access to information held by the State, while POPIA safeguards personal information processed by public and private bodies and balances privacy against other rights, including access to information. In plain terms, PAIA is about transparency and POPIA is about protection.
PAIA and POPIA side by side
| POPIA | PAIA | |
|---|---|---|
| Main purpose | Protect personal information and privacy | Give people access to records held by public and private bodies |
| Who it protects | The person the information is about (the data subject) | The person asking for the record (the requester) |
| Your main role | Responsible party, deciding why and how personal information is processed | Body holding records that someone may ask to see |
| Key document in your business | Privacy policy and internal data practices | PAIA manual |
| Key person | Information Officer | Information Officer (often the same person) |
| Regulator | Information Regulator | Information Regulator |
The last row is worth noticing. The Information Regulator took over the regulatory functions for PAIA from the South African Human Rights Commission on 30 June 2021. Both laws now answer to one regulator, which makes it easier to see them as two halves of one information framework.
What POPIA asks of your business
POPIA is built around eight conditions for lawful processing. The Information Regulator lists them as accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
That list sounds abstract until you attach it to real decisions. Here is what each condition means in a business setting:
- Accountability: someone in your business is responsible for how personal information is handled.
- Processing limitation: you collect only what you need, and you have a proper reason for it.
- Purpose specification: you know why you are collecting each piece of information, and you tell people.
- Further processing limitation: you do not suddenly use client details for something unrelated, like selling their contact details on.
- Information quality: you keep records accurate and up to date.
- Openness: people can find out what you collect and why.
- Security safeguards: you protect information from being lost or accessed by the wrong people.
- Data subject participation: people can ask what you hold and ask you to correct it.
The last one is where POPIA and PAIA start to touch. Under POPIA, a data subject can access their personal information and ask for it to be corrected or deleted if it is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained, according to the Information Regulator. If you suspect personal information has been accessed by an unauthorised person, the same source explains that you must tell both the Regulator and the person affected.
If you want a practical walk through the day-to-day steps, our POPIA compliance checklist for small business is a good place to start, and our guide to POPIA compliance for small businesses in South Africa explains the reasoning behind it.
What PAIA asks of your business
PAIA starts from the idea that people have a right to information, but that right has limits. For private bodies like yours, the Information Regulator explains that a requester can ask for any recorded information you hold, as long as they say which right they are trying to protect or exercise. That is a higher bar than the one for government bodies, and it is why requests to businesses are less common than people expect.
The right is not unlimited either. The Act recognises justifiable limits such as protection of privacy, commercial confidentiality and effective governance. So if someone asks for a record that contains another person’s details, or your pricing arrangements with a supplier, you may have grounds to refuse all or part of the request.
Who needs to comply with PAIA?
PAIA applies to both public bodies, such as government departments and municipalities, and private bodies, which include companies, partnerships and sole proprietors. The official PAIA guide says that all public and private bodies must compile and make available a PAIA manual. Older rules exempted many small businesses, so you may hear advice from a few years back that says otherwise. Check the Information Regulator’s current guidance rather than relying on it.
What a PAIA manual is for
The manual is a public-facing guide to your business’s records and how someone goes about requesting them. Think of it as a front door: it tells a requester who to contact, what categories of records exist and how to ask. It is not a list of every document you own.
Where the two laws meet
The overlap is not an accident. PAIA, in the words of the Department of Forestry, Fisheries and the Environment, recognises the need to balance access to information with protection of privacy, which is the focus of POPIA.
It shows up in three places.
Your PAIA manual must mention personal information
The official guide states that PAIA manuals must include matters relating to the processing of personal information under POPIA. So a manual is not a standalone document. It needs to reflect what you actually do with personal information, which is another reason to understand your data practices before you write it.
Access requests that include personal information
When a PAIA request would reveal personal information about someone else, the body may refuse access on the grounds for refusal set out in PAIA. Here POPIA’s privacy thinking guides PAIA’s decisions. Naledi, for example, would not hand over a client list to a stranger simply because the stranger asked for it.
One Information Officer for both
Public and private bodies must register their Information Officers with the Information Regulator before the officer starts their duties. The Regulator’s online portals also let bodies register and submit annual section 32 PAIA reports. According to the Regulator, an Information Officer encourages compliance with the conditions for lawful processing, deals with POPIA requests and works with the Regulator on investigations.
In a small business, the Information Officer is usually the head of the business, such as the owner or CEO, though duties can be delegated. In practice, that one person becomes the contact for privacy questions and for access requests.
Two business scenarios
A freelancer with a growing client base
Thabo is a freelance bookkeeper in Durban. He holds ID numbers, bank details and payroll information for a dozen small clients. POPIA is his daily concern: why he holds this data, where it is stored, who can see it and when he deletes it. PAIA matters less often, but he still needs a short manual that tells a requester how to reach him.
His sensible first steps are to list what personal information he holds, decide why he needs each item, and make sure he can answer a client who asks what he has on file.
An SME bringing on investors or partners
A manufacturing SME in Gauteng is preparing for a funding round. An investor’s team asks to review contracts, staff records and supplier terms. Here the business needs to think about confidentiality and about privacy in the same breath: what can be shared under proper confidentiality arrangements, and what contains employee or customer information that needs care. Having a clear PAIA manual and clear data practices shows the investor the business is organised.
Getting both in place: a practical order of work
You do not need to tackle everything in one afternoon. This sequence works for most small businesses:
- Decide who your Information Officer is. Then register them with the Information Regulator through its online portal.
- Map your personal information. Write down what you collect, from whom, why, where it is kept and how long you keep it.
- Write or update your privacy policy. It should describe what you really do. Our article on the decisions behind a South African privacy policy shows the choices involved.
- Look at your security. Know who has access, how you would spot a problem and how you would tell affected people. Our guide on data security and breaches covers the thinking.
- Check cross-border flows. If you use cloud tools or service providers abroad, see our practical guide to cross-border data transfers under POPIA.
- Prepare your PAIA manual. Use the Regulator’s guide and make sure the personal information section matches step 2.
- Agree a simple routine for requests. Decide who receives a request, how quickly you respond and who checks it before it goes out.
If you are unsure how a particular refusal ground applies to a request, or how the law fits a complex situation, speak to an attorney. The steps above give you the foundation to have that conversation efficiently.
Putting the right foundations in one place
Many founders know they should sort out their legal basics but are not sure where to begin, or whether they need a full legal engagement for every item. PocketAdvisor Legal Toolkits™ are digital boxes that bring together expert-led videos, practical workbooks and professionally drafted South African legal agreements, so you understand the reasoning behind each piece and can put it into practice at your own pace.
The Legal Toolkit™ for Start-Ups and Solopreneurs (R1 495, once-off) covers the legal foundations a new business needs. The Legal Toolkit™ for SMEs (R2 495, once-off) is aimed at growing businesses and looks at governance and commercial arrangements. Understand the legal foundations your business needs: explore PocketAdvisor Legal Toolkits™.
The toolkits support, and do not replace, professional legal advice where your situation calls for it. They help you ask better questions and make more informed decisions about your business’s legal readiness.
What if someone makes a PAIA request to you?
It helps to know the basics before the first request lands. A private body request is made to the business’s Information Officer, and the requester must identify the right they want to exercise or protect. Your manual should tell them how.
If you decide not to release a record, tell the requester clearly and give your reasons. For private bodies there is no compulsory internal appeal. Instead, a requester may lodge a complaint with the Information Regulator within 180 days. A calm, documented decision process makes any such review much easier to handle.
Common misunderstandings
“PAIA and POPIA are two names for the same thing.” They are separate Acts with different purposes, even though they refer to each other.
“I am a small business, so neither applies.” POPIA applies to anyone processing personal information, and the PAIA guide says all public and private bodies must have a manual.
“A PAIA request means I must hand over everything.” It does not. The Act has recognised limits, including privacy and commercial confidentiality.
“Once I have a privacy policy, I am done.” A privacy policy is one piece. The Information Officer registration, your security practices, your PAIA manual and your day-to-day habits all count.
FAQ
Are PAIA and POPIA the same thing?
No. POPIA protects personal information by setting rules for how it is processed, while PAIA gives people a way to request access to records held by public and private bodies. They work together, because PAIA recognises the need to protect privacy. Both are overseen by the Information Regulator.
Who needs to comply with PAIA?
Both public and private bodies, which includes companies, partnerships and sole proprietors. The official PAIA guide states that all public and private bodies must compile and make available a PAIA manual. Check the Information Regulator’s website for the current position and templates.
What are the eight conditions of POPIA?
They are accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. Together they describe how personal information must be handled from collection to deletion.
What information can be requested under PAIA?
Any recorded information held by a public or private body. When you ask a private body, you must say which right you want to protect or exercise. Access can be refused on recognised grounds, such as protecting another person’s privacy or commercial confidentiality.
Sources
- PAIA & POPIA, Department of Forestry, Fisheries and the Environment
- PAIA, Information Regulator
- Promotion of Access to Information Act 2 of 2000, Kouga Local Municipality
- POPIA presentation, Information Regulator (2021)
- Information Regulator takes over functions related to PAIA, SAnews
- PAIA Guide on manuals (2024), Parliament of South Africa
- Information Regulator’s POPIA and PAIA online portals, South African Government
- Portal, Information Regulator
Recommended
- POPIA Compliance Checklist for Small Business
- POPIA Compliance Small Business South Africa
- POPIA Compliance Small Business South Africa
This article is for educational and informational purposes only. It is not a substitute for professional advice.
