PAIA — PAIA Manual: Information Regulator PAIA Manual (English, Updated November 2023) (source: https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Manual-NOV-2023-English-Updated.docx.pdf) DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 PAIA MANUAL Prepared in terms of section 14 of the Promotion of Access to Information Act 2 of 2000, as amended NOVEMBER 2023 (UPDATED) DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 TABLE OF CONTENTS 1. DEFINITIONS AND INTERPRETATIONS .................................................................... 4 2. LIST OF ACRONYMS AND ABBREVIATIONS .......................................................... 10 3. INTRODUCTION ........................................................................................................ 11 4. PURPOSE OF PAIA MANUAL ................................................................................... 12 5. ESTABLISHMENT OF THE INFORMATION REGULATOR ....................................... 13 6. STRUCTURE OF THE INFORMATION REGULATOR .............................................. 14 7. POWERS, DUTIES AND FUNCTIONS OF THE REGULATOR ................................. 18 8. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION OF THE INFORMATION REGULATOR ............................................................................................................. 25 9. REMEDIES AVAILABLE IF PROVISIONS OF PAIA ARE NOT COMPLIED WITH OR IN RESPECT OF AN ACT OR A FAILURE TO ACT BY THE REGULATOR .............. 26 10. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS THE GUIDE ....... 30 11. CATEGORIES OF RECORDS HELD BY THE INFORMATION REGULATOR .......... 33 13. PROCEDURE FOR ACCESS TO RECORDS HELD BY THE INFORMATION REGULATOR ............................................................................................................. 40 14. SERVICES AVAILABLE TO MEMBERS OF THE PUBLIC FROM THE INFORMATION REGULATOR AND HOW TO GAIN ACCESS TO THOSE SERVICES ...................... 45 15. PUBLIC INVOLVEMENT IN THE FORMULATION OF POLICY AND THE EXERCISE OF POWERS OR PERFORMANCE OF DUTIES BY THE INFORMATION REGULATOR ............................................................................................................. 46 16. PROCESSING OF PERSONAL INFORMATION ....................................................... 47 17. PRESCRIBED FEES .................................................................................................. 52 18. AVAILABILITY OF THE MANUAL .............................................................................. 52 19. RECORDS THAT CANNOT BE FOUND OR DO NOT EXIST .................................... 53 20. DISPOSAL OF RECORDS......................................................................................... 53 21. UPDATING OF THE MANUAL ................................................................................... 54 DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FOREWORD BY THE CEO The Information Regulator (Regulator), in compliance with the Promotion of Access to Information Act 2 of 2000, as amended1 (PAIA), has prepared this PAIA Manual (which Manual must be read in conjunction with the Guide on how to use PAIA) to facilitate the public’s access to information held by the Regulator. One of the basic values and principles governing public administration is transparency. The Constitution of the Republic of South Africa Act 108 of 1996 (Constitution) demands that transparency must be fostered by providing the public with timely, accessible and accurate information. The aim of PAIA is to foster a culture of transparency and accountability by public and private bodies and assist in realising South Africa’s goals of an open and participatory democracy. PAIA also gives effect to the right of access to information and actively promotes a society in which any person has effective access to information. This will enable any person to fully exercise their rights. In promoting a culture of transparency and accountability in public and private bodies, the Regulator acknowledges that there are limitations2 within the overall promotion of good governance through transparency. Such limitations are acknowledged within the provisions of PAIA and the Protection of Personal Information Act 4 of 2013 (POPIA), as it specifies circumstances under which there would be limited or restricted access to the information held by the Regulator. The limitations will balance the right of access to information with other rights contained in the Bill of Rights. In accordance with the Regulator’s obligation in terms of the Constitution and PAIA, the Regulator may be compelled, despite the existence of the grounds for refusal of access to records, to grant a request for access to a record of the Regulator, if the disclosure of the record would reveal evidence of a substantial contravention of, or failure to comply with the law, and the public interest in the disclosure of the record clearly outweighs the harm contemplated in any of the grounds for refusal of access to records. ……………………………………………… Mr Mosalanyane Mosala 1Promotion of Access to Information Amendment Act, 2002, Protection of Personal Information Act, 2013 and Promotion of Access to Information Amendment Act, 2019 2 Grounds for refusal of access to records, sections 33-46 of PAIA DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHIEF EXECUTIVE OFFICER 1. DEFINITIONS AND INTERPRETATIONS 1.2 Definition 1.1.1 “Access fee” means a fee prescribed for the purposes of section 22(6) or 54(6), as the case may be; 1.1.2 ‘‘Data subject’’ means the person to whom personal information relates; 1.1.3 “Deputy Information Officer” means the designated individual in the public or private body who is responsible for assisting the Information Officer with the PAIA Request; 1.1.4 “Guide” means the guide on how to use PAIA by any person who wishes to exercise any right contemplated in Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 04 of 2013, as contemplated in section 10 of PAIA; 1.1.5 “Head” of, or in relation to, a private body means- (a) in the case of a natural person, including a person referred to in paragraph (c) of the definition of “political party”, that natural person or any person duly authorised by that natural person; (b) in the case of a partnership, any partner of the partnership or any person duly authorised by the partnership; (c) in the case of a juristic person- (i) the chief executive officer or equivalent officer of the juristic person or any person duly authorised by that officer; or (ii) the person who is acting as such or any person duly authorised by such acting person; or DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 (d) in the case of political party, the leader of the political party or any person duly authorised by that leader; 1.1.6 “Human Rights Commission” means the South African Human Rights Commission referred to in section 181 (1) (b) of the Constitution; 1.1.7 “Information Officer” In relation to, a public body- (a) in the case of a national department, provincial administration or organisational component- (i) mentioned in Column 1 of Schedule 1 or 3 to the Public Service Act, 1994 (Proclamation 103 of 1994), means the officer who is the incumbent of the post bearing the designation mentioned in Column 2 of the said Schedule 1 or 3 opposite the name of the relevant national department, provincial administration or organisational component or the person who is acting as such; or (ii) not so mentioned, means the Director-General, head, executive director or equivalent officer, respectively, of that national department, provincial administration or organisational component, respectively, or the person who is acting as such; (b) in the case of a municipality, means the municipal manager appointed in terms of section 82 of the Local Government: Municipal Structures Act, 1998 (Act 117 of 1998), or the person who is acting as such; or (c) in the case of any other public body, means the chief executive officer, or equivalent officer, of that public body or the person who is acting as such; In relation to, a private body- (d) means the head of a private body as contemplated in section 1, of the Promotion of Access to Information Act; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 1.1.8 “Information Regulator” means the Information Regulator established in terms of section 39 of the Protection of Personal Information Act, 2013; 1.1.9 “Internal appeal” means an internal appeal to the relevant authority in terms of section 74; 1.1.10 “Minister” means the Cabinet member responsible for the administration of justice; 1.1.11 “Person” means a natural person or a juristic person; 1.1.12 “Personal information” means information relating to an identifiable natural person, including, but not limited to- a) information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person; b) information relating to the education or the medical, financial, criminal or employment history of the person; c) any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assigned to the person; d) the biometric information of the person; e) the personal opinions, views or preferences of the person; f) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; g) the views or opinions of another individual about the person; and DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 h) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person, but excludes information about an individual who has been dead for more than 20 years; 1.1.13 “Political party” means- (a) any entity that accepts donations principally to support or oppose any registered political party or its candidates, in an election as defined in section 1 of the Electoral Act, 1998 (Act No. 73 of 1998); (b) any registered political party as defined in the Electoral Act, 1998; or (c) a natural person who is an independent candidate.” 1.1.14 “Private body” means- (a) a natural person who carries or has carried on any trade, business or profession, but only in such capacity; (b) a partnership which carries or has carried on any trade, business or profession; or (c) any former or existing juristic person, or (d) a political party. but excludes a public body; 1.1.15 “Public body” means- (a) any department of state or administration in the national or provincial sphere of government or any municipality in the local sphere of government; or DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 (b) any other functionary or institution when- (i) exercising a power or performing a duty in terms of the Constitution or a provincial constitution; or (ii) exercising a public power or performing a public function in terms of any legislation; 1.1.16 “Record” of, or in relation to, a public or private body, means any recorded information- (a) regardless of form or medium; (b) in the possession or under the control of that public or private body, respectively; and (c) whether or not it was created by that public or private body, respectively; 1.1.17 “Request for access”, in relation to- (a) a public body, means a request for access to a record of a public body in terms of section 11; or (b) a private body, means a request for access to a record of a private body in terms of section 50; 1.1.18 “Requester”, in relation to- (a) a public body, means- i) any person (other than a public body contemplated in paragraph (a) or (b)(i) of the definition of 'public body', or an official thereof) making a request for access to a record of that public body; or ii) a person acting on behalf of the person referred to in subparagraph (i); (b) a private body, means- DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 (i) any person, including, but not limited to, a public body or an official thereof, making a request for access to a record of that private body; or (ii) a person acting on behalf of the person contemplated in subparagraph(i); 1.1.19 ‘‘Responsible party’’ means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information; 1.1.20 “Third party', in relation to a request for access to- (a) a record of a public body, means any person (including, but not limited to, the government of a foreign state, an international organisation or an organ of that government or organisation) other than- (i) the requester concerned; and (ii) a public body; or (b) a record of a private body, means any person (including, but not limited to, a public body) other than the requester, but, for the purposes of sections 34 and 63, the reference to 'person' in paragraphs (a) and (b) must be construed as a reference to 'natural person'; 1.1.21 “The Act” means the Promotion of Access to Information Act 2 of 2000 as amended, and includes any regulation made and in force in terms of section 92. 1.2 Interpretation 1.2.1 any reference to any statute, regulation or other legislation shall be a reference to that statute, regulation or other legislation as at the signature date, and as amended or substituted from time to time; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 1.2.2 if any provision in a definition is a substantive provision conferring a right or imposing an obligation on any party then, notwithstanding that it is only in a definition, effect shall be given to that provision as if it were a substantive provision in the body of this Manual; 1.2.3 where any term is defined within a particular clause other than this, that term shall bear the meaning ascribed to it in that clause wherever it is used in this document; 1.2.4 where any number of days is to be calculated from a particular day, such number shall be calculated as excluding such particular day and commencing on the next day. If the last day of such number so calculated falls on a day which is not a business day, the last day shall be deemed to be the next succeeding day which is a business day; 1.2.5 any reference to days (other than a reference to business days), months or years shall be a reference to calendar days, months or years, as the case may be; 1.2.6 the use of the word "including" followed by a specific example/s shall not be construed as limiting the meaning of the general wording preceding it and the eiusdem generis rule shall not be applied in the interpretation of such general wording or such specific example/s; 1.2.7 insofar as there is a conflict in the interpretation of or application of this Manual and the Act, the Act shall prevail; 1.2.8 this Manual does not purport to be exhaustive of or to comprehensively deal with every procedure provided for in the Act. A requester is advised to familiarise his/her/itself with the provisions of the Act before lodging any request with the Regulator. 2. LIST OF ACRONYMS AND ABBREVIATIONS 2.1 “CEO” Chief Executive Officer DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 2.2 “Constitution” Constitution of the Republic of South Africa, Act No. 108 of 1996; 2.3 “DIO” Deputy Information Officer; 2.4 “IO“ Information Officer; 2.5 “Members” Members of the Information Regulator; 2.6 “Minister” Minister of Justice and Correctional Services; 2.7 “PAIA” Promotion of Access to Information Act No. 2 of 2000, as amended; 2.8 “PFMA” Public Finance Management Act No.1 of 1999, as amended; 2.9 “POPIA” Protection of Personal Information Act No.4 of 2013; 2.10 “Regulator” means the Information Regulator established in terms of section 39 of POPIA; and 2.11 “SAHRC” South African Human Rights Commission. 3. INTRODUCTION 3.1 Before South Africa became a constitutional democracy with an enforceable Bill of Rights, it had a government that thrived on secrecy, clandestine activities and the suppression of information. There was no transparency or accountability. 3.2 The Regulator is committed to upholding the principles enshrined in the Constitution and national legislation including but not limited to PAIA and POPIA. The former contains the key principles of good governance, transparency and accountability. 3.3 In pursuit of its objectives, the Regulator encourages the sharing of information with requesters and members of the public as optimally as is possible. Informed public scrutiny can only strengthen the democratic ideals the Regulator advances. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 3.4 PAIA, as amended by section 110 of POPIA, was promulgated to give effect to the constitutional right of access to information held by the State or by another person, which information is required for the exercise or protection of any rights. 4. PURPOSE OF PAIA MANUAL This manual can be used by members of the public to- 4.1 establish the nature of the records which may already be available at the Regulator, without the need for submitting a formal PAIA request; 4.2 have an understanding of how to make a request for access to a record of the Regulator; 4.3 access all the relevant contact details of the persons who will assist the public with the records they intend to access; 4.4 know all the remedies available from the Regulator regarding request for access to the records, before approaching the Courts; 4.5 describe the services available to members of the public from the Regulator and how to gain access to those services; 4.6 outline the description of the guide on how to use PAIA, as updated by the Regulator and how to obtain access to it; 4.7 understand if the Regulator will process personal information, the purpose of processing of personal information, the description of the categories of data subjects and of the information or categories of information relating thereto; 4.8 know if the Regulator has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and 4.9 know whether the Regulator has appropriate security measures to ensure the confidentiality, integrity and availability of the information which is to be processed. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 5. ESTABLISHMENT OF THE INFORMATION REGULATOR 5.1 The Regulator is established in terms of Section 39 of POPIA, which enjoins the Regulator to be independent and impartial, and to perform its functions and exercise its powers without fear, favour or prejudice. It is accountable to the National Assembly. 5.2 The Regulator is responsible for the promotion and protection of the right to privacy as it relates to the protection of personal information and the right of access to information. In this regard, it exercises its powers and performs its functions in accordance with POPIA and PAIA. 5.3 The Regulator is an independent institution that is subject only to the Constitution and the law and its decisions can only be reviewed by a Court of law. 5.4 Information Regulator’s Vision, Mission and Values 5.4.1 Vision Our vision is to be a world class institution in the protection of personal information and the promotion of access to information. 5.4.2 Mission Our mission to be an independent institution which regulates the processing of personal information and the promotion of access to information in accordance with the Constitution and the law so as to protect the rights of everyone. 5.4.3 Values Our values are Transparency; Accountability; Integrity; Excellence; Impartiality; and Responsiveness. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 6. STRUCTURE OF THE INFORMATION REGULATOR 6.1. The Regulator consists of the National (Head) Office situated in Johannesburg and will, in the near future and subject to funding, establish Regional Offices in all nine (9) Provinces. 6.2. The Regulator consists of the Chairperson and four (4) ordinary Members. The Chairperson and two ordinary Members are appointed in a full-time capacity and the other two ordinary Members are appointed in a part-time capacity. 6.3. In terms of section 47(1) of POPIA, the Regulator must appoint- 6.3.1. a suitably qualified and experienced person as Chief Executive Officer (CEO) of the Regulator for the purpose of assisting the Regulator, subject to the Regulator’s direction and supervision, in the performance of all financial and administrative functions arising from the administration of POPIA and PAIA; and 6.3.2. such other members of staff as the Regulator may deem necessary to assist the Regulator and the CEO. 6.4. The Executive Committee of the Regulator consist of the CEO and six (6) Executives, namely: Executive: POPIA; Executive: PAIA; Executive: Education and Communication; Chief Legal Officer (CLO); Chief Financial Officer (CFO); and Executive: Corporate Services. 6.5. The Regulator may, in terms of section 49(1) of POPIA, if it considers it necessary for the proper performance of its functions, establish one or more Committees. The following Committees have been established by the Regulator- 6.5.1. Policy, Governance and International Cooperation Committee; 6.5.2. Compliance and Monitoring Committee; 6.5.3. Complaints and Investigations Committee; 6.5.4. Legal, Policy and Research Committee; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 6.5.5. Education and Communication Committee; 6.5.6. Enforcement Committee; 6.5.7. Risk Management Committee; and 6.5.8. Corporate Services Committee. 6.6. The full structure of the Regulator, as it currently exist, is attached hereto. 6.7. Below is the description of the organisational structure of the Regulator- DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 INFORMATION REGULATOR (CHAIRPERSON AND MEMBERS) CHIEF EXECUTIVE OFFICER INTERNAL AUDIT Chief Financial Executive Officer: Provincial Chief Legal Officer: Executive Officer: Executive Officer: Executive Officer: Officer Corporate Coordination x 9 Legal Services Education and Protection of Promotion of (CFO) Services (CS) Communication Personal Access to (EDUCOM) Information Act Information Act (POPIA) (PAIA) DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7. POWERS, DUTIES AND FUNCTIONS OF THE REGULATOR 7.1. The Regulator derives its Constitutional mandate from sections 14 (the right to privacy) and section 32 (the right of access to information) of the Constitution. Accordingly, the Regulator’s primary objective is to promote the protection of personal information processed by any person and the promotion of the right of access to any information held by public and private bodies. 7.2. Section 40 of the POPIA makes provision for the following powers, duties and functions of the Regulator- 7.2.1 to provide education by- 7.2.1.1 promoting an understanding and acceptance of the conditions for the lawful processing of personal information and of the objects of those conditions; 7.2.1.2 undertaking educational programmes, for the purpose of promoting the protection of personal information, on the Regulator’s own behalf or in co-operation with other persons or authorities acting on behalf of the Regulator; 7.2.1.3 making public statements in relation to any matter affecting the protection of the personal information of a data subject or of any class of data subjects; 7.2.1.4 giving advice to data subjects in the exercise of their rights; and 7.2.1.5 providing advice, upon request or on its own initiative, to a Minister or a public or private body on their obligations under the provisions, and generally on any matter relevant to the operation, of PAIA and POPIA. 7.2.2 to monitor and enforce compliance by- 7.2.2.1 public and private bodies with the provisions of PAIA and POPIA; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.2.2.2 undertaking research into, and monitoring developments in, information processing and computer technology to ensure that any adverse effects of such developments on the protection of the personal information of data subjects are minimised, and reporting to the Minister the results of such research and monitoring; 7.2.2.3 examining any proposed legislation, including subordinate legislation, or proposed policy of the Government that the Regulator considers may affect the protection of the personal information of data subjects, and reporting to the Minister the results of that examination; 7.2.2.4 reporting upon request or on its own accord, to Parliament from time to time on any policy matter affecting the protection of the personal information of a data subject, including the need for, or desirability of, taking legislative, administrative, or other action to give protection or better protection to the personal information of a data subject; 7.2.2.5 submitting a report to Parliament, within five months of the end of its financial year, on all its activities in terms of PAIA and POPIA during that financial year; 7.2.2.6 conducting an assessment, on its own initiative or when requested to do so, of a public or private body, in respect of the processing of personal information by that body for the purpose of ascertaining whether or not the information is processed according to the conditions for the lawful processing of personal information; 7.2.2.7 monitoring the use of unique identifiers of data subjects, and reporting to Parliament from time to time on the results of that monitoring, including any recommendation relating to the need of, or desirability of taking legislative, administrative, or other action to give protection, or better protection, to the personal information of a data subject; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.2.2.8 maintaining, publishing and making available and providing copies of such registers as are prescribed in PAIA and POPIA; and 7.2.2.9 examining any proposed legislation that makes provision for the- 7.2.2.9.1 collection of personal information by any public or private body; or 7.2.2.9.2 disclosure of personal information by one public or private body to any other public or private body, or both, to have particular regard, in the course of that examination, to the matters set out in section 44(2), in any case where the Regulator considers that the information might be used for the purposes of an information matching programme, and reporting to the Minister and Parliament the results of that examination; 7.2.3 to consult with interested parties by- 7.2.3.1 receiving and inviting representations from members of the public on any matter affecting the personal information of a data subject; 7.2.3.2 co-operating on a national and international basis with other persons and bodies concerned with the protection of personal information; and 7.2.3.3 acting as mediator between opposing parties on any matter that concerns the need for, or the desirability of, action by a responsible party in the interests of the protection of the personal information of a data subject. 7.2.4 to handle complaints by- DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.2.4.1 receiving and investigating complaints about alleged violations of the protection of personal information of data subjects and reporting to complainants in respect of such complaints; 7.2.4.2 gathering such information as in the Regulator’s opinion will assist the Regulator in discharging the duties and carrying out the Regulator’s functions under PAIA and POPIA; 7.2.4.3 attempting to resolve complaints by means of dispute resolution mechanisms such as mediation and conciliation; and 7.2.4.4 serving any notices in terms of PAIA and POPIA and further promoting the resolution of disputes in accordance with the prescripts of PAIA and POPIA. 7.2.5 to conduct research and to report to Parliament- 7.2.5.1 from time to time on the desirability of the acceptance, by South Africa, of any international instrument relating to the protection of the personal information of a data subject; and 7.2.5.2 on any other matter, including necessary legislative amendments, relating to protection of personal information that, in the Regulator’s opinion, should be drawn to Parliament’s attention. 7.2.6 in respect of codes of conduct to- 7.2.6.1 issue, from time to time, codes of conduct, amend codes and to revoke codes of conduct; 7.2.6.2 make guidelines to assist bodies to develop codes of conduct or to apply codes of conduct; and 7.2.6.3 consider afresh, upon application, determinations by adjudicators under approved codes of conduct. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.2.7 to facilitate cross-border co-operation in the enforcement of privacy laws by participating in any initiative that is aimed at such co-operation; and 7.2.8 in general to- 7.2.8.1 do anything incidental or conducive to the performance of any of the preceding functions; 7.2.8.2 exercise and perform such other functions, powers, and duties as are conferred or imposed on the Regulator by or under PAIA and POPIA or any other legislation; 7.2.8.3 require the responsible party to disclose to any person affected by a compromise to the integrity or confidentiality of personal information, such compromise in accordance with section 22 of POPIA; and 7.2.8.4 exercise the powers conferred upon the Regulator by PAIA and POPIA in matters relating to the access of information as provided by the Promotion of Access to Information Act. 7.2.9 To publish reports relating generally to the exercise of the Regulator’s functions under PAIA and POPIA or to any case or cases investigated by the Regulator. 7.3 Section 77C(1) and (2) of PAIA makes provision for the following powers, duties and functions of the Regulator, to- 7.3.1 investigate the complaint in the prescribed manner; 7.3.2 refer the complaint to the Enforcement Committee established in terms of section 50 of the POPIA; or 7.3.3 decide, in accordance with section 77D, to take no action on the complaint or, as the case may be, require no further action in respect of the complaint; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.3.4 act, where appropriate, as conciliator in relation to such complaint in the prescribed manner; 7.3.5 Issue an Information Notice3 requiring the Information Officer to furnish the Regulator with the information specified in the notice. 7.3.6 issue an Enforcement Notice4- 7.3.6.1 confirming, amending or setting aside the decision which is the subject of the complaint; or 7.3.6.2 requiring the said Information Officer to take such action or to refrain from taking such action as the Regulator has specified in the notice. 7.4 The Regulator may, in terms of section 77H(1) of PAIA, and on its own initiative, or at the request by or on behalf of information officer or head of a private body or any other person conduct as an assessment whether a public or private body generally complies with the provisions of PAIA and POPIA, insofar as its policies and implementation procedures are concerned. 7.5 The Regulator has the following additional functions in terms of section 83 of PAIA:- 7.5.1 compile and make available a guide on how to use this Act as contemplated in section 10 of this Act; 7.5.2 submit reports to the National Assembly as contemplated in section 84; 7.5.3 to the extent that financial and other resources are available- 7.5.3.1 develop and conduct educational programmes to advance the understanding of the public, in particular of disadvantaged communities, of this Act and of how to exercise the rights contemplated in this Act; 3 Section 77I (1) of PAIA. 4 Section 77J (1) of PAIA. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.5.3.2 encourage public and private bodies to participate in the development and conduct of programmes referred to in paragraph (a) and to undertake such programmes themselves; and 7.5.3.3 promote timely and effective dissemination of accurate information by public bodies about their activities. 7.5.4 make recommendations for:- 7.5.4.1 the development, improvement, modernisation, reform or amendment of this Act or other legislation or common law having a bearing on access to information held by public and private bodies, respectively; 7.5.4.2 procedures in terms of which public and private bodies make information electronically available; 7.5.5 monitor the implementation of this Act; 7.5.6 if reasonably possible, on request, assist any person wishing to exercise a right contemplated in this Act; 7.5.7 recommend to a public or private body that the body make such changes in the manner in which it administers this Act as the Regulator considers advisable; 7.5.8 train information officers and deputy information officers of public bodies; 7.5.9 consult with and receive reports from public and private bodies on the problems encountered in complying with this Act; 7.5.10 obtain advice from, consult with, or receive and consider proposals or recommendations from, any public or private body, official of such a body or member of the public in connection with the Regulator's functions in terms of this Act; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 7.5.11 for the purposes of section 84(b)(x), request the Public Protector to submit to the Regulator, information with respect to- 7.5.11.1 the number of complaints lodged with the Public Protector in respect of a right conferred or duty imposed by this Act; 7.5.11.2 the nature and outcome of those complaints; and 7.5.11.3 generally, inquire into any matter, including any legislation, the common law and any practice and procedure, connected with the objects of this Act. 7.6 The Information Officer of the Regulator or the Office of the Regulator can be contacted to access the aforementioned services. The Regulator’s website, https://www.inforegulator.org.za , can also be consulted in this regard. 8. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION OF THE INFORMATION REGULATOR 8.1. Information Officer Name: Mr Mosalanyane Mosala Tel: +27 (0) 10 023 5251 Email: [email protected] 8.2. Deputy Information Officer Name: Mr Jaco Jansen Tel: +27 (0) 10 023 5237 Email: [email protected] 8.3. Access to information general contacts Email: [email protected] 8.4. National Head Office DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Postal Address: P.O. Box 31533 Braamfontein Johannesburg 2017 Physical Address: The Information Regulator (South Africa) JD House 27 Stiemens Street Braamfontein Johannesburg 2001 Telephone: +27 (0) 10 023 5200 Email: [email protected] Website: https://www.inforegulator.org.za 9. REMEDIES AVAILABLE IF PROVISIONS OF PAIA ARE NOT COMPLIED WITH OR IN RESPECT OF AN ACT OR A FAILURE TO ACT BY THE REGULATOR 9.1. If the Regulator fails to comply with the provisions of PAIA, the requestor or any aggrieved person may, in accordance with section 785 of PAIA and the Promotion of Administrative Justice Act 3 of 2000 (PAJA), approach the Court with jurisdiction for appropriate relief. 9.2. If the requester or third party is aggrieved by the decision of the Information Officer, he or she may, by way of an application and within 180 days, apply to a court for appropriate relief in terms of section 82 of the Act. 9.3. Although the Regulator is not the kind of a public body where there is an internal appeal process, as referred to in paragraph (a) of the definition of “public body” in section 1 of the Act, it has established the following appeal process, which process 5 Section 78(1) of PAIA- A requester or third party referred to in section 74 may only apply to a court for appropriate relief in terms of section 82 after that requester or third party has exhausted the internal appeal procedure against a decision of the information officer of a public body provided for in section 74. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 is not compulsory and the Requester or third party may opt to approach the court in accordance with paragraph 9.2 above- 9.3.1 Internal Remedies 9.3.1.1 An internal appeal can only be lodged, in terms of section 746 of PAIA, with the relevant authority of the Regulator (Members of the Regulator). 9.3.1.2 However, the requirement of section 74(1) and (2) of PAIA are not exclusive (this is because of the usage of the word “may” in section 74(1) of PAIA) and therefore the Regulator has decided to have an internal appeal process, in order to ensure an accountable, responsive and transparent system of governance within the Regulator. 9.3.1.3 Accordingly, a requester may lodge an internal appeal against a decision of the Information Officer or Deputy Information Officer on the following grounds- 9.3.1.3.1 refusal to grant access to the records; 9.3.1.3.2 the tender or payment of the request fee in terms of section 22(1) of PAIA; or 9.3.1.3.3 the access fee to be paid is too excessive; or 9.3.1.3.4 the tender or payment of a deposit in terms of section 22(2) of PAIA; or 9.3.1.3.5 the decision of the Information Officer to grant a request for access; or 9.3.1.3.6 an extension of period in terms of section 26(1) of PAIA; or 6 Section 74(1) of PAIA- 1) A requester may lodge an internal appeal against a decision of the information officer of a public body referred to in paragraph (a) of the definition of 'public body' in section 1. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 9.3.1.3.7 refusal to grant access to records in a particular form requested, in terms section 29 (3) of PAIA; 9.3.1.3.8 failure to disclose records; or 9.3.1.3.9 refusal to grant request to waive the fees. 9.3.2 A third party may lodge an internal appeal against a decision of the Information Officer or Deputy information Officer to grant a request for access to a record. 9.3.3 In order to appeal against any decision(s) made by the Information Officer or Deputy information Officer, referred to in paragraph 9.3.1.3 and 9.3.2 above, a requester must lodge an internal appeal by completing Form 4. Form 4, attached hereto, must be submitted to the same Information Officer or Deputy information Officer that made the original decision, who is then required to forward it to the Chairperson or a Member designated by the Chairperson within ten (10) working days after receipt of an internal appeal7. 9.3.4 Period within which to lodge an appeal 9.3.4.1 An internal appeal form must be delivered or sent to the Information Officer or Deputy information Officer’s address or fax number or electronic mail address8, contact details of which can be found in paragraph 8 above- 9.3.4.1.1 within 60 days9 after the decision was taken; 9.3.4.1.2 within 30 days10 after notice is given to the third party of the decision appealed against. 7 Section 75(4) of PAIA- As soon as reasonably possible, but in any event within 10 working days after receipt of an internal appeal in accordance with subsection (1), the information officer of the public body concerned must submit to the relevant authority 8 Section 75(1)(b) of PAIA- An internal appeal must be delivered or sent to the information officer of the public body concerned at his or her address, fax number or electronic mail address; 9 section 75(1)(a)(i) of PAIA- An internal appeal must be lodged in the prescribed form, within 60 days 10 section 75(1)(a)(ii) of PAIA- An internal appeal must be lodged in the prescribed form, if notice to a third party is required by section 49 (1) (b), within 30 days after notice is given to the appellant of the decision appealed against or, if notice to the appellant is not required, after the decision was taken. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 9.3.5 The Appeal must be submitted to the Information Officer who must in terms of PAIA, forward it to the Members of the Regulator, within ten (10) days, together with- 9.3.5.1 his or her reasons for the decision concerned; and 9.3.5.2 the name, postal address, phone and fax number and electronic mail address, whichever is available, of any third party that must be notified of the request, in terms of section 47 (1) of PAIA. 9.3.6 The Appeal must be delivered or sent to any of the contact information listed in paragraph 8 above. 9.3.7 The Members may, upon good cause shown, allow the late lodging of the internal appeal. If the Chairperson or a Member designated by the Chairperson is not satisfied with the reasons advanced for late lodging of the appeal, the request will be disallowed on written notice to the person that lodged the internal appeal. 9.3.8 A requester lodging an internal appeal against the refusal of his or her request for access may pay the prescribed appeal fee (if any or unless he/she is exempted from paying fees). If the prescribed appeal fee is payable in respect of an internal appeal, the decision on the internal appeal may be deferred until the fee is paid. 9.3.9 The Members, must process and decide on the internal appeal within thirty (30) days from the date in which the internal appeal was received by the Information Officer or Deputy Information Officer; 9.3.10 External Remedies The decision made by the Members, pertaining to any of the decisions the requester or third party is aggrieved by, is final and the requester or third DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 party may, by way of an application, within 180 days apply to a court for appropriate relief in terms of section 82. 10. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS THE GUIDE 10.1. The Regulator has, in terms of section 10(1) of PAIA, as amended, updated the PAIA Guide, as initially compiled by the SAHRC. 10.2. The purpose of the aforesaid Guide is to provide information that is needed by any person who wishes to exercise any right contemplated in PAIA and POPIA. 10.3. This Guide will specifically assist a person, also called a data subject, on how to access his/her or its personal information in terms of section 23 of POPIA. The aforesaid Guide contain the description of- 10.3.1. the objects of PAIA and POPIA; 10.3.2. the postal and street address, phone and fax number and, if available, electronic mail address of- 10.3.2.1. the Information Officer of every public body, and 10.3.2.2. every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA11 and section 56 of POPIA12; 10.3.3. the manner and form of a request for- 10.3.3.1. access to a record of a public body contemplated in section 1113 of PAIA; and 11 Section 17(1) of PAIA- For the purposes of PAIA, each public body must, subject to legislation governing the employment of personnel of the public body concerned, designate such number of persons as deputy information officers as are necessary to render the public body as accessible as reasonably possible for requesters of its records. 12 Section 56(a) of POPIA- Each public and private body must make provision, in the manner prescribed in section 17 of the Promotion of Access to Information Act, with the necessary changes, for the designation of such a number of persons, if any, as deputy information officers as is necessary to perform the duties and responsibilities as set out in section 55(1) of POPIA. 13 Section 11(1) of PAIA- A requester must be given access to a record of a public body if that requester complies with all the procedural requirements in PAIA relating to a request for access to that record; and access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 10.3.3.2. access to a record of a private body contemplated in section 5014 of PAIA; 10.3.4. the assistance available from the Information Officer of a public body in terms of PAIA and POPIA; 10.3.5. the assistance available from the Regulator in terms of PAIA and POPIA; 10.3.6. all remedies available in law regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging- 10.3.6.1. an internal appeal; 10.3.6.2. a complaint to the Regulator; and 10.3.6.3. an application to a court against a decision by the Information Officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body; 10.3.7. the provisions of sections 1415 and 5116 requiring a public body and private body, respectively, to compile a Manual, and how to obtain access to a manual; 10.3.8. the provisions of sections 1517 and 5218 of PAIA providing for the voluntary disclosure of categories of records by a public body and private body, respectively; 14 Section 50(1) of PAIA- A requester must be given access to any record of a private body if- a) that record is required for the exercise or protection of any rights; b) that person complies with the procedural requirements in PAIA relating to a request for access to that record; and c) access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part. 15 Section 14(1) of PAIA- The information officer of a public body must, in at least three official languages, make available a manual containing information listed in paragraph 4 above. 16 Section 51(1) of PAIA- The head of a private body must make available a manual containing the description of the information listed in paragraph 4 above. 17 Section15(1) of PAIA- The information officer of a public body, must make available in the prescribed manner a description of the categories of records of the public body that are automatically available without a person having to request access 18 Section 52(1) of PAIA- The head of a private body may, on a voluntary basis, make available in the prescribed manner a description of the categories of records of the private body that are automatically available without a person having to request access DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 10.3.9. the notices issued in terms of sections 2219 and 5420 of PAIA regarding fees to be paid in relation to requests for access; and 10.3.10. the regulations made in terms of section 9221 of PAIA. 10.4. Members of the public can inspect or make copies, during normal working hours, of the Guide from the offices of the public and private bodies (in at least two of the official languages), including the office of the Regulator (in each of the official languages). The Guide, in each of the official languages, can also be obtained- 10.4.1. from the Government Gazette; 10.4.2. upon request from the Regulator, by the information officer on a form which corresponds substantially with Form 1 of Annexure A to the Regulations; 10.4.3. upon request from the Regulator, by any person, other than an information officer referred to in paragraph 10.4.2 above, on a form that corresponds substantially with Form 1 of Annexure A to the PAIA Regulations. The fees in relation to a copy of the Guide as provided for in item 1 of Annexure B may apply to the aforesaid person. 10.4.4. from the website of the Regulator (https://www.inforegulator.org.za) and that of any public and private bodies; 10.5. Any request for a Guide from the Regulator must be made in writing, by completing FORM 1, attached hereto. 19 Section 22(1) of PAIA- The information officer of a public body to whom a request for access is made, must by notice require the requester to pay the prescribed request fee (if any), before further processing the request. 20 Section54(1) of PAIA- The head of a private body to whom a request for access is made must by notice require the requester to pay the prescribed request fee (if any), before further processing the request. 21 Section 92(1) of PAIA provides that –“The Minister may, by notice in the Gazette, make regulations regarding- (a) any matter which is required or permitted by this Act to be prescribed; (b) any matter relating to the fees contemplated in sections 22 and 54; (c) any notice required by this Act; (d) uniform criteria to be applied by the information officer of a public body when deciding which categories of records are to be made available in terms of section 15; and (e) any administrative or procedural matter necessary to give effect to the provisions of this Act.” DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 11. CATEGORIES OF RECORDS HELD BY THE INFORMATION REGULATOR 11.1 Records held by the Regulator are generated through each of its divisions, the core operations processes under both PAIA and POPIA and also through the decisions taken by Members. 11.2 Each division of the Regulator generates substantive records which relate specifically to the outputs of the division and operational records in the course of organisational operations. 11.3 The categories of records generated in the Regulator are classified in the manner listed below- 11.3.1 according to the file plan for correspondence, files on strategic support, core functions, and operational processes of the Regulator; 11.3.2 the Records Control Schedule for other records including publications and audio-visual records and the electronic information systems of the Regulator. 11.4 Certain records of the Regulator are acquired in the course of work of the Regulator and in certain instances records are received from public and private bodies in accordance with PAIA and POPIA. 11.5 The Regulator reserves the right to transfer requests for records to relevant bodies where these bodies were the primary holders or generators of the information requested, or where the Regulator no longer has possession of such record. 11.6 The Regulator also reserves the right to create new categories of records where this is necessary. This Manual will be updated to reflect changes in categories of records accordingly. 11.7 Description of the subjects on which the Regulator holds records and the categories of records held on each subject 11.7.1 The Regulator holds the following records, which are available from the Regulator and may be requested by way of the PAIA request process DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 prescribed in paragraph 12 below. Such records usually do not have information which can reasonably be said to be of a confidential nature. 11.7.2 Most records which fall into this category of information are available from the central registry of the Regulator at its Head Office or on the Regulator’s website: https://www.inforegulator.org.za 11.7.3 Below is the list of records and information that may be formally requested in terms of PAIA or downloaded from the above-mentioned website of the Regulator- Subjects Categories of records Request Download for access from the Website Strategic Documents, Plans, Annual Reports, Strategic Plan, Annual X X Proposals Performance Plan. Human Resources - HR policies and procedures; X - Advertised posts; - Employees records; - Learning and Development e.g.: Skills Development and Training Plans - Employment Equity Plan and Statistics Operational Policies / Plans Protocols Agreements, Supply Chain X /Procedures / Frameworks / Management, Procurement Plans, Specific Tenders & Contracts, Donations, Funds, Suppliers, Risk Management, Audit, IT, Finance Management, Human Resources, Marketing and Branding Records Management. Legal, Policy, Research - Research Strategy and Plan X - Research Papers Corporate Governance - Organisational and Business Plans; X - Memorandum of Understanding; - Regulator’s Policies and Procedures; - Occupational Health and Safety Plan; - Loss Control Register; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Subjects Categories of records Request Download for access from the Website - Evacuation procedures. Information Technology - Incidents and Service Requests; x - Asset Issuing and Custodian Information; - System Event Logs; - System Performance Logs; - Systems Maintenance Check lists; - Monthly Operations Reports; - Service Level Agreements; - ICT Policies and Procedure Manuals; - Network maintenance; - System Development lifecycle documents. Manual and Guide Regulator’s Manual and Guide on how to use X X PAIA Publicity and Marketing Publications, Investigation and Assessment X X Material Reports, Frequently Asked Questions (FAQ’s) etc. Publications Booklets, Books, Periodicals, Journals, X X Reports, Newsletters, Bulletins, Magazines, Pamphlets, E- Publications. Media Press releases, Radio and TV Interviews, X X Statements, Participation details, Official Speeches and Messages, Gifts & Awards, Website content and Corporate identity and infographs. Events, Functions, Presentations, Discussions, Documents. X X Seminars and Conferences Registers Information Officers, X X Issued Codes of Conduct X X Internal Directories, File Plan, Records X Control Schedule. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Subjects Categories of records Request Download for access from the Website Reports / Minutes / Conferences Research & Findings, , X Decisions Monitoring & Evaluation, Statistics, Surveys, Submissions on Legislation Supply Chain Matters BID Documents, Contracts, Purchase X Orders, Quotations, Tenders, Terms of Reference and Leases, List of applicants for Tenders, List of Tenders Awarded. Investigation and Subpoena based Hearings, Summons, X compliance Warrants to search and seize items, Enforcement Notices, Information Notices, HR Interventions, Public Hearings, Plenary Reports and investigation report. Finances Financial Accounting, Financial Reporting, X Contracts and Tender Administration, Asset Management / Register, Management Accounting, Estimates, Statements, Budgets, Reports, Audit Records, Revenue Statements, Reports and Returns. Audio-Visual Recordings Slides, Photographs, Films, Videos. X 11.8 Categories of records that may be subject to the grounds for refusal of access to records 11.8.1 The records listed in the categories below may be formally requested, but access to parts of these records or the whole record may be refused on legal grounds listed in sections 33 to 46 and sections 62 to 70 of PAIA. Please refer to PAIA Guide on how to use PAIA. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 11.8.2 The Regulator further reserves the right to refuse access to records where the processing of the record will result in a substantial and unreasonable diversion of its resources. 11.8.3 Access will also be refused where requests are clearly frivolous and / or vexatious. 11.8.4 However, the Information Officer or Deputy Information Officer(s) of the Regulator may grant a request for access to a record of the Regulator, if- 11.8.4.1 the disclosure of the record would reveal evidence of a substantial contravention of, or failure to comply with the law; and 11.8.4.2 the public interest in the disclosure of the record clearly outweighs the harm contemplated in any of the grounds for refusal of access to records. Category of Record On Request form Only Regulator’s Compliance Assessment Reports (PAIA and X POPIA) Security related information X Regulator internal communiqués X Records held by Legal Services Department X Executive Management internal confidential communication X Research conducted by Service Providers for the Regulator or X programs subject to contractual exemptions on disclosure Confidential client communications X Privileged information: held in the course of investigations, X conciliation, closed hearings, attorney client information, national security based information or third party information Specific Human Resource Personnel information, including, but X not limited to files relating to disciplinary process and records, medical information and personal information DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Category of Record On Request form Only Asset disclosures and asset protection procedures X Certain Service Level Agreements X Certain Tender Documentation X Agendas and Minutes of Meetings and correspondence X Draft reports, policies and discussions documents X Research papers and Legal opinions X - Enforcement Notices; X - settlement between the parties; - Assessment report; - Information Notice; - Search warrants; and - Subpoenas. Invoices and proof of payments X Certain forensic reports X 12. RECORDS OF THE REGULATOR WHICH ARE AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS, IN TERMS OF SECTION 15(2) OF THE ACT Category Document Type Website Legislation - Promotion of Access to Information Act 2 of 2000; X - Promotion of Access to Information Amendment Act 54 of 2002; - Protection of Personal Information Act 4 of 2013; - Promotion of Access to Information Amendment Act 31 of 2019; - The Political Party Funding Act 6 of 2018) Regulations - Government Notice R.187 in GG 23119- 15 February 2002; X - Government Notice No. R. 1244 -22 September 2003; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Category Document Type Website - Government Notice R.991 in GG 28107-14 October 2005; - Government Notice No. R. 990-13 October 2006; - Government Notice No. R. 466-1 June 2007; - Government Notice 1222 in GG 39504-11 December 2015; - Government Notice 1217 in GG 42717-19 September 2019; - Government Notice R. 1284 in GG 42740-4 October 2019; - GG 42110, RG 10897, GoN 1383, 14 Dec 2018 (POPIA: Regulations) Forms - PAIA Complaints Form to the Regulator; X - POPIA Complaints Form to the Regulator; - PAIA Request for access to records Forms ( Form 2); Committees of - Terms of Reference for Committees X the Regulators - Charter of Roles and Responsibilities of Members of the Information Regulators Policies, - PAIA Guide; X Guidelines, - PAIA Manual; Code of - Guidance Notes; Conduct, and - Guidelines; Guidance - Policy on Website Privacy; Notes - Code of Ethics and Conduct; - Policy on Disclosure of Interests; - Policy on Formulation of Policies; - Approved and issued Codes of Conduct; - Notices; - Exemptions and - Authorisations. Strategic - Organisational Profile (Overview, Objectives, Functions, X Documents Organogram) (Plans and - Annual Reports; Report) - Strategic Plan; - Annual Performance Plan; - Strategic and Performance Plans. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 13. PROCEDURE FOR ACCESS TO RECORDS HELD BY THE INFORMATION REGULATOR 13.1 Section 18 of PAIA prescribes the procedure to be followed in making a request for access to information held by the Regulator. Section 23(1) of POPIA22 also provides the procedure to access personal information. Manner of access to personal information in terms of section 23 of POPIA should be in accordance with section 18 of PAIA23. 13.2 A requester or data subject must use the prescribed form, FORM 2, when requesting access to a record or personal information. Form 2 is annexed hereto. 13.3 A requester is any person making a request for access to a record of the Regulator and in this regard, PAIA distinguishes between two types of requesters for access to information, i.e. Personal Requester, (data subject) and Other Requester. 13.3.1 A data subject is a requester who, having provided adequate proof of identity, is seeking access to a record containing personal information about the data subject. Subject to the provisions of PAIA and POPIA, the Regulator will provide the requested information, or give access to any record with regard to the data subject’s personal information within a reasonable time, (at a prescribed fee, if any) in a reasonable manner and format and in a form that is generally understandable. The prescribed fee24 for reproduction of the personal information requested will be charged by the Regulator; 13.3.2 A person falling in the category of Other Requester is entitled to request access to information pertaining to third parties. However, the Regulator is not obliged to grant access prior to the requester fulfilling the requirements for access to information in terms of PAIA and POPIA. 22 Section 23(1) of POPIA provides that a data subject, having provided adequate proof of identity, has the right to— a) request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject; and b) (b) request from a responsible party the record or a description of the personal information about the data subject held by the responsible party, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information 23 Section 25 of POPIA. 24 Section 23(1)(b)(ii) of the POPIA DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 13.3.3 The prescribed fee for reproduction of the information requested may be charged by the Regulator. 13.4 The Form 2 must be addressed and submitted to the Information Officer by hand, post, per fax or e-mail, which details are set out in paragraph 8 above. 13.5 The requester must provide sufficient information of the record(s) requested in order for the Information Officer or Deputy Information Officer, if any, to identify the record(s). The prescribed form must be filled in with enough particularity to at least enable the Information Officer to identify: 13.5.1 the identity of the requester; 13.5.2 particulars of record requested; 13.5.3 type of record; 13.5.4 form of access; and 13.5.5 manner of access. 13.6 Some additional important points to remember when completing the request form: 13.6.1 each section of the form contains instructions that should be followed to improve the likelihood of the request being granted with minimal delay being experienced; 13.6.2 if records are requested on behalf of another person, please provide a copy of the mandate authorising you to act on behalf of another person; 13.6.3 a detailed description of the records being requested must be provided to enable the Information Officer or Deputy Information Officer to identify it accurately. 13.7 The requester must indicate, as per section 29(2) of PAIA25, the form of access 25 Section 29(2)(a) of PAIA provides that “record must be provided in written or printed form or visual images or printed transcriptions, by supplying a copy of the record or by making arrangements for the inspection of the record. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 that is required. 13.8 The requester must indicate whether the requested record(s) is preferred in any particular language. 13.9 The requester should indicate the manner in which he/she wishes to be informed of the decision on the request and the necessary particulars to be informed accordingly. 13.10 The requester will receive the information in such manner as indicated. Section 29(3) of PAIA26 indicates that making available the information will depend on whether the request will not interfere unreasonably with the effective administration of the Regulator, be detrimental to the preservation of the record(s) or infringe any copyright not owned by the State. 13.11 According to Section 29(4) of PAIA, should access in the form as requested, be refused as per Section 29(3) of PAIA, but access is given in an alternative form, then the fee charged may not exceed the amount that would have been charged for access in the form initially requested. 13.12 If, in addition to a written reply to the request for the record, the requester wants to be informed of the decision in any other manner, the requester must specify the manner and provide the necessary particulars to be informed accordingly. 13.13 Where the requester is making a request for the information on behalf of another person, he or she must provide proof of the capacity in which the request is being made. 13.14 An oral request for access to a record(s) may be made, if the requester does not have a formal education or has a disability. The Information Officer or Deputy Information Officer will assist the requester to complete the prescribed form on behalf of such requester and provide him/her with a copy of the completed form. 26 Section 29(3) of PAIA provides that- If a requester has requested access in a particular form, access must, subject to section 28, be given in that form, unless to do so would (a) interfere unreasonably with the effective administration of the public body concerned; (b) be detrimental to the preservation of the record; or (c) amount to an infringement of copyright not owned by the State or the public body concerned. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 13.15 The requester will be notified of the prescribed fee payable, if any, the method of payment and the office to which he/she can make such payment or submit proof of payment before a request for information is processed further. Please note that the requester is exempted from paying an access fee27 to the Regulator if:- 13.15.1 the requester is a single person whose annual income, after permissible deductions, such as PAYE and UIF, is less than R14 712 a year, or 13.15.2 the requester is married and his/her joint income, after permissible deductions, such as PAYE and UIF, is less than R27 192 per year. 13.16 The request for information will, in terms of Section 25 of PAIA, be processed by the Information Officer within 30 days after receipt of the request or as soon as is reasonably possible, whereafter the Information Officer will inform the requester of his/her decision, either to grant or reject the request for access to records. The decision must, if it is reasonably possible, be communicated in the manner requested by the requester. 13.17 Section 26 of PAIA28 prescribes the instances where the period of thirty (30) days referenced in Section 25 of PAIA29, may be extended once for a further 30 days. The period of 30 days may be extended once for a further period of not more than 30 days, if- 13.17.1 the request is for a large number of records or requires a search through a large number of records and compliance with the original period would unreasonably interfere with the activities of the Regulator; 27 as per Government Notice R991 of 14 October 2005 28 Section 26(1)- The information officer to whom a request for access has been made or transferred, may extend the period of 30 days referred to in section 25 (1) (in this section referred to as the 'original period') once for a further period of not more than 30 days, if- a) the request is for a large number of records or requires a search through a large number of records and compliance with the original period would unreasonably interfere with the activities of the public body concerned; b) the request requires a search for records in, or collection thereof from, an office of the public body not situated in the same town or city as the office of the information officer that cannot reasonably be completed within the original period; c) consultation among divisions of the public body or with another public body is necessary or desirable to decide upon the request that cannot reasonably be completed within the original period; d) more than one of the circumstances contemplated in paragraphs (a), (b) and (c) exist in respect of the request making compliance with the original period not reasonably possible; or e) the requester consents in writing to such extension. 29 Section 25 of PAIA deals with the requirement for a decision on request to be taken within 30 days and the requirement of notifying the requester about the decision to his or her request. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 13.17.2 the request requires a search for records in, or collection thereof from, an office of the Regulator not situated in the same town or city as the office of the Information Officer and cannot reasonably be completed within the original period; 13.17.3 consultation among divisions of the Regulator or with another public body is necessary or desirable to decide upon the request and such decision-making process cannot reasonably be completed within the original period; 13.17.4 more than one of the circumstances contemplated in paragraphs 13.17.1, 13.17.2 and 13.17.3 exist in respect of the request making compliance with the original period not reasonably possible; or 13.17.5 the requester consents in writing to such extension. 13.18 If the period has been extended, the information officer must as soon as possible and within 30 days of first receiving the request inform the requester of that extension. 13.19 If a request for access to a record has been refused, delayed or granted subject to unreasonable fees or is granted in an unacceptable form, the requester may lodge an internal appeal as per Section 74 of PAIA. 13.20 Section 74 of PAIA allows for appeals against the decision of the Information Officer of the Regulator and the appeal processes (which are not compulsory) are detailed in paragraph 9.3 above. 13.21 According to Section 78 of PAIA, a requester or third party referred to in Section 74, may only apply to a Court for appropriate relief in terms of Section 82 of the Act, after having exhausted the internal appeal procedure against a decision of the Information Officer. As indicated in paragraph 9.3 above, appeal processes are not compulsory and the requester or thirds party may, at any time, within the prescribed period of 180 days, approach the court for appropriate relief. 13.22 A requester, who is aggrieved by the decision of the information officer of the DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Regulator under PAIA, cannot lodge a complaint with the Regulator and must proceeds in accordance with paragraph 9.3.10 above. 14. SERVICES AVAILABLE TO MEMBERS OF THE PUBLIC FROM THE INFORMATION REGULATOR AND HOW TO GAIN ACCESS TO THOSE SERVICES 14.1 Complaints under POPIA 14.1.1 Any person alleging interference with the protection of the personal information of a data subject may, in terms of section 74(1) of POPIA, submit a complaint to the Regulator. Any person who wishes to submit a complaint contemplated in section 74(1) of POPIA must submit such a complaint to the Regulator on Form 5 (Part I thereof), which form is available on the Regulator’s website. 14.1.2 A responsible party or data subject who is aggrieved by a determination, including any declaration, order or direction that is included in the determination, made by an adjudicator, may submit a complaint to the Regulator against the determination in terms of section 74(2) of POPIA. Please note that there is a fee payable by a responsible party or data subject in respect of a complaint lodged against the adjudicator’s determination. 14.1.3 A responsible party or a data subject who wishes to submit a complaint contemplated in paragraph 14.1.2 above, must submit such a complaint to the Regulator on Form 5 (Part II thereof), which form is available on the Regulator’s website. 14.2 Complaints under PAIA 14.2.1 A requester or third party may only submit a complaint to the Regulator after that requester or third party has exhausted the internal appeal procedure against a decision of the Information Officer of a National, Provincial or Local sphere of government. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 14.2.2 However, with regard to a public body, in respect of which an internal appeal is not applicable and a private body, a requester or third party may submit a complaint to the Regulator, if not satisfied by the decision of the body concerned. 14.2.3 A complaint to the Regulator by a requester or third party must be lodged within 180 days of receipt of the decision from the body and must be submitted using Form 5, attached hereto. 15. PUBLIC INVOLVEMENT IN THE FORMULATION OF POLICY AND THE EXERCISE OF POWERS OR PERFORMANCE OF DUTIES BY THE INFORMATION REGULATOR 15.1 In the exercise of its powers or performance of its duties in terms of PAIA and POPIA, the public are from time to time invited to make representations or to participate or influence the development of Regulations, Codes of Conduct and Guidelines. 15.2 Members of the public can, at any time, make representations to the Regulator regarding the conduct of any person that falls within the jurisdiction of any of the Regulator’s mandate. 15.3 Members of the public are also encouraged to submit proposals for the development of a Code of Conduct or any legislative reform or representations on any matter affecting the personal information of a data subject. The public are also encouraged to participate in public consultation and stakeholder’s engagement arranged by the Regulator. 15.4 The platform utilised for public participation may either be through public hearings (physical or virtually), email or written submissions. 15.5 The inputs and submissions of members of the public are considered intensively during the formulation of the Regulations, Guidelines and Codes of Conduct. 15.6 The Regulator disseminates information to the public via electronic and print media, government gazette as well as social media. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 16. PROCESSING OF PERSONAL INFORMATION 16.1 Purpose of processing of personal information of data subject by the Regulator 16.1.1 The Regulator process personal information of data subjects under its care in the following ways:- 16.1.1.1 Fulfilling or executing its statutory obligations under PAIA and POPIA, through- 16.1.1.1.1 Receiving of complaints; 16.1.1.1.2 investigation of complaints; 16.1.1.1.3 conducting compliance assessment; 16.1.1.1.4 enforcement mechanism; 16.1.1.1.5 processing of application for- a) a codes of conduct; b) Exemptions; c) Prior Authorisations; d) Authorisation for processing of special personal information; and e) Authorisation for processing personal information of children. 16.1.1.2 Staff administration and Job applicants; 16.1.1.3 Keeping of accounts and records; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 16.1.1.4 Procurement process; 16.1.1.5 Visitors to any premises of the Regulator; 16.1.1.6 Complying with other relevant legislations, such as PFMA, Regulations under it and National Treasury Instruction Notes. 16.2 Categories of Data Subjects and their Personal Information The Regulator may process records relating to suppliers, shareholders, contractors, service providers, staff and clients: Categories of Data Personal Information that may be processed Subjects Complainants: Natural Names and surname; contact details (contact Persons number(s), fax number, email address); Residential, postal or business address; Unique Identifier/Identity Number, and confidential correspondence. Complainants: Responsible Names of contact persons; Name of Legal Entity; parties, Juristic Persons / Physical and Postal address; contact details (contact Public Entities number(s), fax number, email address) and Registration Number. Foreign Persons / Entities Name; contact details (contact number(s), fax number, email address); physical and postal addresses. Intermediary / Advisor/ Names of contact persons; Name of Entity; Physical consultants and Postal address and contact details (contact number(s), fax number, email address); Registration Number. Contracted Service Providers Names of contact persons; name of entity; name of directors and shareholders, physical and postal address and contact details (contact number(s), fax number, email address); financial information; registration number; founding documents; tax related information; authorised signatories, broad-based black economic empowerment (B-BBEE) status, affiliates entities, business strategies. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Categories of Data Personal Information that may be processed Subjects Employees / Members / Gender, pregnancy; marital status; race, age, Committee Members language, education information (qualifications); financial information; employment history; ID numbers; physical and postal address; contact details (contact number(s), fax number, email address); criminal record; well-being and family members, medical, nationality, ethnic or social origin, physical or mental health, disability, biometric information of the person, employment history, professional affiliation and references. 16.3 The recipients or categories of recipients to whom the personal information may be supplied by the Regulator 16.3.1 The Regulator may supply the personal information of data subject to the Employees of the Regulator, as part of executing its statutory mandate. 16.3.2 The Regulator may supply the personal information of data subject to the Service Providers who render the following services:- 16.3.2.1 Capturing and organising of personal information; 16.3.2.2 Storing of personal information; 16.3.2.3 Sending of emails and other correspondence to the public; 16.3.2.4 Conducting due diligence checks; 16.3.2.5 Conducting criminal checks; 16.3.2.6 Conducting qualification verifications; DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 16.3.2.7 Forensic investigation and any other investigation relating to the activities of the Regulator; 16.3.2.8 Auditing; 16.3.2.9 Administration of the Provident, Pension Funds and medical aids; and 16.3.2.10 ICT Infrastructure. 16.4 The Regulator may also supply the personal information of data subjects to- 16.4.1 any person whom a complaint has been lodged against; 16.4.2 any regulatory authority or tribunal, in respect of any matter or part thereof, that falls under their jurisdiction; 16.4.3 law enforcement agencies, such as the National Prosecuting Authority or South African Police Service, for criminal investigation; and 16.4.4 to Courts, in respect of any matter taken on judicial review. 16.5 Planned transborder flows of personal information 16.5.1 The Regulator has not planned Transborder flows of personal information. However, should it become necessary to transfer personal information to another country for any lawful purposes, the Regulator will ensure that anyone to whom it pass personal information is subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection and the third party agrees to treat that personal information with the same level of protection as the Regulator is obliged under POPIA. 16.5.2 Any transfer of personal information cross border shall be with data subject’s consent, however should it not be reasonably practicable to obtain data subject’s consent, the Regulator shall transfer the personal information if- DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 16.5.2.1 it will be for the data subject’s benefit; and 16.5.2.2 the data subject would have given consent should it have been reasonably practicable to obtain such consent. 16.6 General Description of Information Security Measures 16.6.1 The Regulator continuously establishes and maintains appropriate, reasonable technical and organisational measures by taking appropriate, reasonable technical and organisational measures to prevent- 16.6.1.1 loss of, damage to or unauthorised destruction of personal information; and 16.6.1.2 unlawful access to or processing of personal information. 16.6.2 The Regulator has taken reasonable measures, as contained paragraph 16.6.3 below, to- 16.6.2.1 identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control; 16.6.2.2 establish and maintain appropriate safeguards against the risks identified; 16.6.2.3 regularly verify that the safeguards are effectively implemented; and 16.6.2.4 ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards. 16.6.3 Measures taken by the Regulator includes, amongst others:- DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 16.6.3.1 Access Control; 16.6.3.2 Data Encryption; 16.6.3.3 Defensive Measures; 16.6.3.4 Robust Monitoring, Auditing and Reporting capabilities; 16.6.3.5 Data Backups; 16.6.3.6 Anti-virus and Anti-malware Solutions; 16.6.3.7 Awareness and Vigilance; and 16.6.3.8 Agreements are concluded with Operators to implement security controls. 17. PRESCRIBED FEES 17.1 Section 22(1) of PAIA states that fees payable for access to records of the Regulator are to be prescribed. The prescribed fees are as set out in annexure B, attached hereto. 17.2 A requester who seeks access to any record may be required to pay a fee, unless an exempted, as referred to in paragraph 17.3 below. 17.3 The requester does not need to pay an access fee30 to a public body if:- 17.3.1 He or she is a single person whose annual income, after permissible deductions, such as PAYE and UIF, is less than R14 712 a year, or 17.3.2 He or she is married and the joint income with his or her partner, after permissible deductions, such as PAYE and UIF, is less than R27 192 per year. 18. AVAILABILITY OF THE MANUAL as per Government Notice R991 of 14 October 2005 DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 18.1 The Manual of the Regulator is made available in at least three official languages and braille. A copy will be available- 18.1.1 on the website of the Regulator at https://www.inforegulator.org.za; 18.1.2 at the head office of the Regulator for public inspection during normal business hours; 18.1.3 to any person upon request and upon the payment of a reasonable amount. 18.2 A fee for a copy of the Manual, as contemplated in annexure B, shall be payable per each A4-size photocopy made. 19. RECORDS THAT CANNOT BE FOUND OR DO NOT EXIST 19.1 Requesters have the right to receive a response in the form of an affidavit or affirmation where records cannot reasonably be located, but to which a requester would have had access had the record been available31. 19.2 Requesters also have the right to receive a response in the form of an affidavit or affirmation where requested records do not exist. 20. DISPOSAL OF RECORDS 20.1 The Regulator reserves the right to lawfully dispose of certain records in terms of authorities obtained from the National Archives and Records Service. 20.2 Requesters will be advised whether a particular record has been disposed of where this is relevant to the records requested. 20.3 In accordance with section 24(1) of POPIA, the Regulator may, upon receipt of the request from a data subject: - Section 23(1) of PAIA DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 20.3.1 correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or 20.3.2 destroy or delete a record of personal information about the data subject that the Regulator is no longer authorised to retain in terms of section 14 of POPIA32. 21. UPDATING OF THE MANUAL The Regulator will, if necessary, update and publish this Manual annually. Issued by INFORMATION REGULATOR 32 Section 14 (1) of POPIA- Subject to subsections (2) and (3), records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed . DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FORM 1 REQUEST FOR A COPY OF THE GUIDE [Regulations 2 and 3] TO: The Information Regulator P.O Box 31533 Braamfontein Johannesburg 2017 E-mail address: [email protected] Tel number: +27 (0) 10 023 5200 OR *The information officer ______________________ ______________________ ______________________ I, Full names: In my capacity as (mark with Information officer Other "x"): Name of *public/private body (if applicable) Postal Address: Street Address: E-mail address: Facsimile: Contact Tel.(B): Cellular: numbers: hereby request the following copy(ies) of the Guide: Language (mark with "X") No of copies Language(mark with "X") No of copies Sepedi, Sesotho Setswana siSwati Tshivenda Xitsonga Afrikaans English isiNdebele isiXhosa isiZulu Manner of collection (mark with "x"): Electronic communication Personal collection Postal address Facsimile (Please specify) Signed at ____________________ this ___________ day of ________________ 20 _________ _________________________________ Signature of requester * Delete whichever is not applicable DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FORM 2 REQUEST FOR ACCESS TO RECORD [Regulation 7] Note: 1. Proof of identity must be attached by the requester. 2. If requests made on behalf of another person, proof of such authorisation, must be attached to this form. TO: The information officer ______________________ ______________________ ______________________ ______________________ (Address) E-mail address: _____________________________ Fax number: _____________________________ Mark with an "X" Request is made in my own name Request is made on behalf of another person. PERSONAL INFORMATION Full names: Identity number: Capacity in which request is made (when made on behalf of another person): Postal Address: Street Address: E-mail Address: Tel. (B): Facsimile: Contact numbers: Cellular: Full names of person on whose behalf request is made (if applicable): Identity number: Postal Address: Street Address: E-mail Address: Contact numbers: Tel. (B): Facsimile Cellular: PARTICULARS OF RECORD REQUESTED Provide full particulars of the record to which access is requested, including the reference number if that is known to you, to enable the record to be located. (If the provided space is inadequate, please continue on a separate page and attach it to this form. All additional pages must be signed.) Description of record or relevant part of the record: DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Reference number, if available: Any further particulars of record: TYPE OF RECORD (Mark the applicable box with an "X") Record is in written or printed form Record comprises virtual images (this includes photographs, slides, video recordings, computer-generated images, sketches, etc) Record consists of recorded words or information which can be reproduced in sound Record is held on a computer or in an electronic, or machine-readable form FORM OF ACCESS (Mark the applicable box with an "X") Printed copy of record (including copies of any virtual images, transcriptions and information held on computer or in an electronic or machine-readable form) Written or printed transcription of virtual images (this includes photographs, slides, video recordings, computer-generated images, sketches, etc) Transcription of soundtrack (written or printed document) Copy of record on flash drive (including virtual images and soundtracks) Copy of record on compact disc drive(including virtual images and soundtracks) Copy of record saved on cloud storage server MANNER OF ACCESS (Mark the applicable box with an "X") Personal inspection of record at registered address of public/private body (including listening to recorded words, information which can be reproduced in sound, or information held on computer or in an electronic or machine-readable form) Postal services to postal address Postal services to street address Courier service to street address Facsimile of information in written or printed format (including transcriptions) E-mail of information (including soundtracks if possible) Cloud share/file transfer Preferred language: (Note that if the record is not available in the language you prefer, access may be granted in the language in which the record is available) PARTICULARS OF RIGHT TO BE EXERCISED OR PROTECTED If the provided space is inadequate, please continue on a separate page and attach it to this Form. The requester must sign all the additional pages. Indicate which right is to be exercised or protected: Explain why the record requested is required for the exercise or protection of the aforementioned right: DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FEES a) A request fee must be paid before the request will be considered. b) You will be notified of the amount of the access fee to be paid. c) The fee payable for access to a record depends on the form in which access is required and the reasonable time required to search for and prepare a record. d) If you qualify for exemption of the payment of any fee, please state the reason for exemption Reason: You will be notified in writing whether your request has been approved or denied and if approved the costs relating to your request, if any. Please indicate your preferred manner of correspondence: Electronic communication Postal address Facsimile (Please specify) Signed at ____________________ this ___________ day of ________________ 20 _________ ____________________________________________________ Signature of requester / person on whose behalf request is made ------------------------------------------------------------------------------------------------------------ ----------------------------- FOR OFFICIAL USE Reference number: Request received by: (state rank, name and surname of information officer) Date received: Access fees: Deposit (if any): ________________________________________ Signature of information officer DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FORM 4 LODGING OF AN INTERNAL APPEAL [Regulation 9] Reference number: _______________________ PARTICULARS OF PUBLIC BODY Name of public body: Name and surname of information officer: PARTICULARS OF COMPLAINANT WHO LODGES THE INTERNAL APPEAL Full names: Identity number: Postal address: Tel. (B): Facsimile: Contact numbers: Cellular: E-mail Address: Is the internal appeal lodged on behalf of another person? Yes No If answer is "yes", capacity in which an internal appeal on behalf of another person is lodged: (Proof of the capacity in which appeal is lodged, if applicable, must be attached.) PARTICULARS OF PERSON ON WHOSE BEHALF THE INTERNAL APPEAL IS LODGED (If lodged by a third party) Full names: Identity number: Postal address: Tel. (B): Facsimile: Contact numbers: Cellular: E-mail address: DECISION AGAINST WHICH THE INTERNAL APPEAL IS LODGED (mark the appropriate box with an "X") Refusal of request for access: Decision regarding fees prescribed in terms of section 22 of the Act: Decision regarding the extension of the period within which the request must be dealt with in terms of section 26(1) of the Act: Decision in terms of section 29(3) of the Act to refuse access in the form requested by the requester: Decision to grant request for access: GROUNDS FOR APPEAL (If the provided space is inadequate, please continue on a separate page and attach it to this form. all the additional pages must be signed.) State the grounds on which the internal appeal is based: State any other information that may be relevant in considering the appeal: DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 You will be notified in writing of the decision on your internal appeal. Please indicate your preferred manner of notification: Electronic communication Postal address Facsimile (Please specify) Signed at ____________________ this ___________ day of ________________ 20 _________ ____________________________________________________ Signature of appellant/Third party ------------------------------------------------------------------------------------------------------------ ----------------------------- FOR OFFICIAL USE OFFICIAL RECORD OF INTERNAL APPEAL Appeal received by: (state rank, name and surname of Information officer) Date received: Appeal accompanied by the reasons for the information officer's decision and, where Yes applicable, the particulars of any third party to whom or which the record relates, submitted by the information officer: No OUTCOME OF APPEAL Yes New decision Refusal of request for (if not access. Confirmed? No confirmed) Yes New decision Fees (Sec 22). (if not Confirmed? No confirmed) Yes New decision Extension (Sec 26(1)). (if not Confirmed? No confirmed) Yes New decision Access (Sec 29(3)). (if not Confirmed? No confirmed) Yes New decision Request for access (if not granted. Confirmed? No confirmed) Signed at ____________________ this ___________ day of ________________ 20 _________ ___________________________________ Relevant authority DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FORM 5 LODGING OF COMPLAINT [Regulation 10] Note: 1. This form is designed to assist the Requester (hereinafter referred to as “the Complainant”) in requesting a review of a public or private body’s response or non-response to a request for access to records under the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) (“PAIA”). Please fill out this form and send it to the Information Regulator or complete the online complaint form available at https://www.inforegulator.org.za. 2. PAIA gives a member of the public a right to file a complaint with the Information Regulator about any of the nature of complaints detailed in part E of this complaint form. 3. It is the policy of the Information Regulator to defer investigating or to reject a complaint if the Complainant has not first given the public or private body (herein after referred to as “the Body”) an opportunity to respond to and attempt to resolve the issue. To help the Body address your concerns prior to approaching the Information Regulator, you are required to complete the prescribed PAIA form and submit it to the Body. 4. A copy of this form will be provided to the Body that is the subject of your complaint. The information you provide on this form, attached to this form or that you supply later, will only be used to attempt to resolve your dispute, unless otherwise stated herein. 5. The Information Regulator will only accept your complaint once you confirm having complied with the prerequisites below. 6. Please attach copies of the following documents, if you have them:  Copy of the form to the Body requesting access to records;  The Body’s response to your complaint or access request;  Any other correspondence between you and the Body regarding your request;  Copy of the appeal form, if your compliant relate to a public body;  The Body’s response to your appeal;  Any other correspondence between you and the Body regarding your appeal;  Documentation authorizing you to act on behalf of another person (if applicable);  Court order or court documents relevant to your complaint, if any. 7. If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page. TO: The Information Regulator P.O Box 31533 Braamfontein, 2017 E-mail address: [email protected] Tel number: +27 (0) 10 023 5200 CAPACITY OF PERSON/PARTY LODGING A COMPLAINT (Mark with an "X") Complainant personally Representative of complainant Third party PREREQUISITES Did you submit request (PAIA form) for access to record of a Yes No public/private body? Has 30 days lapsed from the date on which you submitted your PAIA Yes No form? DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Did you exhaust all the internal appeal procedure against a decision of Yes No the Information officer of a public body? Have you applied to Court for appropriate relief regarding this matter? Yes No FOR INFORMATION REGULATOR’S USE ONLY Received by: (Full names) Position: Signature: Complaint accepted: Yes No Reference Number: Date stamp Other electronic communication Postal address Facsimile (Please specify) PART A PERSONAL INFORMATION OF COMPLAINANT Full names: Identity number: Postal Address: Street Address: E-mail Address: Contact Tel. (B): Facsimile numbers: Cellular PART B REPRESENTATIVE INFORMATION (Complete only if you will be represented. A Power of Attorney must be attached if complainant is represented, failing which the complaint will be rejected) Full names of representative: Nature of representation: Identity number/Registration number: Postal Address: Street Address: E-mail Address: Contact numbers: Tel. (B): Facsimile Cellular: PART C THIRD PARTY INFORMATION (Please attach letter of authorisation) Type of body: Private Public Name of *public/private body: Registration number (if any): Name, surname and title of person DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 authorised to lodge complaint: Postal Address: Street Address: E-mail Address: Contact Tel. (B): Facsimile numbers: Cellular PART D BODY AGAINST WHICH THE COMPLAINT IS LODGED Type of body: Private Public Name of *public/private body: Registration number (if any): Name, surname and title of person you dealt with at the public or private body to try to resolve your complaint or request to access of information: Postal Address: Street Address: E-mail Address: Contact Tel. (B): Facsimile numbers: Cellular Reference number given (if any): PART E COMPLAINT Tell us about the steps you have taken to try to resolve your complaint (Complaints should first be submitted directly to the public body for response and possible resolution; there are limited exceptions) Date on which request for access to records submitted: Please specify the nature of the right(s) to be exercised or protected, if a compliant is against a private body: Have you attempted to resolve the matter with the organisation? Yes No If yes, when did you receive it? (Please attach the letter to this application.) Did you appeal against a decision of the information officer of the Yes No public body? If yes, when did you lodge an appeal? Have you applied to Court for appropriate relief regarding this matter? Yes No DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 If yes, please indicate when was the matter adjudicated by the Court? Please attach Court Order, if there is any. PART F DETAILED TYPE OF ACCESS TO RECORDS (Please select one or more of the following to describe your complaint to the Information Regulator) Unsuccessful appeal: I have appealed against the decision of (Section 77A(2)(a) or the public body and the appeal is section 77A(3)(a) of unsuccessful. PAIA) Unsuccessful application I filed my appeal against the decision of for condonation: the public body late and applied for (Sections 77A(2)(b) and condonation. The condonation 75(2) of PAIA) application was dismissed. Refusal of a request for I requested access to information held by access: a body and that request was refused or (Section 77A(2)(c)(i) or partially refused. 77A(2)(d)(i) or 77A(3)(b) of PAIA) The body requires me to Tender or payment of the prescribed pay a fee and I feel it is fee. excessive: The tender or payment of a deposit. (Sections 22 or 54 of PAIA) Repayment of the The information officer refused to repay deposit: a deposit paid in respect of a request for (Section 22(4) of PAIA) access which is refused. The body decided to extend the time limit Disagree with time for responding to my request, and I extension: disagree with the requested time limit (Sections 26 or 57 of extension or a time extension taken to PAIA) respond to my access request. Form of access denied: I requested access in a particular and (Section 29(3) or 60(a) reasonable form and such form of access of PAIA) was refused. It is more than 30 days since I made my Deemed refusal: request and I have not received a (Section 27 or 58 of decision. PAIA) Extension period has expired and no response was received. Inappropriate disclosure Records (that are subject to the grounds of a record: for refusal of access) have (Mandatory grounds for inappropriately/unreasonable been refusal of access to disclosed. record) No adequate reasons My request for access is refused, and no for the refusal of access: valid or adequate reasons for the (Section 56(3)(a) of refusal, were given, including the PAIA) provisions of this Act which were relied upon for the refusal. Partial access to record: Access to only a part of the requested (Section 28(2) or 59(2) records was granted and I believe that of PAIA) more of the records should have been disclosed. Fee waiver: I am exempt from paying any fee and my (Section 22(8) or 54(8) request to waive the fees was refused. of PAIA) Records that cannot be The Body indicated that some or all of the found or do not exist: requested records do not exist and I believe that more records do exist. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 (Section 23 or 55 of PAIA) Failure to disclose The Body decided to grant me access to records: the requested records, but I have not received them. No jurisdiction (exercise The Body indicated that the requested or protection of any records are excluded from PAIA and I rights): disagree. (Section 50(1)(a) of PAIA) Frivolous or vexatious The Body indicated that my request is request: manifestly frivolous or vexatious and I (Section 45 of PAIA) disagree. Other: (Please explain): PART G EXPECTED OUTCOME How do you think the Information Regulator can assist you? Describe the result or outcome that you seek. PART H AGREEMENTS The legal basis for the following agreements is explained in the Privacy Notice on how to file your complaint document. In order for the Information Regulator to process your complaint, you need to check each one of the checkboxes below to show your agreement: I agree that the Information Regulator may use the information provided in my complaint to assist it in researching issues relating to the promotion of the right of access to information as well as the protection of the right to privacy in South Africa. I understand that the Information Regulator will never include my personal or other identifying information in any public report, and that my personal information is still protected by the Protection of Personal Information Act, 2013 (Act No. 4 of 2013). I understand that if I do not agree, the Information Regulator will still process my complaint. The information in this Complaint Form is true to the best of my knowledge and belief. I authorize the Information Regulator to collect my personal complaint information (such as the information about me in this complaint form) and use it to process my human rights complaint relating to the right of access to information and / or the protection of the right to privacy. I authorise anyone (such as an employer, service provider, witness) who has information needed to process my complaint to share it with the Information Regulator. The Information Regulator can obtain this information by talking to witnesses or asking for written records. Depending on the nature of the complaint, these records could include personnel files or employer data, medical or hospital records, and financial or taxpayer information. If any of my contact information changes during the complaint process, it is my responsibility to inform the Information Regulator; otherwise my complaint could experience a delay or even be closed. Signed at ____________________ this ___________ day of ________________ 20 _________ __________________________________________________ DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 Complainant/Representative/Authorised person of Third party ANNEXURE B FEES Fees in Respect of Public Bodies Item Description Amount 1. The request fee payable by every requester R100.00 2. Photocopy of A4-size page R1.50 per page or part thereof. 3. Printed copy of A4-size page R1.50 per page or part thereof. 4. For a copy in a computer-readable form on: (i) Flash drive (to be provided by requestor) R40.00 (ii) Compact disc  If provided by requestor R40.00  If provided to the requestor R60.00 5. For a transcription of visual images per A4-size page Service to be outsourced. Will 6. Copy of visual images depend on quotation from Service provider. 7. Transcription of an audio record, per A4-size page R24.00 8. Copy of an audio record on: (i) Flash drive (to be provided by requestor) R40.00 (ii) Compact disc  If provided by requestor R40.00  If provided to the requestor R60.00 9. To search for and prepare the record for disclosure for each R100.00 hour or part of an hour, excluding the first hour, reasonably required for such search and preparation. To not exceed a total cost of R300.00 10. Deposit: If search exceeds 6 hours One third of amount per request calculated in terms of items 2 to 8. 11. Postage, e-mail or any other electronic transfer Actual expense, if any. Fees in Respect of Private Bodies Item Description Amount 1. The request fee payable by every requester R140.00 2. Photocopy/printed black & white copy of A4-size page R2.00 per page or part thereof. 3. Printed copy of A4-size page R2.00 per page or part thereof. 4. For a copy in a computer-readable form on: (iii) Flash drive (to be provided by requestor) R40.00 (iv) Compact disc  If provided by requestor R40.00  If provided to the requestor R60.00 5. For a transcription of visual images per A4-size page Service to be outsourced. Will 6. Copy of visual images depend on quotation from Service provider. 7. Transcription of an audio record, per A4-size page R24.00 8. Copy of an audio record on: (v) Flash drive (to be provided by requestor) R40.00 (vi) Compact disc  If provided by requestor R40.00  If provided to the requestor R60.00 9. To search for and prepare the record for disclosure for each R145.00 hour or part of an hour, excluding the first hour, reasonably required for such search and preparation. To not exceed a total cost of R435.00 10. Deposit: If search exceeds 6 hours One third of amount per request calculated in terms of items 2 to 8. 11. Postage, e-mail or any other electronic transfer Actual expense, if any.". DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 FULL STRUCTURE OF THE INFORMATION REGULATOR INFORMATION REGULATOR (CHAIRPERSON AND MEMBERS) CHIEF EXECUTIVE OFFICER INTERNAL AUDIT Chief Financial Executive Officer: Provincial Chief Legal Officer: Executive Officer: Executive Officer: Officer Corporate Coordination (x 9) Legal Services Education and Executive Officer: Promotion of (CFO) Services (CS) Communication Protection of Access to (EDUCOM) Personal Information Act Information Act (PAIA) (POPIA) DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 INFORMATION REGULATOR (CHAIRPERSON AND MEMBERS) SECTION 49 AND 50 CHIEF EXECUTIVE OFFICER Purpose: To provide effective and efficient leadership in the day –to –day management of the Information Regulator COMMITTEES Functions: AUDIT COMMITTEE 1. Performing responsibilities as Head of Administration 2. Performing responsibilities of Accounting Officer in terms of sections 36- 44 of the PFMA 3. Performing duties required in terms of the provisions of POPIA 4. Performing duties required in terms of the provisions of PAIA 5. Execution of the Decisions of the Regulator and is for those purposes accountable to the Regulator as and when required. 6. Performing any other function as may be delegated by the Regulator in terms of the Charter of roles and responsibilities. 7. To provide legal advice and represent the Regulator in litigation matters before courts and negotiations. UNIT: INTERNAL AUDIT DIVISION: FINANCE DIVISION: CORPORATE SERVICES UNIT: PROVINCIAL COORDINATION Purpose: To assist the Accounting Officer in Purpose: To ensure the provision of corporate (X 9 OFFICES) Purpose: To provide internal and forensic discharging the financial management duties services and administrative support auditing services prescribed in terms of the Public Finance Purpose: To promote compliance to POPIA and Functions: Functions: PAIA and handle complaints in the Provinces Management Act and the Treasury Regulations 1. The conducting of financial and 1. Ensuring the managing of the provision of Human Resources Management and operational audits Functions: Functions: 2. The conducting legal compliance audits Development Services 1. The managing of the conducting of 1. The managing of management Accounting 3. The reporting of audit results 2. Ensuring the managing of the provision of investigation of complaints in terms of the activities administrative support services provisions of POPIA in the provinces 2. The managing of Financial Accounting activities 3. Ensuring the managing of the provision of 2. The managing of the conducting of 3. The managing of Supply Chain activities the information technology and information investigation of complaints in terms of the 4. The managing of assets technology analysis services provisions of PAIA in the provinces DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHAIRPERSON AND MEMBERS CHIEF EXECUTIVE OFFICER DIVISION: EDUCATION AND DIVISION: PROTECTION OF PERSONAL DIVISION: PROMOTION OF ACCESS TO COMMUNICATION INFORMATION ACT (POPIA) INFORMATION ACT (PAIA) Purpose: To provide strategic direction for Purpose: To ensure the promotion of the Purpose: To ensure the effective SUB-DIVISION: LEGAL SERVICES education and communication and to coordinate protection of personal information processed implementation of the promotion of the the POPIA and PAIA functions in the provinces by public and private bodies constitutional right of access to any information Purpose: To provide legal advice and represent held by the state and by any other person and the Regulator in litigation matters before courts Functions: that is required for the exercise of any rights and negotiations Functions: 1. The providing of policy and strategic direction on management of complaints Functions: Functions: 1. Ensuring the provision of education, and investigations awareness, and stakeholder management 1. The providing of policy and strategic 1. The managing of the provision of legal 2. Ensuring the managing of complaints services direction on complaints management to advice to the Regulator and the conducting of investigation of 2. Ensuring the provision of communication provincial offices 2. The drafting and negotiation of contracts complaints in terms of the provisions of and branding services 2. Ensuring the managing of complaints and management POPIA. 3. Ensuring the provision of public liaison and the conducting of investigation of 3. The drafting of legal opinions 3. The managing of Investigation of services complaints including those that are 4. The conducting of case investigation complaints that are initiated by the 4. Ensuring the provision of media relations, initiated by the Regulator in terms of the 5. The conducting of pre-litigation settlement Regulator. monitoring and analysis services provisions of PAIA discussions 4. The managing of the Investigation of 5. Ensuring the development of policy and the 3. Ensuring the managing of conducting of 6. The preparing for trial and appearing in breaches on the instruction of the conducting of applied research monitoring of compliance with and court and other fora Regulator enforcement of the provisions of the Act 7. The engaging in dispute resolution 5. The managing of the conducting of by public and private bodies on 8. The conducting of appeals monitoring of compliance with and instruction by the Regulator enforcement of the provisions of the Act 6. The managing of the development of and compliance with codes of conduct DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHAIRPERSON AND MEMBERS CHIEF EXECUTIVE OFFICER UNIT: GOVERNANCE UNIT: STRATEGIC PLANNING AND PERFORMANCE Purpose: To ensure the coordination and administrative support MONITORING of Governance Structures of the Regulator Purpose: To ensure the effective strategic planning and performance management Functions: Functions: 1. Co-ordinate all governance structures of the Regulator 2. Provide secretariat services to all governance committees and 1. Ensure that strategy is developed. Ordinary Meetings 2. Ensure the development of annual performance and 3. Ensure proper records keeping of governance structure. operational plans. 4. Coordinate international Relations. 3. Provide Monitoring, evaluation and reporting of the performance of the Regulator. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHIEF EXECUTIVE OFFICER DIVISION: EDUCATION AND COMMUNICATION Purpose: To provide strategic direction for the coordination and communication of the POPIA and PAIA functions in the provinces Functions 1. Ensuring the provision of education, awareness, and stakeholder management services 2. Ensuring the provision of communication and branding services 3. Ensuring the provision of public liaison services 4. Ensuring the provision of media relations, monitoring and analysis services 5. Ensuring the development of policy and the conduction of applied research Posts: 1 x Executive Officer (SL 15) 1 x Admin Officer (SL 7) SUBDIVISION: EDUCATION AND PUBLIC AWARENESS SUB-DIVISION: COMMUNICATION AND MEDIA RELATIONS Purpose: To provide communication, media relations, public liaison and Purpose: To manage the training and development of public branding services education and training of Information officers Functions: Functions 1. The development of the training programmes 1. The overseeing of the development and implementation of the 2. The implementation of public education and training communication and branding strategy and Plan programmes 2. The managing of the communication and branding strategy and 3. The coordination and facilitation of training and plan development of programmes 3. The managing of the public liaison (marketing) 4. The monitoring of the effectiveness of training and 4. The managing of media relations, monitoring and analysis services reporting DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION EDUCATION AND COMMUNICATION SUBDIVISION: STAKEHOLDER MANAGEMENT AND SUB-DIVISION: POLICY AND RESEARCH ENGAGEMENT Purpose: To manage the development of policy and the conducting of applied Purpose: To manage and implement stakeholder management research programmes Functions: Functions: 1. The managing of the undertaking of research on the desirability of acceptance of international instruments relating to the protection of personal 1. The managing of the development of stakeholder management information programmes 2. The managing of research on any other matter including necessary legislative amendments relating to the protection of personal information that 2. Provide customer care services. should be drawn to Parliament’s attention. 3. The managing of research to identify gaps in PAIA or any other laws and make recommendations to reform or amend PAIA or any other laws. 4. The managing of research to obtain advice from, consult with, and consider proposals or recommendations from parties in connection with the Regulator’s functions. 5. The managing of research to enquire into any matter including legislation, common law, practice and procedure related to PAIA. 6. The managing of the examination of proposed legislation and subordinate legislation or government policy that makes provision for the collection and disclosure of personal information and report the result of that examination to the Minister of Justice and Correctional Services 7. The managing for the developing of policy guidelines for public and private bodies 8. The managing of the reporting to Parliament on any policy matter affecting the protection of personal information including the need for legislative, administrative or other action necessary to protect the personal information of a data subject DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: PROTECTION OF PERSONAL INFORMATION ACT (POPIA) CHIEF EXECUTIVE OFFICER 1x Executive Officer 1 x Admin Officer SUBDIVISION: COMPLAINTS AND INVESTIGATIONS SUBDIVISION: MONITORING AND COMPLIANCE SUBDIVISION: SECURITY COMPROMISES Purpose: To manage the investigation of complaints Purpose: To manage monitoring and enforcement of compliance by public and Purpose: To manage and handle security compromises private bodies Functions Functions 1. The managing of the receiving and investigating of complaints about alleged Functions: 1. The managing of receiving of notifications of security compromises. violations of the protection of personal information of data subjects 1. The managing of the conducting of assessments of the processing of 2. The managing of the assessment of security compromises. 2. The managing of the providing of assistance with submission of complaints personal information by public and private bodies 3. Assessing compliance with Section 22 of POPIA. in writing 2. The managing of the monitoring of the use of unique identifiers of data 4. Conducting assessments on security in terms to Section 89 of POPIA. 3. The managing of the referring of complaints to other bodies subjects 5. The managing of conducting of investigation proceedings. 4. The managing of the conducting of pre-investigations 3. The managing of the maintaining of publishing and making available 6. The managing of monitoring and enforcement. 5. The managing of the resolving of complaints by means of dispute resolution prescribed registers 7. The managing of security audits. mechanisms. 4. The managing of the examining of proposed legislation that makes 8. Manage evidence analysis for security compromises. 6. The managing of conducting of investigations proceedings provision for the collection or disclosure of personal information. 7. The managing of referral of reports of the investigations to the Members for 5. The managing of reporting of the results of such examination to Parliament a decision 6. The managing of consultations with interested parties on any matter 8. The managing of objections to search and seizure. affecting personal information of a data subject 9. The managing of the referral of complaints or other matters to the 7. The managing of co-operating nationally and internationally on issues Enforcement Committee relating to the protection of personal information 10. The managing of the serving of notices 8. The managing of mediation between opposing parties with interests of 11. The managing of the administrative procedures related to Enforcement protection of personal information of a data subject Notices 9. The managing of issues relating to Codes of Conduct 10. The managing of facilitating of cross border co-operation 11. The managing of developing and updating of the existing Guide and making it available 12. The managing of publication of the manual DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: PROMOTION OF ACCESS TO INFORMATION ACT (PAIA) 1x Executive Officer 1 x Admin Officer SUBDIVISION: COMPLAINTS AND INVESTIGATIONS SUBDIVISION: MONITORING AND COMPLIANCE (PAIA) Purpose: To manage the investigation of complaints Purpose: To manage the monitoring of compliance by public and private bodies with the provisions of the PAIA Functions 9. The managing of the receiving and investigating of complaints about Functions: alleged violations of access to information 1. The managing of the obtaining of Annual Reports of public and private 10. The managing of the providing of assistance with submission of complaints bodies submitted to the SA Human Rights Commission in writing 2. The managing of the obtaining of the number, nature and outcome of 11. The managing of the resolving of complaints by means of dispute complaints deal with by the Public Protector South African resolution mechanisms. 3. The making of general inquiries on any matter, legislation, common law 12. The managing of the conducting of investigations and any practice and procedure concerning objects of PAIA 13. The managing of the updating of the existing Guide 4. The managing of the obtaining from heads off private bodies information 14. The managing of conducting of investigations proceedings about requests for access to records of the body 15. The managing of referral of reports of the investigations to the Members 5. The requiring of an official of a public body to afford the Regulator for a decision reasonable assistance for effective performance of its functions. 16. The managing of objections to search and seizure. 6. The managing of the updating of the existing guide 17. The managing of the referral of complaints or other matters to the Enforcement Committee 18. The managing of the serving of notices 19. The managing of the administrative procedures related to Enforcement Notices 20. The managing of the making available and allocation of the Manual DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHIEF EXECUTIVE OFFICER DIVISION: FINANCE Purpose: To provide direction in the management of financial resources within the Regulator. Functions: 1. The managing of Management Accounting services 2. The managing of Financial Accounting services 3. The managing of Supply Chain Management services UNIT: FINANCIAL ACCOUNTING UNIT: SUPPLY CHAIN MANAGEMENT UNIT: MANAGEMENT ACCOUNTING (BUDGETTING) Purpose: To render vide management accounting services Purpose: To render supply chain management Purpose: To render management accounting (budgeting services Functions: services) 1. The managing of transaction processing Functions: 2. The managing of related financial accounts and 1. The Managing of Acquisition and Demand Functions: services suspense control accounts 2. The Managing of Logistics 1. The managing of budget planning 3. The Managing of Disposal 2. The managing of budget control 4. The Managing of Assets 3. The preparing of quarterly and annual financial statements 5. The Managing of supply chain performance and contracts DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHIEF FINANCIAL OFFICER UNIT: SUPPLY CHAIN AND ASSETS MANAGEMENT Purpose: To manage supply chain management activities Functions: 1.The Managing of Acquisition and Demand services 2.The Managing of Logistics 3.The Managing of Disposal 4.The Managing of Assets 5. The Managing supply chain management performance and contracts SUB-UNIT: DEMAND AND ACQUISITION MANAGEMENT SUB-UNIT: LOGISTICS AND CONTRACT MANAGEMENT SUB-UNIT: ASSET AND DISPOSAL Purpose: To manage demand and acquisition in accordance with Purpose: To manage logistics and contracts in accordance with PFMA Purpose: To manage assets and Disposal prescripts Functions: Functions: 1. The implementing of preferential procurement and strategy Functions: 1. The maintaining of the assets register. 2.The administering of the bids process 2. The implementation of asset control utilisation systems 3. The determining of needs 3. The verification of asset purchases 1.The administration of utilisation of vehicles 4. The maintaining of the service providers’ database 1. 2.The administration of travelling on official trips 5 The rendering of secretarial service to Bid Committees (Evaluation, 2. 3.The administration of stores specification and adjudication 3. 4.The administration of contracts with service providers DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHIEF EXECUTIVE OFFICER DIVISION: CORPORATE SERVICES Purpose: To ensure the provision of corporate services and administrative support Functions: 1. Ensuring the managing of the provision of Human Resources Management and Development Services 2. Ensuring the managing of the provision of administrative support services 3. Ensuring the managing of the provision of the information technology services 4. Ensuring the managing of the provision of support in utilization of information and information technology UNIT: HUMAN RESOURCES MANAGEMENT AND UNIT: ADMINISTRATIVE SUPPORT SERVICES SUBDIVISION: INFORMATION AND COMMUNICATION DEVELOPMENT TECHNOLOGY Purpose: To manage the rendering of administrative support Purpose: To manage the rendering of Human Resources services management services and development Purpose: To manage the provision of information and communication Functions: technology (ICT) services Functions: 1. Rendering of facilities and office accommodation 1. The developing and implementing of a Human services Functions: Resources strategy and plan 2. Rendering of telephone services 1. The managing of the developing of the ICT Policy, Strategy and 2. The rendering of efficient human resource 3. Rendering of messenger services Guidelines in line with King IV, DPSA’s CGICT and COBIT administration services 4. Administering of Registry and Records Management 2. Render ICT Infrastructure of the Regulator 3. The management of sound employee relations, health, 5. Rendering of cleaning, food, and refreshment services 3. The managing of the developing of policies, procedures, standards wellness, and safety and systems ICT and knowledge management 4. The promotion of optimal human resource development 4. Developing and implementing information risk management, security and support protocols 5. The managing of contracts and agreements with suppliers of information management and technology goods and services 6. Ensure the provision of strategic analysis and guidance on complex, varied and sensitive technological issues relevant to the mandate of the Regulator. DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHIEF EXECUTIVE OFFICER UNIT: HUMAN RESOURCES MANAGEMENT AND DEVELOPMENT Purpose: To manage the rendering of Human Resources management services and development Functions: 1.Developing and implementing of a Human Resources strategy and plan 2. The rendering of efficient human resource administration services 3. The management of sound employee relations, health, wellness, and safety 4. The promotion of optimal human resource development SUB-UNIT: HUMAN RESOURCE STRATEGY, PLANNING, ORGANISATIONAL DEVELOPMENT AND SUB-UNIT: HUMAN RESOURCE ADMINISTRATION, UTILISATION DESIGN Purpose: To render efficient human resource administration and utilization services Purpose: To develop human resource strategies, plans and organizational design and development services Functions 1. The performance of recruitment, selection, appointment and other life cycle events of employees Functions 2. The rendering of compensation and the conditions of service 1. The development of human resource strategies 3. The provision of human resource service records 2. The provision of human resources information and knowledge resources services 4. The providing of the quality of work life processes 3. The monitoring and evaluating of the HR strategies. 5. The managing of the implementation of occupational health and safety programmes 4. The managing and allocation of posts 5. The provision of organisational development and design and job evaluation services SUB-UNIT: EMPLOYEE RELATIONS, Purpose: To provide sound employee relations services Functions: 1. The providing of labour relations services SUB-UNIT: STAFF TRAINING DEVELOPMENT AND PERFORMANCE MANAGEMENT AND 2. The providing of collective bargaining process services DEVELOPMENT SYSTEM Purpose: To manage the training and development of employees Functions: 1. The development of training and development policies and programmes 2. The conducting of skills audits 3. The coordination and facilitation of training and development programmes SUB-UNIT: OCCUPATIONAL HEALTH, SAFETY AND EMPLOYEE HEALTH AND WELLNESS 4. The implementation and monitoring of organizational HRD strategy 5. The development and management of departmental training database Purpose: To manage occupational health, safety and wellness programmes 6. The administration of bursaries and study assistance Functions: 7. The implementation of Skills Development Legislation 1. To co-ordinate occupational health and safety 8. The implementation of Learnership and Internship programmes 2. To render employee health and wellness programme 9. The implementation of a performance management system DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: CORPORATE SERVICES UNIT: HUMAN RESOURCES MANAGEMENT AND DEVELOPMENT SUB-UNIT: HUMAN RESOURCE STRATEGY, PLANNING, SUB-UNIT: HUMAN RESOURCE SUB-UNIT: EMPLOYEE HEALTH AND ORGANISATIONAL DEVELOPMENT AND DESIGN ADMINISTRATION AND UTILISATION WELLNESS AND OCCUPATIONAL SAFETY Purpose: To render human resource policy and planning as well as monitoring and evaluation Purpose: To provide human resource staffing, conditions of service and Functions: remuneration services 1.Ensure the assessment of human resource demand, supply and financial Functions constraints. Purpose: To manage personnel records 1. The recruitment of human resources Functions: 2.Ensure the development, implementation and maintenance of a monitoring and 2. The selection of human resources evaluation system. 1. The administration of compensation for injury on duty 3. The appointment of selected staff 2. The design, implementation and monitoring of 3.The monitoring and evaluation of service delivery performance. 4. The provision of employee cycle management 4.Ensure the analysis and monitoring of strategic information. employee assistance and wellness programmes. 5. The capturing and processing of employee benefits 5.Ensure monitoring of the implementation of organisational HR strategies and 6. The administration of remuneration matters 3. The promotion of good health and safety within the policies (EE, Remuneration, Recruitment) 7. The management of the HR registry organization 4. The design and implementation of programmes to address environment risks. 5. The managing of occupational hygiene within the Regulator 6. The overseeing of health and productivity in the Regulator DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: CORPORATE SERVICES UNIT: HUMAN RESOURCES MANAGEMENT AND DEVELOPMENT SUB-UNIT: EMPLOYEE RELATIONS Purpose: To provide sound employee relations services Functions: 1. The providing of labour relations services 2. The providing of collective bargaining process services SECTION: LABOUR RELATIONS SECTION: COLLECTIVE BARGAINING Purpose: To manage labour relations matters Purpose: To manage collective bargaining Functions: Functions: 1. The development and implementation of labour relations policies, 1. The negotiating and management of agreements in the codes and practices. Bargaining Chamber 2. The handling of grievances, disputes, and disciplinary matters 2. The communicating of resolutions and decisions to employees 3. The provision of labour relations support to the organisation on 3. The coordinating of the employee caucus processes. labour relations issues 4. The facilitation of capacity building programmes in the labour relations field DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: CORPORATE SERVICES UNIT: HUMAN RESOURCES MANAGEMENT AND DEVELOPMENT SUB-UNIT: STAFF TRAINING DEVELOPMENT AND PERFORMANCE MANAGEMENT AND DEVELOPMENT SYSTEM Purpose: To manage the training and development of employees Functions: 1. The development of training and development policies and programmes 2. The conducting of skills audits 3. The coordination and facilitation of training and development programmes 4. The implementation and monitoring of organizational HRD strategy 5. The development and management of departmental training database 6. The administration of bursaries and study assistance 7. The implementation of Skills Development Legislation 8. The implementation of Learnership and Internship programmes 9. The implementation of a performance management system SECTION: PERFORMANCE MANAGEMENT Purpose: To manage and implement a performance management system SETION: HUMAN RESOURCE DEVELOPMENT Functions: Purpose: To manage the training and development of employees 1. The development and monitoring of a performance management framework Functions: 2. The administration of performance rewards and expenditure 1. The development of training and development policies and programmes 3. The coordination of probationary reports 4. The maintenance of a performance management database 2. The conducting of skills audits 5. The provision of technical advice and assistance on performance management 3. The coordination and facilitation of training and development programmes issues 4. The implementation and monitoring of organizational HRD strategy 5. The development and management of departmental training database 6. The administration of bursaries and study assistance 7. The implementation of Skills Development Legislation 8. The implementation of Learnership and Internship programmes 9. The implementation of a performance management system DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: CORPORATE SERVICES UNIT: ADMINISTRATIVE SUPPORT Purpose: To manage the rendering of administrative support services Functions: 1. Rendering of facilities and office accommodation services 2. Rendering of telephone services 3. Rendering of messenger services 4. Administering of Registry and archive services 5. Rendering of cleaning, food and refreshment services 6. Receive and register complaints SUB-UNIT: FACILITIES AND AUXILLIARY SERVICES SUB-UNIT : RECORDS MANAGEMENT AND REGISTRATION SERVICES PURPOSE: To render facilities management and auxiliary services PURPOSE: To render records management and registration services Functions: Functions: 1. Render facilities and office accommodation services 1. Render records management services 2. Render Cleaning, food and refreshment services 2. Render registry services 3. Registration of all Complaints 4. Registration of all other Compliance Applications DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: CORPORATE SERVICES UNIT: ADMINISTRATION SUPPORT SUB-UNIT : RECORDS MANAGEMENT AND REGISTRATION SERVICES PURPOSE: To render records management and registration services Functions: 1. Render records management services 2. Render registry services 3. Registration of all Complaints 4. Registration of all other Compliance Applications SUB-UNIT : RECORDS MANAGEMENT SUB-UNIT : REGISTRATION SERVICES PURPOSE: To render records management PURPOSE: To render registration services Functions: Functions: 1. Render records management services 1. Registration of all Complaints 2. Render messenger services 2. Registration of all other Compliance Applications DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 DIVISION: CORPORATE SERVICES UNIT: ADMINISTRATION SUPPORT SUBDIVISION: INFORMATION AND COMMUNICATION TECHNOLOGY Purpose: To manage the provision of information and communication technology (ICT) services Functions: 1. The managing of the developing of the ICT Policy, Strategy and Guidelines in line with King IV, DPSA’s CGICT and COBIT information and communication technology infrastructure of the Regulator 2. The managing of the developing of policies, procedures, standards and systems for information technology, information and knowledge management 3. Developing and implementing information risk management, security and support protocols 4. The managing of contracts and agreements with suppliers of information management and technology goods and services 5. Ensure the provision of strategic analysis and guidance on complex, varied and sensitive technological issues relevant to the mandate of the Regulator UNIT: ICT INFRASTRUCTURE AND ICT RISK MANAGEMENT UNIT: INFORMATION TECHNOLOGY ANALYSIS UNIT: ICT STRATEGIES, GOVERNANCE AND KNOWLEDGE Purpose: To manage the provision of ICT Governance services MANAGEMENT Purpose: To manage the provision of research and guidance on complex, varied and sensitive technological issues relevant to the Functions: Purpose: Provision of Information Communication Strategies and mandate of the Information Regulator 1. Ensuring the rendering of ICT infrastructure and maintenance Governance services Functions: 1. Conduct research on technological trends and developments in 2. Ensuring the rendering of ICT architecture and project management Functions: electronic platforms and digital media services 2. The managing of research to assess the impact of technology on 3. Ensuring the management of the ICT contracts and agreements protection of personal information in the digital world 1. Developing and implementing of the Information and Communication with suppliers Technology Strategies and plans in accordance with the DPSA’s 3. The managing of research undertaken to monitor developments in 4. Ensuring the rendering of risk management, security, and support CGICT and COBIT frameworks information processing and computer technology protocols 2. Manage the development of policies, procedures, standards and 4. Providing the Regulator with advice relating to technological systems for information technology, information and knowledge matters management DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997 CHAIRPERSON AND MEMBERS CHIEF EXECUTIVE OFFICER UNIT: PROVINCIAL COORDINATION (X9 PROVINCES) Purpose: To provide direction in the administration of the provincial offices and the performance of functions to promote compliance with the provisions of the POPIA and PAIA) in the provinces Functions: 1. The performing of Head of administration functions in the provinces 2. The overseeing of managing of the conducting of investigation of complaints in terms of the provisions of POPIA in the provinces 3. The overseeing of managing of the conducting of investigation of complaints in terms of the provisions of PAIA in the provinces SUBUNIT: POPIA AND PAIA COORDINATION Purpose: To promote compliance to POPIA and PAIA and handle complaints Functions: 1. The managing of the conducting of investigation of complaints in terms SUBUNIT: OFFICE ADMINISTRATION AND SUPPORT of the provisions of POPIA in the provinces 2. The managing of the conducting of investigation of complaints in terms of the provisions of PAIA in the provinces Purpose: To provide office support services to the Provincial Office Functions: 1. The rendering of general administration support services 2. The performing of financial administration tasks 3. The performing of supply chain management related tasks 4. The performing of Human Resource management tasks 5. The rendering of secretarial, registry and messenger services DocuSign Envelope ID: 9547CDFE-F529-44EF-B313-AB179BCA4997

---