NRS Solutions (Pty) Ltd — PAIA Manual

Registration Number: 2022/682414/07 ("the Company")

Prepared in terms of section 51 of the Promotion of Access to Information Act, No. 2 of 2000, as amended.

Version 3.0  |  Date of compilation: 09/06/2021  |  Date of revision: 30/09/2025

1. Definitions

2. Purpose of the PAIA Manual

This PAIA Manual is useful for the public to:

The PAIA Manual serves as a public guide to the information held by the organisation and how it can be accessed. It outlines the categories of records available without a formal request, the subjects on which records are maintained, and details of records accessible under other legislation. The manual also provides the official contact details of the Information Officer (IO) and Deputy Information Officer (DIO), who are responsible for assisting the public in exercising their right of access.

The manual further explains how to use the PAIA process and where to obtain the official guide published by the Regulator. It describes whether and how the organisation processes personal information, including the purposes of processing, the categories of data subjects involved, and the recipients (local or international) to whom such information may be supplied. The manual further confirms that appropriate security safeguards are in place to protect the confidentiality, integrity, and availability of personal information.

3. Contact Details for Access to Information Requests

Information Officer

Deputy Information Officer

National or Head Office

4. Guide on How to Use PAIA and How to Obtain Access to the Guide

The Information Regulator has published a revised PAIA Guide in terms of section 10(1) of PAIA (as amended). This guide is designed to help any person who wishes to exercise rights under PAIA or POPIA, and it is available in all official languages as well as in braille to ensure accessibility.

The Guide serves two key purposes:

• Access to Personal Information (POPIA): It explains how individuals (data subjects) can exercise their rights to request confirmation of whether personal information is held about them, to access that information (including details of third-party recipients), and to request correction, deletion, or destruction of personal information that is inaccurate, outdated, excessive, or unlawfully obtained.
• Access to Records (PAIA): It provides step-by-step guidance on how to request records from public or private bodies, including the required forms, the process for appeals or complaints, and how to approach a court if necessary.

In addition, the Guide offers:

• An overview of the objectives of PAIA and POPIA.
• Contact details of Information Officers (IOs) and Deputy Information Officers (DIOs).^[1]
• Manner and form of a request for access to a record of a public body and private body.^[2]
• Guidance on compiling or accessing PAIA Manuals.^[3]
• Information on voluntary disclosures of records, prescribed access fees, and applicable regulations.^[4]
• How to lodge an internal appeal, a complaint with the Regulator, or apply to court against a decision by the IO of a public body, a decision on internal appeal, a decision by the Regulator, or a decision of the head of a private body.
• Insight into how PAIA has been amended following the implementation of POPIA.

The guide can also be obtained:

• Upon request to the IO: Request for a Copy of the Guide from an Information Officer [Regulation 3].
• From the website of the Regulator: www.inforegulator.org.za.
• From the offices of the Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, or by email: enquiries@inforegulator.org.za.

A copy of the guide is also available in the following three official languages, for public inspection during normal office hours:

• English
• Afrikaans
• Zulu

5. Latest Notices in terms of Section 52(2) of PAIA

At this stage, no notice(s) has/have been published on the categories of records that are available without having to request access to them in terms of PAIA.

6. Availability of Certain Records in terms of PAIA

Categories of records available without a person having to request access

Records / subjects available in accordance with any other legislation

Records kept as required by PAIA and POPIA

• PAIA records: PAIA Manual, official guides, submission records, and awareness training materials.
• POPIA records: Information Officer registration certificate, data breach records, retention records, and awareness training materials.
• Other relevant information may also be made available on request.

The tabulated records may be requested; however, it should be noted that there is no guarantee that the request will be honoured. Each request will be evaluated in terms of PAIA and any other applicable legislation.

7. Request Process

An individual who wishes to place a request must comply with all the procedures laid down in PAIA:

1. Initiating the request

Use the prescribed form. All requests must be made on the prescribed form (Form 2 – Request for Access to Record [Regulation 7]) – Request for Access to Record [Regulation 7].

Additional prescribed forms include:

• Form 2 – Request for Correction or Deletion (section 24 of POPIA). Used by a data subject to request the correction of inaccurate, outdated, incomplete, irrelevant, or misleading personal information, and/or the deletion or destruction of personal information that is no longer necessary or unlawfully obtained, in accordance with section 24(1) of POPIA. – Form link
• Form 3 – Application for a Code of Conduct (section 61 of POPIA). Used by an industry body, profession, or class of entities to apply for the issuance of a Code of Conduct under section 61(1)(b) of POPIA. – Form link
• Form 4 – Request for Consent for Direct Marketing (section 69 of POPIA). Enables a responsible party to formally request a data subject’s consent to receive direct marketing communications via unsolicited electronic means (e.g. SMS, email), as required under section 69(2) of POPIA. – Form link
• Form 5 – Complaint Regarding Interference with Personal Information. Allows a data subject or complainant to submit a complaint to the Regulator concerning unlawful interference with personal information, or a determination made by an adjudicator under POPIA. – Form link

Requests not submitted on the prescribed form may be rejected.

Assistance in the request process:

• If a requester is illiterate or disabled, they may make the request orally to the IO, who must complete the prescribed form on their behalf and provide them with a copy (section 18(3) of PAIA).
• The IO must provide reasonable assistance to any requester who requires help in completing the form or understanding the procedure.

2. Particulars of the request

The request must provide sufficient detail to enable the IO to identify and process it. This includes:

• A clear description of the record(s) requested.
• Full identity of the requester, with proof of identity where required.
• The preferred form of access (inspection, copy, electronic copy, etc.).
• The requester’s contact details (postal, physical, fax or email).
• A statement that the record is required to exercise or protect a right, specifying the nature of that right and explaining why the record is necessary.
• If a request is made on behalf of another person, proof of authorisation must be attached.

3. Submission of requests

The completed form, together with proof of payment of the prescribed request fee (if applicable), must be submitted to the Information Officer (IO) at the Company. Requests may be lodged by:

• Hand delivery to the physical address provided in this Manual;
• Postal delivery to the Company’s registered address;
• Fax; or
• Email to the address of the IO or DIO.

Where applicable, the IO may require a deposit in terms of section 22(2) of PAIA where search and preparation is expected to be time-consuming.

4. Fees and timeframes for response

• Requests will be processed and responded to within 30 (thirty) calendar days of receipt.
• In terms of section 26 of PAIA, the IO may extend this period once, by up to 30 additional days, if: the request involves a large number of records; consultation with third parties is required; or the records are located in another office and cannot reasonably be obtained within 30 days.
• If an extension is required, the requester will be notified in writing, with reasons for the extension.
• A request fee may be charged for non-personal requests.
• If the search and preparation of the record will exceed six (6) hours, the requester may be required to pay a deposit of up to one-third of the estimated fee.
• Access will only be granted once all required fees have been paid.

5. Outcome of request

The IO will notify the requester in writing, using Form 3 – Outcome of Request and of Fees Payable [Regulation 8], of the decision to grant or refuse access.

• If access is granted, the notice will specify the form of access and state the applicable access fees payable before access is given.
• If access is refused, the notice will set out the grounds for refusal as provided in Chapter 4 of PAIA.

6. Appeals and complaints

If access is refused or deemed refused (i.e. no decision within the prescribed period), the requester may:

• Lodge an internal appeal (for public bodies); or
• Refer the matter to the Information Regulator or approach a court of law (for private bodies).

The Regulator can be contacted using the details provided in this Manual.

8. Grounds for Refusal

In terms of Chapter 4 of PAIA, the Company may refuse a request for access to records on the following grounds (unless an exception applies):

• Privacy of individuals – To protect the personal information of a third party (including deceased persons) where disclosure would be unreasonable.
• Commercial interests of third parties – Records may be refused if they contain:
  • Trade secrets;
  • Financial, commercial, scientific, or technical information, where disclosure could cause harm; or
  • Information provided in confidence, where disclosure could disadvantage or prejudice the third party in negotiations or competition.
• Confidentiality agreements – Information that is protected under a contract or agreement with a third party.
• Safety and security – Records that could endanger the life, health, or safety of a person, or the protection of property.
• Legal privilege – Records that would be privileged from disclosure in legal proceedings.
• Commercial interests of the Company – Records may be refused if they contain:
  • Trade secrets;
  • Financial, commercial, scientific, or technical information that could harm the Company’s interests;
  • Information that could prejudice the Company in negotiations or competition; or
  • Proprietary computer programs protected by copyright or intellectual property law.
• Research information – Where disclosure would place ongoing research or a researcher at a serious disadvantage.
• Frivolous or unreasonable requests – Requests that are clearly frivolous, vexatious, or that would cause an unreasonable burden on Company resources.

9. Remedies Should a Request be Refused

• If the Company does not have an internal appeal procedure in light of a denial of a request, decisions made by the IO are final.
• The requestor may, in accordance with sections 56(3)(c) and 78 of PAIA, apply to a court for relief within 180 (one hundred and eighty) days of notification of the decision for appropriate relief.

10. Fees

The following fees shall be payable upon request by a requestor:

11. Processing of Personal Information

The Company processes personal information in accordance with the conditions for lawful processing as set out in the Protection of Personal Information Act, 4 of 2013 ("POPIA"). Personal information is processed only for legitimate business purposes, which may include (but are not limited to):

• Employment-related purposes: Recruitment, administration of employment contracts, payroll, benefits, training, and compliance with labour laws.
• Client and supplier management: Entering into and performing contracts, maintaining relationships, processing payments, and responding to queries or complaints.
• Legal and compliance obligations: Compliance with statutory and regulatory requirements, record keeping, audits, and reporting.
• Security and risk management: Protecting company property, monitoring access, preventing fraud, and ensuring the safety of staff, clients, and visitors.
• Marketing and communication: Providing information about products or services, subject to obtaining the necessary consent under POPIA.

The Company ensures that personal information is processed lawfully, reasonably, and only for the purposes for which it was collected, and takes appropriate steps to protect the confidentiality and integrity of such information.

Categories of data subjects and related personal information

The Company processes personal information relating to various categories of data subjects. The categories of data subjects, and the types of personal information that may be processed in respect of each, include (but are not limited to) the following:

12. Recipients or Categories of Recipients to whom the Personal Information may be Supplied

Personal information held by the Company may be disseminated to third parties only when lawful and necessary for business, contractual, or regulatory purposes. Categories of personal information and possible recipients include (but are not limited to):

13. Planned Transborder Flows of Personal Information

The Company may, where necessary and lawful, transfer or store personal information outside the Republic of South Africa. This could include, for example, the use of secure cloud-based service providers or international business partners. Where no transborder transfer is required, personal information will continue to be stored and processed within South Africa.

Any cross-border transfer of personal information will only take place in accordance with section 72 of POPIA, which requires that:

• The recipient country, organisation, or international organisation is subject to a law, binding agreement, or corporate rules that provide an adequate level of protection; or
• The transfer is necessary for the performance of a contract, with the consent of the data subject, or for another lawful reason recognised by POPIA.

14. Availability of the PAIA Manual

A copy of the manual is available:

• On the website or at any head office for public inspection during normal business hours;
• To any person upon request and upon the payment of a reasonable prescribed fee; and
• To the Information Regulator upon request.

A fee for a copy of the manual, as contemplated in the Regulations, shall be payable per each A4-size photocopy made.

15. Objection to the Processing of Personal Information by a Data Subject

• Any person ("data subject") has the right to object to the processing of their personal information in terms of section 11(3) of POPIA.
• An objection must be made on Form 1 – Objection to the Processing of Personal Information or a similar form. This is free of charge and can be sent by hand, post, fax, email, SMS, WhatsApp, or any other convenient method.
• When personal information is collected, the Company must inform the data subject of their right to object.
• If an objection is made by phone, the Company must record it electronically and provide a copy or written transcript to the data subject on request, at no cost.

16. Request for Correction / Deletion of Personal Information

A data subject has the right, under section 24 of POPIA, to request the correction, destruction, or deletion of their personal information at any time and free of charge. Correction or deletion may be requested if the personal information is:

• Inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained; or
• No longer lawfully permitted to be kept by the Company.

Requests must be made using Form 2 – Request for Correction or Deletion of Personal Information or a similar form. This can be submitted free of charge by hand, post, fax, email, SMS, WhatsApp, or any other convenient method.

• If a request is made by phone, the Company must record it electronically and provide a copy or written transcript to the data subject on request, at no cost.
• The Company must respond within 30 days of receiving the request and notify the data subject in writing of the outcome and any action taken.

17. Applicable Forms

PAIA Forms

• Form 01: Request for a Copy of the Guide from an Information Officer [Regulation 3]
• Form 02: Request for Access to Record [Regulation 7]
• Form 03: Outcome of Request and of Fees Payable [Regulation 8]
• Form 05: Complaint Form [Regulation 10]
• Form 13: PAIA Request for Compliance Assessment Form [Regulation 14(1)]

POPIA Forms

• Form 1: Objection to the Processing of Personal Information
• Form 2: Request for Correction or Deletion of Personal Information
• Form 3: Application for the Issue of a Code of Conduct
• Form 4: Application for Consent for Direct Marketing
• Form 5: Complaint Regarding Interference with the Protection of Personal Information

18. Updating of the Manual

The head of the Company will update this manual on a regular basis.