PAIA Manual

Private Body Manual in terms of section 51 of PAIA

Version 1.0 | Date of compilation: 02 October 2026 | Date of revision: 02 October 2026

1. List of acronyms and abbreviations

2. Purpose of this PAIA Manual

This Manual is prepared for SAS Consulting as a private body in accordance with section 51 of PAIA. It is intended to help a person understand what categories of records SAS Consulting holds, which records may be available without a formal request, how to make a request for access, and where to obtain assistance.

The Manual also describes the processing of personal information by SAS Consulting, the categories of data subjects, possible recipients of personal information, potential transborder processing, and the general security measures used to protect information.

3. Key contact details for access to information

No Deputy Information Officer is currently designated. SAS Consulting is a sole proprietorship, and the Information Officer is the owner and head of the private body.

4. Guide on how to use PAIA

The Information Regulator publishes a Guide on how to use PAIA and provides current PAIA forms and related resources. A requester may obtain the Guide and current forms from the Information Regulator website or request assistance from the SAS Consulting Information Officer.

Information Regulator PAIA resources: https://inforegulator.org.za/paia/

Current PAIA forms: https://inforegulator.org.za/paia-forms/

The current private-body template published by the Information Regulator is used as the structural benchmark for this Manual.

5. Categories of records available without a formal request

The following records are intended to be accessible without a formal PAIA request where they are current and appropriate for public disclosure:

• SAS Consulting website pages describing services and business information.
• Current Privacy Notice.
• Current PAIA Manual.
• Public contact details and service descriptions.
• Publicly issued marketing or informational material published by SAS Consulting.

Certain records may also be made available upon written request where disclosure is lawful and appropriate. Nothing in this section overrides statutory grounds for refusal, confidentiality duties, contractual restrictions or the rights of third parties.

6. Records available in accordance with other legislation

SAS Consulting may create and retain records in accordance with applicable South African legislation and regulatory requirements, including, where relevant:

• Income tax and other tax records required under applicable tax legislation and SARS requirements.
• Employment and service records required under applicable labour and employment legislation, where relevant.
• Records relating to skills development and SETA submissions where SAS Consulting acts as an SDF.
• Records relating to B-BBEE and other regulatory or client compliance services.
• Records required under POPIA, PAIA and applicable Information Regulator requirements.

7. Subjects on which SAS Consulting holds records and categories of records

8. Processing of personal information

8.1 Purpose of processing personal information

SAS Consulting processes personal information to provide consulting services, communicate with clients and business contacts, prepare quotations and records, complete regulatory or client submissions, administer the business, comply with legal obligations, protect systems and records, and manage data-subject and access requests.

8.2 Categories of data subjects and information

8.3 Recipients or categories of recipients

• Authorised SAS Consulting users and administrative personnel.
• Technology/service providers used for cloud storage, email, website hosting, document transfer and related business systems, where relevant.
• B-BBEE verification agencies where required for a client service.
• Relevant SETAs and regulatory/statutory bodies for lawful submissions and compliance purposes.
• Training providers, professional advisers, accountants/bookkeepers or other service providers where necessary for an authorised business purpose.
• Clients, suppliers and other business contacts where disclosure is necessary for the agreed service or business relationship.
• Courts, regulators, SARS, law-enforcement authorities or other public bodies where disclosure is required or lawfully permitted.

8.4 Planned transborder flows of personal information

SAS Consulting uses cloud and technology services that may involve storage or processing outside the Republic of South Africa. Categories that may be affected include website enquiry information, business correspondence, client documents and other records held in cloud or technology systems. Where cross-border processing or transfer applies, SAS Consulting will assess and manage it in accordance with POPIA section 72 and other applicable requirements. Exact locations depend on the service provider and current service configuration.

8.5 General description of information security measures

• Two-factor authentication on relevant Microsoft and Gmail accounts.
• Windows login PIN protection and automatic screen locking on the main business desktop.
• Microsoft Defender / Windows Security and system updates.
• Authorised-user and access controls for business and client records.
• Recipient and attachment verification before sending information electronically.
• SSL/TLS protection for the website and secure transfer controls appropriate to the circumstances.
• VeraCrypt-encrypted external SSD used for secondary backup, stored disconnected when not in use.
• Confidentiality obligations for authorised persons handling personal or confidential information.
• Data Breach / Security Compromise Procedure and security incident management controls.

9. Requesting access to records

A requester who requires access to a record held by SAS Consulting should submit a written request to the Information Officer using the prescribed PAIA Form 02 or a substantially similar written request containing the information required by PAIA. The request should identify the record sought, provide sufficient detail to enable SAS Consulting to locate it, and identify the right that the requester seeks to exercise or protect.

1. Send the request to info@sasconsultingservices.co.za or deliver it to the business address for the attention of the Information Officer.
2. Identify the requester and provide sufficient contact details for correspondence.
3. Describe the record or category of records requested with sufficient detail to enable identification.
4. State the right the requester seeks to exercise or protect, where required for a private-body request.
5. State the preferred form of access, where applicable.
6. Provide any other information reasonably required to process the request.

10. Consideration of requests, fees and grounds for refusal

PAIA allows access to a record of a private body where the applicable requirements are met, including that the record is required for the exercise or protection of a right and that no ground for refusal applies. Access may be refused or limited where permitted by PAIA, including where records contain confidential third-party information, legally privileged material, commercially sensitive information or other information protected by law.

Where a prescribed fee or other lawful cost is applicable, the requester will be informed in accordance with PAIA and the applicable regulations before further processing to the extent required.

11. Personal information requests under POPIA

A person seeking access to their own personal information should normally use the POPIA section 23 access process. Requests for correction or deletion of personal information are handled under section 24 and the applicable prescribed form. SAS Consulting will apply its Data Subject Request Procedure (12.7) and the current Information Regulator forms.

Current POPIA forms: https://inforegulator.org.za/popia-forms/

12. Remedies and complaints

A requester or data subject may have remedies available under PAIA or POPIA, depending on the nature of the decision or processing. This may include lodging a complaint with the Information Regulator and, where applicable, seeking relief through a court. SAS Consulting will cooperate with lawful requests and regulatory processes.

13. Availability of this Manual

Once published, a current copy of this Manual will be made available on the SAS Consulting website at the address below and a controlled copy will be kept available at the business premises for public inspection during normal business hours. A copy may also be provided on request, subject to any applicable prescribed fee.

Website: https://sasconsultingservices.co.za/paia-manual.html

Website: https://sasconsultingservices.co.za/paia-manual.html

14. Updating of the Manual

SAS Consulting will review and update this Manual at least annually and whenever there is a material change to the business, its records, information processing, responsible persons, contact details or applicable PAIA/POPIA requirements.

15. Document control and approval

Signature: ________________________________________________ Date: __________________________

Current PAIA resources: Information Regulator PAIA resources | PAIA forms