In short: Section 32 of the Constitution gives everyone a right of access to information, and PAIA is the statute that operationalises it - so a private body's manual, required under section 51 (section 14 for public bodies), is not administrative housekeeping but the mechanism through which people exercise that right against the organisation. Section 51(1) requires specific content categories - contact details, how to obtain the section 10 guide, records available without a request, and the request procedure - and section 51(2) requires the manual to be kept current, though the Act sets no fixed numeric update interval. Two errors recur constantly: naming the South African Human Rights Commission rather than the Information Regulator as custodian of the section 10 guide, and citing a stale regulator address. The amended Regulation 4 now requires an Information Officer's compliance programme to be developed, implemented, monitored, maintained, and continually improved - not a one-off fix.
The request arrived on a Tuesday. A former contractor wanted every record the company held about him, and he wanted it under PAIA. The Information Officer opened the company's PAIA manual to check the procedure, and her stomach dropped. The document was four years old. It named the South African Human Rights Commission as the body to approach for guidance. It listed a postal address in Braamfontein. It described a fee structure that no longer existed. And somewhere in Johannesburg, a Regulator running own-initiative compliance assessments since April 2024 was entirely capable of asking to see exactly this document.
Transparency as a constitutional discharge
Section 32 of the Constitution gives everyone the right of access to information held by the state, and to information held by another person where that information is required for the exercise or protection of any right. PAIA is the statute that gives that right operational form. A manual is not administrative housekeeping - it is the mechanism by which a private or public body tells the world how to exercise a constitutional right against it. A manual that is technically present but practically useless does not discharge a constitutional obligation. It documents a failure to discharge one.
Two parallel duties, not one
PAIA does not impose a single manual duty - it imposes two parallel duties depending on body type, and getting the section number wrong signals to a Regulator that an organisation does not know its own statute. For a private body, the manual obligation lives in section 51. For a public body, the parallel obligation lives in section 14. They are structurally similar and numerically distinct, because public and private bodies stand in different constitutional relationships to the information they hold, and the Act keeps those relationships in separate Parts. If an organisation is a private body, section 51 is its provision, full stop.
What section 51 actually requires
Section 51(1) sets out the required content categories, and the discipline is completeness. The manual must give the postal and street address, phone number and electronic contact of the head of the body. It must describe the section 10 guide and how to obtain it. It must set out the records the body holds that are available without a formal request, and records available under any other legislation. It must describe the subjects on which the body holds records and the categories of records held under each subject. And it must set out the procedure by which a request is made, including the description required to identify records. Each category answers a question a requester would actually ask - an omission in any one of them is a defect a Regulator can name.
The update duty has no fixed deadline
Section 51(2) requires the manual to be updated on a regular basis - but it does not state a fixed numeric interval. There is no statutory "every twelve months" or "every three years" in the section. So when someone in a meeting asserts a manual is compliant because it was updated within the deadline, the correct response is to ask which deadline, because the section does not set one. The duty is a duty of currency, judged against a standard of regularity and against reality: has the information changed. If the head of the body changes, if contact details change, if the categories of records change, the trigger to update has arrived regardless of the calendar. Reading a numeric deadline into section 51(2) invents an obligation the statute does not contain, and lets a stale manual pass a test the law never set.
Who actually holds the guide
The four-year-old manual in the opening scenario made a specific and extremely common error - it named the South African Human Rights Commission as the body to approach for the section 10 guide on how to use the Act. That was once correct. It is not correct now. The Information Regulator is the body currently under the statutory obligation to compile, update and make available the section 10 guide. The Commission's role in PAIA's history is real and foundational, but it is historical. A manual still routing a requester to the Commission is routing them to the wrong door, and it tells anyone who reads it that the organisation has not looked at its own transparency instrument since custodianship moved.
Contact details that must be current
The same discipline applies to the Regulator's own details, and the trap is subtle because a wrong address can appear on genuine documents - the signature block of the 17 April 2025 gazette notice itself still carried the old Braamfontein address. The Regulator's current published contact address is 54 Maxwell Drive, Woodmead, Johannesburg, 2191, in the Woodmead North Office Park. Current telephone numbers are 010 023 5200 and the toll-free line 0800 017 160; general enquiries go to enquiries@inforegulator.org.za, and PAIA complaints specifically to PAIAComplaints@inforegulator.org.za. Do not lift an address from an old gazette signature block and assume it is current - in this instance, it is not.
The amended Regulation 4 duty to continually improve
The Amendment of the Regulations Relating to the Protection of Personal Information, 2018 - published as GN 6126 in Government Gazette 52523 on 17 April 2025 - changed Regulation 4, which sets out an Information Officer's duties and responsibilities. Former Regulation 4(1)(c) was deleted, Regulation 4(2) was deleted, and at the end of Regulation 4(1)(a), the words "and continually improved" were inserted. That insertion is small in text and large in effect. Where an Information Officer previously ensured a compliance framework was developed, implemented and monitored, the duty now reads developed, implemented, monitored, maintained and continually improved. Existence and monitoring are now the floor, not the ceiling - the manual audit is not a one-off remediation followed by silence, but a recurring cycle in which each review should leave the transparency instrument in a better state than the last.
Auditing a defective manual
Run a private-body manual against the section 51(1) checklist category by category: are the head of the body's address, phone and electronic contact present and current? Does the manual describe the section 10 guide correctly and point to the Information Regulator rather than the Commission? Are the records available without a request accurately listed? Do the subjects and categories of records reflect how things actually stand today? Is the request procedure correct? Then test the whole document against section 51(2) - given every change since the last version, has the regular-update duty been triggered and met? Finally, test the surrounding Information Officer programme against amended Regulation 4, asking not only whether a framework exists but whether it is being maintained and continually improved. That sequence turns a panicked scramble into a defensible, provision-anchored audit. When did anyone last open the PAIA manual with the statute beside it - not filed it, not referenced it in a policy register, but read it against section 51(1) line by line? Make it true, and then keep making it true.
Check whether your transparency instrument still holds up
The free POPIA Compliance Status Assessment reviews where your organisation stands across all eight conditions for lawful processing, including the transparency and openness obligations this article covers - reviewed personally by our data privacy specialists.
Start the free POPIA assessment →Frequently asked questions
It is the mechanism by which an organisation tells the world how to exercise the constitutional right of access to information under section 32 - PAIA gives that right operational form, and the manual is its practical instrument. A manual that is technically present but practically useless does not discharge that constitutional obligation; it documents a failure to discharge one.
Section 51. PAIA imposes two structurally similar but numerically distinct duties depending on body type - section 51 for private bodies, section 14 for the parallel public-body obligation - because public and private bodies stand in different constitutional relationships to the information they hold.
Section 51(2) requires the manual to be updated on a regular basis but sets no fixed numeric interval - there is no statutory 'every twelve months' in the Act. The duty is one of currency: if the head of the body, contact details, or categories of records change, the trigger to update has arrived regardless of the calendar.
The Information Regulator is the body currently under the statutory obligation to compile, update and make available the section 10 guide. The South African Human Rights Commission's role is historical - a manual that still routes requesters to the Commission for the guide is one of the most common and telling errors a Regulator can find.
The Amendment of the Regulations Relating to the Protection of Personal Information, 2018 (GN 6126, GG 52523, 17 April 2025) deleted former Regulation 4(1)(c) and Regulation 4(2), and inserted "and continually improved" at the end of Regulation 4(1)(a). A compliance framework must now be developed, implemented, monitored, maintained and continually improved - existence and monitoring alone are no longer sufficient.