PAIA manual

This is the manual of forge, compiled under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA"). It follows the manual template published by the Information Regulator and the Regulations relating to the Promotion of Access to Information, 2021 ("the PAIA Regulations").

forge is a private body for the purposes of PAIA. Its legal name, the head of the private body and their postal address, street address, telephone number and email address are set out in the particulars table in the Information Officer section below. forge's full disclosure under the Electronic Communications and Transactions Act is in our terms.

What this manual does

The manual tells you:

• who to send a request to, and how to reach them;
• where to find the Information Regulator's guide on using PAIA;
• the categories of records forge holds, and which of them are available without a formal request;
• how to request a record, what it costs, how long it takes and why a request may be refused;
• what you can do if you are unhappy with a decision;
• how forge processes personal information, as POPIA requires this manual to describe.

Reservations

• A category is not a promise. Listing a category of record does not mean that a record in that category exists, that forge holds it, or that it will be released. Every request is decided on its own merits under PAIA.
• No waiver. Nothing in this manual waives legal privilege, confidentiality owed to clients, partners or other third parties, or any ground of refusal that PAIA allows or requires forge to rely on.
• Prescribed form. A request should be made on the prescribed form and addressed to the Information Officer as set out in this manual. A request that reaches forge by another route will be passed to the Information Officer, and the time limits run from when forge receives it, as PAIA provides.
• PAIA is not a substitute for discovery. PAIA does not apply to a record requested for the purpose of criminal or civil proceedings after those proceedings have begun, where production is otherwise provided for by law (section 7 of PAIA).
• Not advice. This manual describes the law in general terms. It is not legal advice to any requester.

Every request for access to a record, and every question about this manual, should be addressed to forge's Information Officer. This is the only place on the site where these particulars are kept; other pages link here.

Particulars of forge

The head of the private body is forge's Information Officer, unless a different person is designated below (section 1 of PAIA, and sections 55 and 56 of POPIA).

Information Officer

Deputy Information Officer

Information Regulator registration reference: TO BE SUPPLIED — Information Officer's registration reference with the Information Regulator.

For anything other than a request under PAIA or POPIA, use our contact page. A request that reaches forge some other way will be passed to the Information Officer, and the time limits run from when forge receives it, as PAIA provides.

Section 10 of PAIA requires the Information Regulator to publish a guide explaining how to use PAIA and POPIA to exercise the rights they give. The guide is available in every official language of South Africa.

The guide sets out, among other things, the objects of PAIA and POPIA, how to make a request, the help available from the Regulator, the remedies available, and the fees payable.

You can read or download the guide on the Information Regulator's website. You may also inspect a copy, or ask for one, from the Information Officer during normal business hours.

Contacting the Information Regulator

forge is a small information-engineering consultancy in KwaZulu-Natal, working with a collective of partner companies. The records below are described by subject and category, as section 51 of PAIA requires. Some categories apply only once the circumstance they describe exists — employee records, for example, only once forge employs staff.

A category listed here is not a statement that any particular record exists, and does not mean that access will be given. Every request is considered against the grounds of refusal in PAIA.

forge has not published a notice under section 52 of PAIA describing categories of records that are automatically available.

The information published on this website is available to anyone, without a request under PAIA and without a fee. That includes the descriptions of forge's services, this manual, our terms, our privacy notice and our cookie notice.

Any other record must be requested under the procedure in this manual.

forge keeps records in terms of the following legislation, to the extent that each applies to it. Some of these records may be available to specific persons under the statute concerned rather than under PAIA. The list is not exhaustive.

The prescribed form

A request must be made on the prescribed form, Form 2 — Request for access to record (Regulation 7 of the PAIA Regulations), available from the Information Regulator's PAIA forms page. Address the completed form to the Information Officer at the postal address, street address or email address given in the Information Officer section above.

A request that reaches forge at any other address will be forwarded to the Information Officer. The time limits below run from when forge receives the request, as PAIA provides.

What the request must contain

Under section 53 of PAIA, the request must:

1. give enough detail for the Information Officer to identify the record requested and the requester;
2. state the form in which access is wanted;
3. give a postal address, email address or fax number in South Africa to which the reply can be sent;
4. identify the right the requester seeks to exercise or protect, and explain why the record is required to exercise or protect that right (section 53(2)(d)) — a request that does not do this may be refused;
5. if the requester wants to be told of the decision in another manner as well, say so and give the necessary particulars;
6. if the request is made on behalf of another person, give proof of the capacity in which it is made.

Proof of identity must accompany the form. A requester who cannot read or write, or who has a disability, may make the request orally, and the Information Officer will complete the form on their behalf.

Time limits

• The Information Officer will decide the request within 30 days of receiving it in the prescribed form (section 56).
• That period may be extended once, by up to 30 days, where the request is for a large number of records, requires a search through records held elsewhere, or requires consultation that cannot reasonably be completed in time, or where the requester agrees (section 57). The requester will be told of the extension, the reasons for it, and the right to lodge a complaint about it.
• If no decision is given within the time allowed, the request is regarded as refused (section 58).
• The time limits do not run while a request fee or deposit that is due remains unpaid.

Records that cannot be found

If a record cannot be found, or does not exist, the Information Officer will tell the requester by affidavit or affirmation, setting out the steps taken to find it (section 55).

Notice to third parties

If a request is for a record that may contain a third party's personal, commercial or confidential information, forge must take all reasonable steps to inform that third party within 21 days (section 71). The third party then has 21 days to make representations or to consent (section 72), and forge decides the request within 30 days of notifying the third party (section 73). The third party is told of the decision and of its right to lodge a complaint with the Information Regulator or apply to court.

Access and severance

If access is granted, the requester is told of the access fee, the form of access and the right to complain about either. Where part of a record must or may be refused, forge will give access to the rest of it, if the refused part can reasonably be severed (section 59).

The fees below are those prescribed for private bodies in Annexure B to the PAIA Regulations, made by the Minister of Justice and Correctional Services (GNR 757 of 27 August 2021). The Information Regulator publishes the fee schedule on its website. If the prescribed fees change, the fee in force at the time of the request applies.

How fees work

• Request fee. The request fee must be paid before the request is processed. A personal requester — someone asking for a record containing their own personal information — does not pay it.
• Deposit. If the search for and preparation of the record will take more than six hours, the Information Officer will ask the requester to pay a deposit of one third of the search and preparation fees (items 2 to 8 of the fee schedule) before the search begins.
• Access fee. Access is given only once the access fee has been paid. If the request is refused, any deposit paid is refunded.
• Exemptions. The Minister may exempt categories of requester from fees. A requester who believes they are exempt should say so on the form.
• Complaints. A requester may lodge a complaint with the Information Regulator, or apply to court, about the request fee, the deposit or the access fee.

forge will refuse access to a record where PAIA requires it to, and may refuse it where PAIA allows it to. The grounds are set out in Chapter 4 of Part 3 of PAIA. In summary, a record may be refused where access would:

Public-interest override

Despite the grounds above, forge must give access to a record if disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public-safety or environmental risk, and the public interest in disclosure clearly outweighs the harm the ground of refusal is meant to prevent (section 70).

Reasons

If a request is refused, the Information Officer will give adequate reasons, identify the provisions of PAIA relied on, and tell the requester of the right to lodge a complaint with the Information Regulator or apply to court.

forge is a private body, and PAIA provides no internal appeal against the decision of a private body. A requester or third party aggrieved by a decision of forge — to refuse a request, about a fee or deposit, about an extension of time, or about the form of access — should follow these steps, in this order:

1. Lodge a complaint with the Information Regulator on the prescribed complaint form, within 180 days of the decision (sections 77A and 77B).
2. Apply to a court for appropriate relief (section 78), once the complaint procedure before the Information Regulator has been exhausted — subject to the exceptions in the Act.

The Information Regulator's contact details are in the section on its guide above, and the complaint form is on its PAIA forms page.

Section 51(1)(c) of PAIA, as amended by POPIA, requires this manual to describe how forge processes personal information. The summary below meets that requirement. The full description — what forge collects, why, on what lawful basis, how long it is kept and your rights as a data subject — is in our privacy notice, which governs wherever more detail is needed.

Purpose of processing

forge processes personal information to respond to enquiries; to propose, agree, deliver and invoice its services; to work with the partner companies in its collective and with suppliers; to employ staff, where it does; to meet its legal, tax and regulatory obligations; and to protect its legitimate interests, including in legal proceedings.

Categories of data subjects and their information

Recipients

Where needed for the purposes above, personal information may be shared with partner companies in the collective working on an engagement; with forge's professional advisers, auditors and insurers; with service providers that host, store or carry forge's information; and with regulators, the South African Revenue Service, courts and other authorities where the law requires it.

Planned cross-border flows

Some of forge's service providers store or process information outside South Africa. Messages sent to forge by WhatsApp are carried by Meta, whose infrastructure is outside South Africa. forge's hosting and email providers, and where they store information, are named in our privacy notice. Any transfer outside South Africa is made only on a basis permitted by section 72 of POPIA, as described in our privacy notice.

Security measures

forge takes appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it, as section 19 of POPIA requires — in summary, collecting as little as it can, limiting access, binding its providers by contract and using strong authentication. The measures are set out in our privacy notice.

Requesting your own personal information

A data subject may ask forge whether it holds their personal information, and for a record of it, under section 23 of POPIA. That request is made under the procedure in this manual, and a personal requester pays no request fee. Requests to correct or delete personal information are dealt with in our privacy notice.

This manual is available:

• on this website, at weforge.africa/legal/paia;
• in print, for inspection free of charge, during normal business hours at the street address in the particulars table in the Information Officer section above;
• to the Information Regulator, on request.

A printed copy may be requested from the Information Officer, subject to the copying fee set out above.

forge will update this manual whenever the information in it changes. The date of the latest revision is shown at the top of this manual.