PAIA Manual

1. Introduction

This Manual has been prepared by Infotech Solutions in accordance with Section 51 of PAIA.

PAIA gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of a right.

This Manual describes the records held by Infotech Solutions, how those records may be requested, the circumstances in which access may be granted or refused, and the information-governance measures applicable to personal information processed by the organisation.

2. Organisation Details

Organisation: Infotech Solutions
Trading Structure: A division of Infotech Enterprise
Company Registration Number: 2020/190559/07
Organisation Type: Private Body
Location: Pretoria, South Africa
Website: https://infotechenterprise.com

3. Head of the Private Body and Information Officer

Name: Kgaogelo MM Madileng
Position: Information Officer
Information Officer Registration Number: 2026-024619
Company Registration Number: 2020/190559/07
Email: [email protected]

PAIA requests and matters relating to access to records should be directed to the Information Officer using the contact details above.

4. Purpose of this Manual

The purpose of this Manual is to:

• describe the records held by Infotech Solutions;
• identify categories of records that may be accessed under PAIA;
• explain the procedure for submitting a request for access;
• identify records available in terms of other legislation;
• describe the grounds on which access may lawfully be refused;
• provide information required under POPIA concerning the processing of personal information; and
• provide contact details for the Information Officer and Information Regulator.

5. Guide on How to Use PAIA — Section 10

The Information Regulator has published a guide contemplated in Section 10 of PAIA to assist members of the public in exercising their rights under the Act.

The guide contains information about the objectives of PAIA, how to make a request for access to records, applicable forms and fees, available remedies, and the functions of the Information Regulator.

The guide and prescribed PAIA forms may be obtained from the Information Regulator:

Information Regulator (South Africa)
Website: https://inforegulator.org.za
PAIA Forms: https://inforegulator.org.za/paia-forms/
Telephone: 010 023 5200

6. Records Automatically Available

Certain information may be made publicly available without a formal PAIA request, including information published on Infotech Solutions' website or otherwise intentionally released for public access.

Such information may include:

• company and service information published on the website;
• public legal notices and policies;
• public contact information;
• marketing and corporate communications intended for public distribution;
• published capability, service and governance information; and
• other records voluntarily made available by Infotech Solutions.

The inclusion of a category in this section does not mean that every record falling within that category is automatically available.

7. Records Available in Terms of Other Legislation

Where applicable to Infotech Solutions and its operations, records may be created, retained or made available in accordance with legislation including:

• Companies Act 71 of 2008;
• Protection of Personal Information Act 4 of 2013;
• Promotion of Access to Information Act 2 of 2000;
• Electronic Communications and Transactions Act 25 of 2002;
• Income Tax Act 58 of 1962;
• Value-Added Tax Act 89 of 1991;
• Tax Administration Act 28 of 2011;
• Basic Conditions of Employment Act 75 of 1997;
• Employment Equity Act 55 of 1998;
• Labour Relations Act 66 of 1995;
• Unemployment Insurance Act 63 of 2001;
• Occupational Health and Safety Act 85 of 1993; and
• other legislation applicable to Infotech Solutions' business activities.

The presence of legislation in this list does not mean that every record created under that legislation is automatically accessible. Access remains subject to PAIA and any other applicable legal restrictions.

8. Categories of Records Held

Infotech Solutions may hold records relating to the following subjects:

Corporate and Statutory Records

• company registration and governance records;
• statutory registers and corporate records;
• company policies and governance documentation;
• insurance and administrative records;
• supplier and procurement records; and
• business planning and management records.

Governance, Risk and Compliance Records

• governance policies and frameworks;
• risk assessments and risk registers;
• compliance assessments and control documentation;
• audit and assurance records;
• privacy and information-governance documentation;
• security policies, standards and procedures; and
• regulatory and governance correspondence.

Client and Engagement Records

• client agreements and statements of work;
• project plans and delivery records;
• technical and governance assessments;
• architecture and implementation documentation;
• client correspondence;
• service-management records; and
• project evidence and assurance records.

Technology and Security Records

• technology architecture documentation;
• cloud and infrastructure configuration records;
• identity and access-control documentation;
• security-control records;
• system inventories and asset records;
• security monitoring and incident records;
• business continuity and resilience documentation;
• data architecture and governance records; and
• AI governance and security documentation.

Financial and Tax Records

• accounting and bookkeeping records;
• invoices and payment records;
• tax records and statutory submissions;
• banking and financial administration records; and
• procurement and supplier financial records.

Human Resources Records

• employee and contractor records;
• employment agreements;
• recruitment and applicant records;
• training and professional-development records;
• performance and operational records; and
• employment-related statutory records.

Communications and Operational Records

• business correspondence;
• website enquiries;
• internal operational procedures;
• service communications;
• marketing records; and
• records relating to suppliers, partners and other stakeholders.

9. Right of Access to Records of a Private Body

A person requesting access to a record of Infotech Solutions must satisfy the requirements of Section 50 of PAIA.

In general, a requester must demonstrate that:

• the requested record is required for the exercise or protection of a right;
• the procedural requirements of PAIA have been complied with; and
• access is not subject to a lawful ground of refusal.

The submission of a request does not create an automatic right of access. Each request will be assessed in accordance with PAIA.

10. Request Procedure

A request for access to a record must be submitted using the prescribed Form 2: Request for Access to Record.

The request should provide sufficient detail to enable Infotech Solutions to identify:

• the requester;
• the record or category of records requested;
• the form in which access is required;
• the right the requester seeks to exercise or protect;
• why the requested record is required for that purpose; and
• where applicable, the authority of the requester to act on behalf of another person.

The completed Form 2, together with proof of identity, proof of authority where applicable and any prescribed fee where required, should be submitted to:

Information Officer
Email: [email protected]

11. Fees

Fees applicable to a PAIA request are determined in accordance with PAIA and the applicable Regulations.

A prescribed request fee may be payable by a requester other than a personal requester before the request is processed, unless an exemption applies.

Where access is granted, additional access fees may be payable in respect of reproduction, preparation, search time, delivery or other prescribed costs.

Where required, the requester will be notified of the applicable amount before access is provided.

12. Decision on a Request

Infotech Solutions will consider requests in accordance with PAIA and will notify the requester whether access has been granted or refused.

Where a request is refused, the requester will be informed of the applicable grounds for refusal and available remedies, subject to the requirements of PAIA.

Where additional time is reasonably required to process a request, the period may be extended where PAIA permits such an extension.

13. Grounds for Refusal

Access to a record may or must be refused where a ground contemplated in Chapter 4 of Part 3 of PAIA applies.

Depending on the circumstances, this may include the protection of:

• the privacy of a third party who is a natural person;
• commercial information or trade secrets of a third party;
• confidential information supplied by a third party;
• the safety of individuals and protection of property;
• records privileged from production in legal proceedings;
• commercial information of Infotech Solutions;
• research information;
• cybersecurity architecture, security configurations and sensitive technical controls where disclosure could create a material security risk; and
• information otherwise protected from disclosure by law.

Where only part of a record is protected, Infotech Solutions will consider whether access may lawfully be provided to the remainder of the record in accordance with PAIA's severability requirements.

14. Public Interest Override

A record that would otherwise be subject to a ground of refusal may nevertheless be required to be disclosed where the public-interest requirements in Section 70 of PAIA are satisfied.

Requests involving potentially protected records will therefore be assessed against both the applicable ground of refusal and any mandatory public-interest disclosure requirement.

15. POPIA — Purpose of Processing Personal Information

Infotech Solutions processes personal information for legitimate and lawful operational purposes, which may include:

• responding to business and service enquiries;
• concluding and managing contractual engagements;
• delivering governance, cybersecurity, cloud, data and AI services;
• managing client, supplier, employee and stakeholder relationships;
• administering procurement, finance and business operations;
• maintaining security, governance and audit records;
• protecting information systems and digital environments; and
• meeting legal, regulatory and contractual obligations.

16. Categories of Data Subjects and Personal Information

Categories of Data Subjects may include:

• clients and prospective clients;
• employees, contractors and applicants;
• suppliers and service providers;
• business partners;
• website users and individuals submitting enquiries;
• professional and regulatory stakeholders; and
• other individuals whose information is processed in connection with legitimate business activities.

Categories of personal information may include:

• identity and contact information;
• professional and employment information;
• organisational and business information;
• contractual and engagement information;
• financial and administrative information;
• technical and security-related information;
• website and communications data; and
• other information lawfully required for a defined processing purpose.

17. Recipients of Personal Information

Personal information may, where lawfully required and appropriate, be supplied to categories of recipients including:

• authorised Infotech Solutions personnel and contractors;
• clients where information forms part of an authorised engagement;
• cloud, technology and infrastructure service providers;
• professional advisers, auditors and assurance providers;
• financial, accounting and administrative service providers;
• regulators, public authorities or law-enforcement bodies where disclosure is legally required; and
• other authorised Operators or service providers acting under appropriate contractual arrangements.

18. Transborder Flows of Personal Information

Infotech Solutions may make use of global cloud, technology and service-provider environments that involve the transfer or processing of personal information outside South Africa.

Such transfers are governed in accordance with Section 72 of POPIA. Where cross-border processing occurs, Infotech Solutions considers applicable transfer safeguards, data residency, processing location, contractual protections and access arrangements.

19. Information Security Measures

Infotech Solutions maintains appropriate technical and organisational measures designed to protect the confidentiality, integrity and availability of personal information.

Depending on the processing environment and associated risk, these may include:

• identity and access management;
• least-privilege and role-based access controls;
• privileged-access management;
• multi-factor authentication;
• encryption and key-management controls;
• information classification and protection;
• Data Loss Prevention;
• security monitoring, logging and threat detection;
• vulnerability and configuration management;
• secure cloud and network architecture;
• incident-management procedures;
• business continuity and resilience measures; and
• governance, policy and administrative safeguards.

These safeguards are applied according to the nature and sensitivity of information processed, reasonably foreseeable threats and applicable legal, contractual and governance requirements.

20. Availability and Updating of this Manual

This Manual is made available on the Infotech Solutions website and will be reviewed and updated periodically where organisational, legal, regulatory or processing requirements materially change.

A copy may also be requested from the Information Officer.

21. Complaints and Remedies

A requester who is dissatisfied with the handling or outcome of a PAIA request may exercise the remedies available under PAIA, including submitting a complaint to the Information Regulator or, where appropriate, approaching a competent court.

Information Regulator (South Africa)
Website: https://inforegulator.org.za
Telephone: 010 023 5200