PAIA and POPIA Manual

The Promotion of Access to Information Act, No. 2 of 2000 (“PAIA”) gives effect to the constitutional right of access to any information held by the State, and to any information held by another person that is required for the exercise or protection of any rights.

The Protection of Personal Information Act, No. 4 of 2013 (“POPIA”) complements PAIA by protecting the constitutional right to privacy. It requires that personal information be processed responsibly, securely and transparently.

This manual is Zorah Technologies’ information manual. It sets out the procedure to follow if you want access to a record we hold, and how we process personal information under POPIA.

Requests under this manual go to the Information Officer. This is the person to contact for anything in sections 07 to 09.

The Information Regulator has, under section 10 of PAIA, published a revised guide on how to use the Act. It is written for the person making the request rather than for the organisation receiving it, and it is the better starting point if this is unfamiliar.

• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za

Section 51(1)(c). These are already public. You do not need to complete a form or pay a fee to see them.

• Product brochures and marketing material
• Everything published on this website
• Any financial disclosures or annual reports we have made public

We keep records because these Acts require it. Listing them here does not make those records automatically available; it tells you what exists and why.

• Basic Conditions of Employment Act, No. 75 of 1997
• Companies Act, No. 71 of 2008
• Compensation for Occupational Injuries and Diseases Act, No. 130 of 1993
• Employment Equity Act, No. 55 of 1998
• Income Tax Act, No. 58 of 1962
• Labour Relations Act, No. 66 of 1995
• Occupational Health and Safety Act, No. 85 of 1993
• Skills Development Levies Act, No. 9 of 1999
• Value Added Tax Act, No. 89 of 1991

Section 51(1)(e). Access to anything in this section must be requested through the process in section 09.

POPIA section 51(1)(c)(i) to (v). This section covers Zorah’s own processing. Where we build and run a platform for a client, the client is the responsible party and we act as an operator on their instructions.

Why we process it

• Administering employee payroll and statutory HR functions
• Managing client accounts, billing and project delivery
• Meeting legal, tax, compliance and reporting obligations

Whose information, and what

Who else may receive it

• Statutory bodies and regulators, including SARS and the Department of Employment and Labour
• Third-party service providers, including IT hosting partners and external auditors
• Financial institutions, for payment processing

Transfers outside South Africa

Cross-border transfers, such as those involved in using global cloud services, happen only where the recipient country provides an adequate level of protection or an appropriate transfer agreement is in place.

How it is secured

• Firewalls, malware protection and network encryption
• Restricted physical and digital access controls
• Regular security assessments and data privacy training for staff

Five steps. The request fee has to be paid before we can process the request, so it is worth reading step five before starting.

1. Complete Form 2. The official Request for Access form is on the Information Regulator’s website.
2. Send it to the Information Officer using the details in section 03.
3. Prove who you are. Give enough detail on the form for us to identify the record and verify your identity.
4. Say which right you are exercising and why the record is required to exercise or protect it.
5. Pay the prescribed fees. A request fee applies, and an access fee may apply on top of it.

This manual is published here and is available for inspection at our registered office during business hours.