PAIA Manual

Introduction

This PAIA Manual is prepared by BuildsByBuchanan (PTY) LTD ("BuildsByBuchanan", "we", "us") in compliance with Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as required by the South African Information Regulator.

PAIA gives every person the right to request access to records held by a private body — subject to certain limitations. This manual explains what records we hold, how to make a request, and what fees may apply.

A copy of this manual is available free of charge on our website at buildsbybuchanan.com/paia.html. A physical copy may be requested by contacting us directly.

Core Compliance Requirements

To be truly compliant beyond registration, your organisation must implement several key technical and administrative measures:

Draft a PAIA Manual

Every business must have a Promotion of Access to Information Act (PAIA) manual that explains how people can access the records you hold. This must be available at your office and on your website.

Update Privacy Policies

Clearly state what data you collect, why you collect it, and how you protect it on your website and in internal documents.

Conduct a Risk Assessment

Identify where you store personal data and evaluate potential security gaps — such as weak passwords or lack of encryption.

Staff Training

Ensure all employees understand their responsibilities under POPIA, as "ignorance of the law" is not a valid defence during an inspection.

Breach Response Plan

Establish a procedure to immediately notify both the Information Regulator and affected individuals if a data breach occurs.

Information Officer

In terms of POPIA, the head of BuildsByBuchanan is the Information Officer, responsible for:

• Ensuring compliance with POPIA and PAIA
• Handling requests for access to information
• Liaising with the Information Regulator of South Africa
• Managing data breach notifications

Note: The Information Officer is registered with the Information Regulator of South Africa. Registration details are available on request or via inforegulator.org.za.

About the Business

Records Held

BuildsByBuchanan holds the following categories of records. Not all records are accessible — access may be refused on the grounds set out in Section 7 below.

Client Records

• Client contact details (name, email, phone number)
• Project briefs, scopes of work, and specifications
• Quotations, invoices, and payment records
• Project correspondence (email, WhatsApp, written)
• Signed agreements or letters of engagement
• Deliverables and source files produced for clients

Website & Platform Records

• Website contact form submissions
• Analytics data collected via our website (aggregated)
• Cookie consent preferences (stored locally in your browser — not on our servers)

Business & Financial Records

• General business correspondence
• Financial records and tax documentation
• Supplier and contractor agreements

Records Not Held

BuildsByBuchanan does not hold or process:

• Credit card numbers or banking details (payments processed by third-party providers)
• National identity numbers, unless voluntarily provided for a specific purpose
• Health, biometric, or other sensitive personal information as defined by POPIA

Records Held by Third Parties

Some records relating to your use of our services may be held by our service providers. Relevant third parties include:

For records held by these parties, you should contact them directly using their published PAIA / data access processes.

How to Request Access to Records

Any person (data subject or otherwise) may request access to records held by BuildsByBuchanan in terms of PAIA. Requests must be made in writing using the prescribed Form C (available from inforegulator.org.za) or by contacting us directly as set out below.

What your request must include

• Your full name, contact details, and identity number (for verification)
• A description of the record(s) you require access to
• The form in which you would like access (electronic copy, printed copy, etc.)
• Whether you are requesting the record for yourself or on behalf of another person (with proof of authority)
• Your reason for requesting the record (required unless the record relates to your own personal information)

Submit your request to

Response timeline

We will acknowledge receipt of your request within 5 business days. We must grant or refuse access within 30 days of receiving the request, unless an extension is required (in which case we will notify you).

If the request is for your own personal information, we will prioritise a faster response wherever possible.

Fees

The following fees apply to PAIA requests, as prescribed by the Minister of Justice under the Regulations to PAIA:

You may be required to pay a deposit before we begin processing a large or complex request. We will advise you if this applies.

Grounds for Refusal

We may refuse access to records on the following grounds, as provided for in PAIA:

• Mandatory refusal: Where disclosure would unreasonably disclose personal information about a third party who has not consented (Section 63)
• Commercial information: Where disclosure would harm the commercial interests of a third party or of BuildsByBuchanan itself (Sections 64–65)
• Confidential communications: Legal privilege, communications in confidence (Section 66–69)
• Safety and security: Where disclosure would endanger the safety of any person (Section 70)
• Record does not exist: If the requested record cannot be found or does not exist (Section 55)
• Manifestly frivolous or vexatious requests (Section 45)

If we refuse access, we will provide you with written reasons and advise you of your right to appeal or seek judicial review.

Third-Party Notice

If a request for access concerns a record that contains personal information about a third party (i.e., someone other than the requester), we are required by PAIA to notify that third party of the request before granting or refusing access.

The third party has the right to make representations before a decision is taken, which may delay our response by up to 30 additional days.

Contact & Remedies

For all PAIA and POPIA-related enquiries, contact our Information Officer:

Your remedies

• If you are unhappy with our decision, you may complain to the Information Regulator at inforegulator.org.za
• You may apply to a court for review of our decision to refuse access
• In the case of a POPIA violation (not just PAIA), the Information Regulator may investigate and impose penalties

We take all PAIA requests seriously and are committed to responding promptly and transparently. If you are unsure how to submit a request or what records to ask for, contact us and we will assist you.