PAIA and POPI Manual

Manual Overview

THIS MANUAL WAS PREPARED IN ACCORDANCE WITH SECTION 51 OF THE PROMOTION OF ACCESS TO INFORMATION ACT, 2000 (The Act) AND TO ADDRESS REQUIREMENTS OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (POPI)

This manual applies to:

PCN IT MANAGEMENT (PTY) LIMITED

Registration number: 2017/526083/07

Registered office address: 75 Roeland Street, Gardens, Cape Town, 8001

1. Introduction

The Promotion of Access to Information Act, 2000 (the Act) gives third parties the right to approach private bodies and the government to request information held by them, which is required in the exercise and/or protection of any rights.

On request, the private body or government is obliged to release such information unless the Act expressly states that the records containing such information may or must not be released. This manual informs requestors of procedural and other requirements which a request must meet as prescribed by the Act.

2. Guide of Human Rights Commission / Information Regulator

A guide to the Act (as contemplated under section 10 of the Act) is available from the South African Human Rights Commission. The guide contains such information as may reasonably be required by a person who wishes to exercise any right contemplated in the Act.

The South African Human Rights Commission

PAIA Unit (Research and Documentation Department)

Postal address: Private Bag 2700, Houghton, 2041

Telephone: +27 11 484-8300

Fax: +27 11 484-7146

Website: www.sahrc.org.za

Email: PAIA@sahrc.org.za

The Information Regulator (South Africa)

Address: SALU Building, 316 Thabo Sehume Street, Pretoria

Contact Person: Ms. Mmamoroke Mphelo

Tel: 012 406 4818

Fax: 086 500 3351

Email: inforeg@justice.gov.za

3. Access to Records Held by the Company

Records held by the Company may be accessed on request only once the requirements for access have been met. A requester is any person making a request for access to a record of the Company and in this regard, the Act distinguishes between two types of requesters:

Personal Requester

A personal requester is a requester who is seeking access to a record containing personal information about the requester. Subject to the provisions of the Act and applicable law, the Company will provide the requested information, or give access to any record with regard to the requester's personal information. The prescribed fee for reproduction of the information requested will be charged by the Company.

Other Requester

This requester (other than a personal requester) is entitled to request access to information pertaining to third parties. However, the Company is not obliged to grant access prior to the requester fulfilling the requirements for access in terms of the Act. The prescribed fee for reproduction of the information requested will be charged by the Company.

Request Procedure

A requester must comply with all the procedural requirements contained in the Act relating to a request for access to a record. A requester must email the company, using the company's email address with the following details:

Required Information:

The record or records requested
The identity of the requester
What form of access is required
The postal address or fax number of the requester

A requester must state that he or she requires the information in order to exercise or protect a right, and clearly state what the nature of the right is so to be exercised or protected. The requester must also provide an explanation of why the requested record is required for the exercise or protection of that right.

Processing Timeline

The Company will process a request within 30 (thirty) days, unless the requestor has stated special reasons which would satisfy the information officer that circumstances dictate that this time period not be complied with. The requester shall be informed in writing whether access has been granted or denied.

5. Categories of Records Held by the Company

Companies Act Records

• Documents of incorporation
• Memorandum of Incorporation
• Minutes of Board of Directors meetings
• Records relating to appointments
• Share Register and statutory registers

Financial Records

• Annual Financial Statements
• Tax Returns
• Accounting Records
• Banking Records and Statements
• Electronic banking records
• Asset Register
• Invoices

Tax Records

• PAYE Records
• Employee tax documents
• SARS payment records
• VAT records
• Skills Development Levies
• UIF records
• Workmen's Compensation

Personnel Documents

• Employment contracts
• Employment Equity Plan
• Disciplinary records
• Salary records
• Leave records
• Training records and manuals

6. Processing of Personal Information

Purpose of Processing

The Company uses Personal Information under its care in the following ways:

• Rendering service according to instructions given by clients
• Staff administration
• Keeping of accounts and records
• Complying with tax laws

Categories of Data Subjects

The Company may possess records relating to suppliers, shareholders, contractors, service providers, staff and clients:

Clients (Juristic Persons)

Names of contact persons; Physical and Postal addresses; Financial information; Registration numbers; Tax information

Employees / Directors

Personal details; Employment history; Financial information; Contact details; ID numbers

Information Security Measures

The Company employs up to date technology to ensure the confidentiality, integrity and availability of the Personal Information under its care. Measures include:

Technical Measures

• Firewalls
• Virus protection software
• Regular security updates
• Secure IT infrastructure setup

Access Controls

• Logical access control
• Physical access control
• Contracted security controls
• Service provider agreements

7. Remedies Available if Request is Refused

Internal Remedies

The Company does not have internal appeal procedures. As such, the decision made by the information officer pertaining to a request is final, and requestors will have to exercise such external remedies at their disposal if a request is refused.

External Remedies

A requestor that is dissatisfied with the information officer's refusal to disclose information, may within 30 (thirty) days of notification of the decision, apply to a court for relief. For purposes of the Act, courts that have jurisdiction over these applications are the Constitutional Court, the High Court or another court of similar status.