PAIA & POPIA Manual

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended), and must be read with the Protection of Personal Information Act 4 of 2013.

Prepared by: Thusa Business Support (Pty) Ltd & Thusa Nextgen Services (Pty) Ltd
Document owner: Carl Petzer - Director, Information Officer
Effective date: 6 November 2026
Version: 1.0

1. Definitions and Interpretation

In this Manual, unless the context clearly indicates otherwise, the terms set out below shall bear the following meanings:

2. Purpose and Scope of this Manual

This Manual is published in accordance with section 51 of PAIA and is read together with the obligations of the Companies as responsible parties under POPIA. It applies jointly to the Companies which are related, are under common management, and perform the same activities as an IT managed services provider. Each remains a separate juristic person and a separate responsible party in its own right, and this single Manual is issued on behalf of, and discharges the obligations of, both Companies.

This Manual is useful for members of the public to:

2.1. check the categories of records held by the Companies which are available without a person having to submit a formal PAIA request;

2.2. have a sufficient understanding of how to make a request for access to a record of either Company, by providing a description of the subjects on which the Companies hold records and the categories of records held on each subject;

2.3. know the description of the records of the Companies which are available in accordance with any other legislation;

2.4. access all the relevant contact details of the Information Officer who will assist the public with the records they intend to access;

2.5. know the description of the Guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;

2.6. know if the Companies will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;

2.7. know the description of the categories of data subjects and of the information or categories of information relating thereto;

2.8. know the recipients or categories of recipients to whom the personal information may be supplied;

2.9. know if the Companies have planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and

2.10. know whether the Companies have appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3. Entities Covered and Key Contact Details

3.1 Entities to Which This Manual Applies

This Manual applies to each of the following private bodies:

3.2 Information Officer

3.3 Requests for Access to Information

Email for PAIA requests informationofficer@thusa.co.za

3.4 Head Office

4. Guide on How to Use PAIA and How to Obtain Access to the Guide

4.1. The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2. The Guide is available in each of the official languages and in braille.

4.3. The aforesaid Guide contains the description of -

4.3.1. the objects of PAIA and POPIA;

4.3.2. the postal and street address, phone and fax number and, if available, electronic mail address of -

4.3.2.1. the Information Officer of every public body; and

4.3.2.2. every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA¹ and section 56 of POPIA²;

4.3.3. the manner and form of a request for -

4.3.3.1. access to a record of a public body contemplated in section 11³; and

4.3.3.2. access to a record of a private body contemplated in section 50⁴;

4.3.4. the assistance available from the Information Officer of a public body in terms of PAIA and POPIA;

4.3.5. the assistance available from the Regulator in terms of PAIA and POPIA;

4.3.6. all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging -

4.3.6.1. an internal appeal;

4.3.6.2. a complaint to the Regulator; and

4.3.6.3. an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body;

4.3.7. the provisions of sections 14⁵ and 51⁶ requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;

4.3.8. the provisions of sections 15⁷ and 52⁸ providing for the voluntary disclosure of categories of records by a public body and private body, respectively;

4.3.9. the notices issued in terms of sections 22⁹ and 54¹⁰ regarding fees to be paid in relation to requests for access; and

4.3.10. the regulations made in terms of section 92¹¹.

4.4. Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.

4.5. The Guide can also be obtained -

4.5.1. upon request to the Information Officer of the Companies at informationofficer@thusa.co.za; and

4.5.2. from the website of the Regulator (https://inforegulator.org.za/).

4.6. A copy of the Guide is available in English, for public inspection during normal office hours at the head office of the Companies.

Notes to section 4

1. Section 17(1) of PAIA - For the purposes of PAIA, each public body must, subject to legislation governing the employment of personnel of the public body concerned, designate such number of persons as deputy information officers as are necessary to render the public body as accessible as reasonably possible for requesters of its records.
2. Section 56(a) of POPIA - Each public and private body must make provision, in the manner prescribed in section 17 of the Promotion of Access to Information Act, with the necessary changes, for the designation of such a number of persons, if any, as deputy information officers as is necessary to perform the duties and responsibilities as set out in section 55(1) of POPIA.
3. Section 11(1) of PAIA - A requester must be given access to a record of a public body if that requester complies with all the procedural requirements in PAIA relating to a request for access to that record; and access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part.
4. Section 50(1) of PAIA - A requester must be given access to any record of a private body if (a) that record is required for the exercise or protection of any rights; (b) that person complies with the procedural requirements in PAIA relating to a request for access to that record; and (c) access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part.
5. Section 14(1) of PAIA - The information officer of a public body must, in at least three official languages, make available a manual containing information listed in paragraph 4 above.
6. Section 51(1) of PAIA - The head of a private body must make available a manual containing the description of the information listed in paragraph 4 above.
7. Section 15(1) of PAIA - The information officer of a public body must make available in the prescribed manner a description of the categories of records of the public body that are automatically available without a person having to request access.
8. Section 52(1) of PAIA - The head of a private body may, on a voluntary basis, make available in the prescribed manner a description of the categories of records of the private body that are automatically available without a person having to request access.
9. Section 22(1) of PAIA - The information officer of a public body to whom a request for access is made, must by notice require the requester to pay the prescribed request fee (if any), before further processing the request.
10. Section 54(1) of PAIA - The head of a private body to whom a request for access is made must by notice require the requester to pay the prescribed request fee (if any), before further processing the request.
11. Section 92(1) of PAIA provides that the Minister may, by notice in the Gazette, make regulations regarding: (a) any matter which is required or permitted by this Act to be prescribed; (b) any matter relating to the fees contemplated in sections 22 and 54; (c) any notice required by this Act; (d) uniform criteria to be applied by the information officer of a public body when deciding which categories of records are to be made available in terms of section 15; and (e) any administrative or procedural matter necessary to give effect to the provisions of this Act.

5. Categories of Records Available Without a Request

The following categories of records held by the Companies are available without a person having to submit a formal PAIA request. These records may be accessed on the Companies' website or requested by telephone or email.

6. Records Available in Accordance with Other Legislation

The Companies create and hold records in accordance with, among others, the following legislation. This list is not exhaustive and the applicable legislation may change from time to time.

7. Subjects and Categories of Records Held

The Companies are IT managed services providers. They administer and support the IT equipment, platforms and systems of their clients, and hold the following subjects and categories of records.

8. Processing of Personal Information (POPIA)

8.1 Purpose of Processing Personal Information

The Companies process personal information for purposes connected with their business as IT managed services providers. This includes administering and supporting client IT equipment, platforms and systems; managing client and supplier relationships; providing and invoicing for services; complying with legal, tax and regulatory obligations; and administering their own internal operations, including human resources and accounting. The Companies do not process the underlying business data of their clients as a service; they hold client contact and user information, and system documentation, as necessary to deliver support and administration services.

8.2 Categories of Data Subjects and Personal Information

8.3 Recipients or Categories of Recipients

8.4 Transborder Flows of Personal Information

The Companies may transfer personal information to recipients outside the Republic of South Africa. Where this occurs, the Companies will ensure that the transfer takes place in accordance with section 72 of POPIA.

8.5 Information Security Measures

The Companies implement appropriate, reasonable technical and organisational security measures to ensure the confidentiality, integrity and availability of the personal information in their care, and to prevent loss of, damage to, or unauthorised access to that information. These measures include, among others, access controls and user authentication, network and endpoint security, anti-virus and anti-malware solutions, encryption where appropriate, firewalls, monitoring and logging, secure backups, and internal policies governing the handling of personal information. Security measures are reviewed and updated on a regular basis in line with generally accepted information security practices.

9. Availability of the Manual

9.1. A copy of the Manual is available -

9.1.1. on the Companies' website at www.thusa.co.za;

9.1.2. at the head office of the Companies for public inspection during normal business hours;

9.1.3. to any person upon request and upon the payment of a reasonable prescribed fee; and

9.1.4. to the Information Regulator upon request.

9.2. A fee for a copy of the Manual, as contemplated in annexure B of the Regulations, shall be payable per each A4-size photocopy made.

10. Updating of this Manual

The Information Officer will update this Manual on a regular basis, and whenever there is a material change to the information contained in it. Members of the public are encouraged to consult the version published on the Companies' website for the most current information.