PAIA Manual (South Africa)
Widbrook Consulting (Pty) Ltd
Registration number [number]
Prepared: 3 October 2026. Last updated: 3 October 2026.
1. Introduction
The Promotion of Access to Information Act 2 of 2000 gives effect to the constitutional right of access to information. It requires every private body to compile a manual setting out what records it holds and how they may be requested. Widbrook Consulting (Pty) Ltd is a private body for these purposes.
This manual is available on our website at www.widbrook.net/paia-manual, at our physical address during business hours, and by email on request, at no charge.
2. Contact details
Head of the private body and Information Officer: Claire Coustas
Physical address: [Physical address]
Postal address: [Postal address]
Email: hello@widbrook.net
Website: www.widbrook.net
Deputy Information Officer: None has been designated. Section 56 of POPIA permits but does not require the designation of deputies, and the body consists of one person.
3. The Guide compiled by the Information Regulator
Section 10 of PAIA requires the Information Regulator to compile a guide, in each official language, on how to use the Act. The Guide is available from:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Telephone: [number]
Email: [address]
www.inforegulator.org.za
4. Records available in terms of other legislation
Certain records are available under other laws without a PAIA request. These include records held under the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value Added Tax Act 89 of 1991, the Tax Administration Act 28 of 2011, the Basic Conditions of Employment Act 75 of 1997 where applicable, and the Protection of Personal Information Act 4 of 2013.
5. Records held
| Category | Subjects covered |
|---|---|
| Company records | Memorandum of incorporation, registration documents, share register, director records, resolutions, statutory filings |
| Financial records | Annual financial statements, accounting records, tax returns and assessments, VAT records, banking records, invoices |
| Client records | Engagement letters, scoping documents, correspondence, working papers, deliverables and reports |
| Personal information records | Enquiries received through the website, newsletter subscriptions, consent and suppression records, records of data subject requests |
| Insurance records | Professional indemnity and other business insurance policies and correspondence |
| Supplier and service provider records | Contracts, operator agreements, invoices |
| Website records | Content, form handler error logs, analytics reports |
Client records are confidential. A request for a record containing a third party’s information engages the mandatory grounds for refusal in Chapter 4 of Part 3 of the Act, and the third party notification procedure in section 71.
6. Records automatically available without a request
Our website content, including this manual, the privacy policy and the cookie notice, and any material we publish for general distribution.
We have not made a notice under section 52(2) of the Act specifying categories of records automatically available.
7. How to request a record
- Complete Form 2 of the Regulations relating to the Promotion of Access to Information, 2021, “Request for access to record”, available from the Information Regulator’s website at inforegulator.org.za/paia. The Regulator has said that requests must be made on Form 2 or a form that corresponds substantially with it, and that the older forms are no longer to be used.
- Send it to the Information Officer at the address in section 2 above.
- Provide sufficient detail to enable us to identify the record and to identify you, state the form of access required, and state the right you are seeking to exercise or protect and why the record is required to exercise or protect it, as section 53(2) requires.
- If the request is made on behalf of someone else, submit proof of your authority.
We will respond within 30 days of receiving the request. That period may be extended by a further 30 days in the circumstances set out in section 57, and we will tell you in writing if it is.
8. Fees
Fees are prescribed by regulation and change from time to time. The current schedule is published by the Information Regulator and applies as published.
There are two fees. A request fee, payable before the request is processed, which is not charged to a personal requester seeking their own personal information. And an access fee, covering the cost of reproduction, search and preparation, and postage, payable before access is given. We will tell you what is payable before doing the work. If you consider a fee excessive, you may complain to the Information Regulator or apply to court, as set out in section 10 of this manual. There is no internal appeal against a private body.
9. Grounds for refusal
Access may or must be refused on the grounds in Chapter 4 of Part 3 of the Act, including the mandatory protection of the privacy of a third party who is a natural person (section 63), commercial information of a third party (section 64), information supplied in confidence (section 65), safety of individuals and property (section 66), records privileged from production in legal proceedings (section 67), our own commercial information (section 68), and research information (section 69).
If a request is refused we will tell you in writing, give adequate reasons, identify the provision relied on, and tell you that you may complain to the Information Regulator or apply to a court, and how to do either.
10. Remedies
There is no internal appeal against a decision of a private body. A requester who is dissatisfied may:
- lodge a complaint with the Information Regulator under section 77A, on Form 5, available from the Regulator’s website; or
- apply to a court under section 78 within 180 days of the decision.
Form 4, the internal appeal form, applies only to requests to public bodies.
11. Processing of personal information
In terms of section 51(1)(c) of PAIA read with section 17 of POPIA, the following describes our processing of personal information.
Purposes. Responding to enquiries. Providing risk and compliance advisory services. Meeting legal and regulatory obligations. Sending our newsletter to those who have consented. Keeping our own business records.
Categories of data subject and information.
| Data subject | Information |
|---|---|
| Enquirers | Name, email, organisation, telephone, content of the enquiry |
| Newsletter subscribers | Email address, subscription date and time, IP address, browser details, record of consent wording and checkbox |
| People who have unsubscribed or objected | Email address and date, on the suppression list |
| Clients and their personnel | Contact details, professional information, and whatever the engagement requires |
| Suppliers and service providers | Contact and banking details |
Recipients. Our service providers as listed in our privacy policy, all under written operator agreements. Regulators and law enforcement where the law requires. Professional advisers where necessary.
Transborder flows. Personal information collected through this website is stored by Cloudflare, Inc. outside South Africa, in Western Europe, because the service is not available in an African region. This is disclosed in our privacy policy and is subject to section 72 of POPIA.
Security. As described in our privacy policy, prepared with regard to sections 19 to 22 of POPIA.
12. Availability and updates
This manual is available as set out in section 1 and is updated whenever our records, contact details or processing change, and reviewed at least annually.