1. BACKGROUND INFORMATION

Natural and juristic persons have the right to access Records held by a public or private body in terms of the Promotion of Access to Information Act (PAIA), subject to certain limitations. PAIA seeks to advance the values of transparency and accountability in relation to those Records.

The Protection of Personal Information Act (POPI) also provides natural and juristic persons (Data Subjects) with the right to request access to Personal Information, as defined in the act, by that is in the possession of others. POPI aims to safeguard Personal Information, by regulating how it is collected, used, processed, or shared.

In terms of the provisions of PAIA, private bodies are required to compile this PAIA manual (Manual) as a guide to Requestors of information. This manual further serves to indicate the categories of Records held by the Company and the availability of such Records from the Company.

2. MANUAL AND POLICY RULES

2.1 Eligibility/Applicability

This policy is applicable to all directors, office bearers, and employees of the Company. This policy is also applicable to any external natural or juristic entity that requests access to information held by the Company where such person or entity has a right to access such information and where a Data Subject requests access to, correction of or deletion of Personal Information held by the Company.

2.2 Objectives of this Manual

The objectives of this Manual are:
• To set out the requirements on how to request information in terms of PAIA and POPI
• To set out the manner and form in which an access to information request may be submitted
• To provide a list of information, Records and data held and processed by the Company.

2.3 Updates and Availability of this Manual
This Manual may be inspected at the Company’s Offices, Monday to Friday, between 08h00 to 16h00. It is also made available on the Company’s website. Alternatively, persons requiring a copy of the Manual, or a part thereof may contact the Information Officer. This Manual will be updated as per the requirements of PAIA.

2.5 Section 10 guide
The Information Regulator has developed a guide written in each of the country’s official languages, with information on how to use PAIA to access Records (Section 10 guide). This guide is available on the Information Regulators website (as set out below) or you can make contact directly.

2.6 The Information Regulator’s Contact Details:
Postal Address:     P.O Box 31533, Braamfontein, Johannesburg, 2017
Office Address:      JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
E-Mail address:     [email protected]
Telephone number:     +27 (0)10 023 5200
Website:                    www.inforegulator.org.za

2.7 Details required in terms of section 51(1)(a) of PAIA:

3. DEFINITIONS

3.1 Company means Mkabayi Advisory (Pty) Ltd (Mkabayi Advisory) a private, South African profit company that is 100% black female owned and controlled.
3.2 Consent means any voluntary, specific and informed expression of will in terms of which permission is given for the Processing of Personal Information
3.3 Data Subject means the person to whom Personal Information relates as defined by POPI
3.4 Information Officer means the person appointed by the Company in the role of Information Officer as envisaged by POPI and PAIA
3.5 Information Regulator means the regulator established as a juristic person as in terms of Section 39 of POPI
3.6 Manual means this manual together with any or all of its annexures
3.7 Operator means a person or entity who processes Personal Information for a Responsible Party in terms of a written contract or other mandate
3.8 PAIA means the Promotion of Access to Information Act 2 of 2000, as amended
3.9 Personal Information means any information that can be used to reveal a natural or juristic person’s identity and has the same meaning as defined in the Promotion of Access to Information Act 4 of 2013, as amended
3.10 POPI means the Promotion of Personal Information Act 4 of 2013, as amended
3.11 Process / Processing means any operation or activity comprising any individual or set of actions, whether by automated or other means that directly or indirectly relates to or makes use of Personal Information, including, without limitation:
• the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use
• dissemination by means of transmission, distribution or making available in any other form or
• merging, linking, as well as restriction, degradation, erasure or destruction of information
3.12 Record means any recorded material containing information
• regardless of the form or medium
• in the possession or under the control of the Company
• irrespective of whether it was created by the Company
3.13 Responsible Party means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for Processing Personal Information
3.14 Requestor means any person making a lawful request for access to a Record of the Company or a person acting on behalf of such person (and does not include a Data Subject who requests Records of his or her own Personal Information)
3.15 Request means a lawful request for access to a Record of the Company in accordance with this Manual

4. STATUTORY RECORDS

The Company only keeps the statutory Records that it is required to keep in terms the applicable legislation, such as the:

• Basic Conditions of Employment Act, 75 of 1997
• Broad-Based Black Economic Empowerment Act, 53 of 2003
• Companies Act, 71 of 2008
• Compensation for Occupational Injuries and Diseases Act, 130 of 1993
• Electronic Communications and Transactions Act, 25 of 2002
• Employment Equity Act, 55 of 1998
• Income Tax Act, 58 of 1962
• Labour Relations Act, 66 of 1995
• Occupational Health and Safety Act, 85 of 1993
• Pension Funds Act, 24 of 1956
• Prevention and Combating of Corrupt Activities Act, 12 of 2004
• Prevention of Organised Crime Act, 21 of 1998
• Promotion of Access to Information Act, 2 of 2000
• Protection of Democracy and Terrorist and Related Activities Act, 83 of 2004
• Promotion of Equality and Prevention of Unfair Discrimination Act, 4 of 2000
• Protection of Personal Information Act, 4 of 2013
• Short Term Insurance Act, 53 of 1998
• Skills Development Act, 97 of 1997
• Skills Development Levies Act, 9 of 1999
• South African Reserve Bank Act, 90 of 1989
• Trademarks Act, 194 of 1993
• Unemployment Insurance Act, 63 of 2001
• Unemployment Insurance Contributions Act, 4 of 2002
• Value Added Tax Act, 89 of 1991
As they may be amended from time to time.

5. OTHER INFORMATION THAT MAY BE COVERED IN FUTURE

The Minister has the power to publish a notice prescribing further information that must be disclosed in terms of PAIA – Section 51(1) (f) of PAIA.

6. CATEGORIES OF RECORDS THE COMPANY MAY PROCESS

A list of some of the Records that may be held by the Company is attached at Annexure A.

6.1 Other Information available on the Company’s website from time to time:
• Privacy Notice
• This Manual
• B-BBEE Records?
• Cookie Policy ? For website?
• Terms of Use Policy ?.For website content?

6.2 Records that may be requested from the Company:
• Records in terms of applicable legislation or regulatgion
• Personal Information the Company collects, processes or keeps
• Records of a public nature that the Company collects, processes or keeps

6.3 Record retention periods:
• Records are kept for as long as they are required to achieve the legitimate purpose for which the information was obtained, unless required for such longer period as required under legislation, or where the Records are required to be retained for historical purposes, or if the Records are required for lawful purposes related to the functions or activities of the Company. Records may in certain circumstances be kept indefinitely, in order for the comply to comply with legislative obligations.
• Records retained for longer than required to achieve the legitimate purpose for which the information was collected will be archived with restricted access and with appropriate safeguards ensuring that information is not processed without the relevant approvals or Consent.

6.4 Updating Records
• A Data Subject is responsible to advise the Company of any changes in Personal Information and shall advise the Company of such changes or updates to Records as they occur.
• Clients of the Company are required to update any Records held by the Company in relation to their Personal Information on at least an annual basis or at such point in time when the Records may change.
• Clients are responsible for the accuracy and integrity of data and Records that is submitted to the Company either through Company portals made available to the Client, or through emails or other methods of data transfer.

7. RIGHT TO ACCESS INFORMATION

7.1 You have the right to access the Company’s Records if:

• The purpose is for exercising or protecting a Data Subject’s or a Requestor’s right, and
PAIA Manual | Page 6
• The Data Subject or Requestor has complied with the procedure set out by the Company in this Manual, and
• The Company does not have legal or legitimate legal grounds for refusing access to the Records.

7.2 In terms of POPI, a Data Subject may, subject only providing proof of identity, request the Responsible Party to confirm (free of any fee or charge) all information that the Responsible Party has in its possession pertaining to the Data Subject.

7.3 Subject to paying the prescribed fee(s) a Requestor may also request access such information (which includes information about the identity of any third-parties who have or may have had accessed to the Data Subjects Personal Information while in the possession or under the control of the Company

8. PROCEDURE TO REQUEST INFORMATION

8.1 Any Request to access to any Record(s) held by the Company must be accompanied with a correctly filled out and duly executed request in the form of (or in exceptional circumstances, as close as is reasonably possible to) that set out in Annexure B.

8.2 The request form must be addressed to the Information Officer using the contact details set out in Annexure B or the further details per 2.6 above.

8.3 Any request which fails to comply with the requirements of this manual will be referred to the Data Subject or Requestor, with direction on the requisite information to be provided or forms to be completed.

8.4 The Information Officer shall respond to the request for information within thirty (30) days of receiving the request in the prescribed from.

8.5 The Information Officer shall respond to the Data Subject or Requestor (and provide the requested documents) according to the manner of transmission or communication specified in the Request. n question. application, which will then be deemed to have been received or collected by the Requestor.

9. PRESCRIBED FEES

9.1 As set out in POPI, Data Subjects is not required to pay the request fee. Every other Requestor must pay the required request fee of R50.00 to the Company to have the application considered.
9.2 If the Request is successful, then further fee(s) may be payable by the Requestor for the search, reproduction, preparation of the Records, and for any time that has exceeded the prescribed hours to search and prepare the Record(s) for disclosure. The Company shall inform the Requestor of such fee(s) by written notice, which shall specify the additional fee(s) or deposit(s) required to be paid.
9.3 The liability of a Requestor to pay the prescribed fee(s) may only be challenged on application via Court. However, as indicated below, the Company may, at its sole and absolute discretion, waive or relax any fee(s) owed by any Requestor setting out any sufficiently compelling justification in writing.
9.3 For all purposes contemplated in this Manual the Company will accept payment of the prescribed fee(s) as recorded in the Government Gazette as at 2022-23 as follows:

10. SUCCESSFUL REQUESTS 

10.1 The Information Officer shall decide whether to accede to the Request(s) within 30 business days of receipt and will notify the Data Subject or Requestor of the outcome – accompanied with written reasons to that effect, if requested in writing, and subject only to reasonable advance notice and payment of the prescribed fee(s).

10.2 The period of 30 business days referred to in 10.1 above may be extended for a further period of not more than 30 days if the required Record(s) or Requested form are not readily available at the point that the Request was submitted to the Company.

10.3 The Information Officer will notify the Data Subject or Requestor in writing should an extension of time as contemplated in 10.2 above be necessary to locate, compile, or format the Record(s) in question.

11. UNSUCCESSFUL REQUESTS 

Upon refusal of any Request(s) the Information Officer will inform the Data Subject or Requestor of the reasons for the refusal of access in line with Chapter 4 of PAIA. The Data Subject or Requestor, as the case may be, will enjoy the right to appeal under the process set out in

12. OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION BY A DATA SUBJECT         

Where the Company holds Personal Information in respect of any Data Subject, such Data Subject may object, in writing and to the Information Officer to the Processing or further Processing of Personal Information. Such an objection shall be in the prescribed form as set out in Annexure C.

13. REQUEST FOR CORRECTION, DELETION OR DESTRUCTION OF PERSONAL INFORMATION BY A DATA SUBJECT

13.1 Where any Data Subject has lawfully obtained or accessed Personal Information under the provisions of POPI, then the Data Subject will also be entitled to insist on the correction, deletion, or destruction of Personal Information provided by the Company, subject to any conditions prescribed by POPI, PAIA, and/or this Manual.

13.2 Any Request(s) contemplated in 13.1 above shall be made to the Company’s Information Officer, accompanied with correct and accurate information set out in the prescribed form per Annexure D hereto.

13.3 Any valid Request(s) by a Data Subject for the correction, deletion or destruction Personal Information provided by the Company shall be adhered to within 14 calendar days of receipt any valid Request(s) to that effect.