POPIA & PAIA, explained

One right to privacy. Two manuals it makes you write.

POPIA and PAIA don't just ask for documents, they create legal duties, a named role inside your business, and a compliance cycle that keeps going after the manuals are delivered. Here's exactly what that means.

Contact UsWhere It Comes From

  1. 01

    The Constitution

    Section 14 (privacy) and Section 32 (access to information)

  2. 02

    The Acts

    POPIA (2013) and PAIA (2000) give effect to those rights

  3. 03

    The Manuals

    Your POPIA Manual and PAIA Manual, the written record of compliance

  4. 04

    The Role

    A named Information Officer, registered with the Regulator

  5. 05

    The Cycle

    Review, respond, train, and back to the manuals

The last step points back to the manuals, this isn't a document you file once. It's a cycle you maintain.

Where it comes from

Neither manual is a lawvero invention, or a nice-to-have. Both are the written output of a specific statutory duty.

POPIA

Protection of Personal Information Act 4 of 2013

Signed into law in 2013, with commencement staggered over several years. The core operational provisions, including the duty to appoint an Information Officer, came into force on 1 July 2020, with a one-year grace period. Full enforcement began 1 July 2021.

  • Regulates how personal information is collected, used, stored and shared
  • Enforced by the Information Regulator
  • Modelled on international frameworks such as the GDPR, adapted for South African law

PAIA

Promotion of Access to Information Act 2 of 2000

Gives effect to the constitutional right of access to information. Predates POPIA by more than a decade. Section 51 requires certain bodies to compile and make public a manual describing the records they hold and how a person can request access to them.

  • Applies regardless of the size of the business
  • The duty to have a manual is separate from the duty to respond properly to an actual request
  • Now administered by the same Information Regulator as POPIA

Since the Information Regulator took over administration of both Acts, POPIA and PAIA are increasingly treated as a pair rather than two separate compliance projects, which is why lawvero delivers them together.

What's actually inside each one

Two different documents, doing two different jobs, one governs how you handle personal information, the other governs how the public can find out what records you hold.

Internal-facing

The POPIA Manual

  1. 01Information Officer and Deputy details
  2. 02The eight conditions for lawful processing, applied to your business
  3. 03Categories of personal information you actually process
  4. 04Data subject rights and how a request gets handled
  5. 05Security safeguards in place to protect that information
  6. 06Retention and disposal schedule, by record type
  7. 07Data breach response plan and notification templates
  8. 08Third-party/operator agreement position

Public-facing

The PAIA Manual

  1. 01Information Officer and Deputy contact details
  2. 02Reference to the SAHRC's guide on using PAIA
  3. 03Categories of records the business holds
  4. 04Records available without a formal request
  5. 05How to submit a request, and the applicable fees
  6. 06Grounds on which access can be refused
  7. 07The appeal or court process if a request is refused

What the law actually requires

Not a checklist of nice-to-haves, these are the conditions the Act itself sets out.

POPIA's eight conditions for lawful processing

  1. 01

    Accountability

    You must ensure, and be able to show, that these conditions are met.

  2. 02

    Processing limitation

    Collect only what's needed, and only with a lawful basis.

  3. 03

    Purpose specification

    Say why you're collecting it, before or at the point of collection.

  4. 04

    Further processing limitation

    Don't repurpose data for something incompatible with why it was collected.

  5. 05

    Information quality

    Keep it accurate, complete and up to date.

  6. 06

    Openness

    Be transparent with data subjects about what you're doing with their information.

  7. 07

    Security safeguards

    Protect it against loss, damage and unauthorised access.

  8. 08

    Data subject participation

    Let people see, correct, or ask you to delete their own information.

PAIA's core duty

Section 51 requires a manual to be compiled and made public, that duty exists whether or not anyone ever actually submits a request. Not having a manual is itself a compliance failure, separate from how well you'd handle a real request.

R10m

Maximum fine for serious POPIA offences, with criminal liability, including imprisonment, possible for certain violations. The Information Regulator is actively investigating and enforcing, not just publishing guidance.

The positions this creates inside your company

This is the part most businesses miss, POPIA doesn't just ask for a document, it deems someone in your business responsible for it, whether you've formally appointed them or not.

Mandatory

Information Officer

By default, this is the head of the organisation, typically the CEO or most senior person, unless another individual is formally appointed and registered in their place.

  • Must be registered with the Information Regulator
  • Responsible for encouraging compliance across the business
  • Handles data subject requests and PAIA access requests
  • Develops and maintains internal compliance measures

Optional

Deputy Information Officer

Not required, but common in larger businesses or where the Information Officer needs to delegate day-to-day compliance work.

  • Also must be registered with the Information Regulator
  • Can be delegated specific duties by the Information Officer
  • Doesn't remove the Information Officer's ultimate accountability

This isn't a once-off deliverable

The manuals are the starting document, not the finish line. POPIA and PAIA both expect ongoing action, not a policy that sits in a drawer.

  • Annually

    Review and version-update both manuals to reflect any change in how the business processes personal information.

  • As they arrive

    Log and respond to data subject access, correction or deletion requests within the statutory timeframe.

  • Per new hire

    Onboard new staff with POPIA awareness training and record their sign-off.

  • On readiness

    Keep a tested data breach response plan, with notification templates ready to use, not drafted after the fact.

  • Per new vendor

    Review and sign an operator agreement whenever a new third party will process personal information on your behalf.

  • Ongoing

    Keep the Information Officer's registration and details current with the Information Regulator.

Important: lawvero (Pty) Ltd provides document-preparation and compliance-support services and does not provide legal advice. This page is general information on South African law current as at July 2026. Key legislation: Protection of Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000. © lawvero (Pty) Ltd 2026 · law, verified.

We draft it. We maintain it. One fixed fee.

lawvero builds both manuals for your business, appoints and registers your Information Officer, and keeps the whole cycle running, so this stays handled, not just filed.

Contact Us