PAIA Manual
Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000
A copy of this manual is available free of charge from the Information Officer by email, and as a downloadable PDF. Erudite's Website Terms of Use govern use of this site.
1. Purpose of this manual
The Promotion of Access to Information Act 2 of 2000 ("PAIA") gives effect to the constitutional right of access to information. Section 50 gives a requester a right of access to a record of a private body where the record is required for the exercise or protection of any right.
Section 51 requires a private body to compile a manual describing how a request may be made. This is that manual.
This manual also explains how a data subject exercises the rights that the Protection of Personal Information Act 4 of 2013 ("POPIA") gives over personal information Erudite holds, because in practice those two routes are confused and a requester should not have to know which one applies before asking.
2. Particulars of the private body — section 51(1)(a)
| Item | Detail |
|---|---|
| Registered name | ERUDITE AI CONSULTING (PTY) LTD |
| Trading name | Erudite |
| Registration number | 2025/562940/07 (incorporated 15 July 2025) |
| Type of entity | Private company |
| Address for PAIA requests | 157 5th Avenue, Edenvale, Johannesburg, 1609 |
| Registered address | 157 5th Avenue, Edenvale, Johannesburg, 1609 |
| Postal address | 157 5th Avenue, Edenvale, Johannesburg, 1609 |
| Telephone | +27 83 519 5357 |
| suvan@erudite.co.za | |
| Website | https://erudite.co.za |
3. Information Officer — sections 51(1)(a) and 17 of POPIA
| Item | Detail |
|---|---|
| Information Officer | Suvan Singh |
| Capacity | Sole director |
| Appointed | 15 July 2025 |
| Registered with the Information Regulator | 7 August 2026, registration 2026-063956 — verifiable on the Regulator's eServices portal |
| suvan@erudite.co.za | |
| Telephone | +27 83 519 5357 |
| Deputy Information Officer | None designated. Erudite has one person, who is the Information Officer. Section 17 of POPIA read with section 56 of PAIA permits a private body to designate deputies; it does not require a body of one to create the office. Erudite will designate a Deputy Information Officer when it has a second person capable of holding it. |
All requests under this manual go to the Information Officer at the address above.
Erudite maintains an emergency contact under its client agreements who may be reached if the Information Officer cannot be. That contact is not a Deputy Information Officer and holds no authority under PAIA or POPIA. Their function is to notify Erudite's clients and release a handover pack if the sole operator is incapacitated. A request under this manual made to that contact is not a request received by the Information Officer, and time under section 56 of PAIA does not begin to run.
4. The Information Regulator's PAIA Guide — section 51(1)(b)
The Information Regulator has compiled a guide, in each official language, on how to use PAIA. A requester who needs help may obtain it from:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Email: PAIAComplaints@inforegulator.org.za · General: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za
5. Records held by Erudite — section 51(1)(e)
Erudite holds the following categories of records. Listing a category here does not mean a record in it will be released. Access depends on the requester establishing the right in section 50 and on the grounds for refusal in Chapter 4 of PAIA, which include the mandatory protection of a third party's personal information and of another party's confidential commercial information.
| Category | Examples | Typical access position |
|---|---|---|
| Company and statutory | Registration documents, CIPC filings, share register, beneficial ownership filing, tax registrations | Largely public via CIPC |
| Client engagement | Master Services Agreements, Statements of Work, Data Processing Agreements, schedules, signed acceptances | Confidential to the parties; third-party notice required |
| Deliverables and working papers | Diagnostic reports, Blueprint deliverables, assessment evidence, governance policies and procedures prepared for clients | Confidential to the client concerned |
| Survey records | Aggregate survey results and reports. Individual staff survey responses are anonymous — they carry no identifier and Erudite holds no key linking a response to a person, so Erudite cannot retrieve "your response" on request. See the staff survey respondent notice, which clause 7 makes available without a request | Not retrievable per individual |
| Personal information of contacts | Prospect and client contact details, correspondence, meeting notes, lead records | POPIA route in clause 8 is usually the correct one |
| Financial | Invoices, payment records, bank records, tax records | Confidential; retained for the periods set in Erudite's client agreements and by tax legislation |
| Insurance | Professional indemnity and cyber policies, claims records | Confidential |
| Suppliers and sub-operators | Hosting, software and service provider agreements | Confidential |
| Internal operations | Security records, backup and restore records, incident records, retention and deletion evidence, conflicts register | Confidential; security records may be refused where disclosure would prejudice protection |
| Employment and contractor | Contractor agreements, appointment-setter and partner agreements | Confidential; third-party notice required |
6. Records available in terms of other legislation — section 51(1)(d)
Records are also held or made available under, among others: the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991 (if and when Erudite registers), the Basic Conditions of Employment Act 75 of 1997 and the Labour Relations Act 66 of 1995 (if and when Erudite employs staff), the Financial Intelligence Centre Act 38 of 2001 to the extent applicable, and POPIA.
7. Records automatically available without a PAIA request — section 52
Erudite voluntarily makes the following available without a formal request:
- the website terms of use and privacy statement;
- the staff survey respondent notice;
- this manual; and
- any other material Erudite publishes on its website from time to time.
Erudite has not submitted a section 52 notice to the Minister, and has decided not to file one. A section 52 notice fixes the categories of record published in it. Erudite is in its second year, and the categories of records it holds are still settling as the service lines settle. The reduction in formal requests a notice might produce is not worth committing to a category list this early. This decision is reviewed with the manual annually.
8. Requesting personal information about yourself — POPIA rights
If you want the personal information Erudite holds about you, POPIA gives you the right. The request itself is made under PAIA, because POPIA has no access form of its own.
- Access to your personal information runs through PAIA, not through a POPIA form. POPIA section 23 gives you the right; the request itself is made on Form 2 of the PAIA Regulations, 2021 ("Request for Access to Record", Regulation 7), sent to the Information Officer at the address in clause 3.
- Erudite will confirm whether it holds personal information about you and provide the record or a description of it.
- To correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, use Form 2 of the POPIA Regulations, 2021 (Regulation 3) — "Request for correction or deletion of personal information or destroying or deletion of record of personal information".
- To object to processing under section 11(3), use Form 1 of the POPIA Regulations, 2021 (Regulation 2) — "Objection to the processing of personal information".
- Erudite may charge the prescribed fee for access, and will tell you the amount before proceeding.
- If you are not satisfied, you may complain to the Information Regulator.
Note on survey responses. If you answered a staff AI-use survey, Erudite cannot give you your individual response, and no fee applies. The responses carry no identifier and Erudite holds no key linking a response to a person, so there is no record it can retrieve as yours. That is a consequence of the anonymity the survey promises, not a refusal.
8A. Processing of personal information — required particulars
The PAIA Regulations, 2021 require a private body's manual to describe the personal information it processes. Erudite processes the following.
| Particular | Detail |
|---|---|
| Purpose of processing | Delivering contracted AI-governance and technology-risk services; administering client engagements, invoicing and statutory records; running the anonymous staff AI-use survey on behalf of a client; responding to enquiries and prospective-client contact; meeting Erudite's own legal, tax and regulatory obligations |
| Categories of data subjects | Client contacts and signatories; staff of clients who are invited to a survey; prospective-client contacts; contractors and partners; the sole director |
| Categories of personal information | Names, job titles, business contact details, correspondence and meeting notes; contracting particulars including registration and, where relevant, financial-threshold information; commission and payment records for contractors and partners. Survey response records contain no identifier — see the note in clause 5 |
| Categories of recipients | The client concerned, for work performed for that client. No other recipient without the client's written instruction or a legal obligation. Aggregate survey results go only to the commissioning client |
| Planned transborder flows | None. Personal information is processed on Erudite's on-premise infrastructure in South Africa and is not transferred outside the Republic. Any future transfer would require a recorded basis under POPIA section 72 |
| General description of security measures | Named accounts with multi-factor authentication on administrative access; TLS on all public endpoints; encrypted backups with the decryption key held offline; automated retention and deletion with per-record evidence; logging of response-level access; a documented incident procedure with a named decision owner; physical control of the processing hardware behind a monitored alarm. The live database is not encrypted at rest; the compensating controls are the encrypted backups and single-operator physical control. Detail is maintained in the security schedule to Erudite's Data Processing Agreement |
9. Requesting a record — PAIA route, sections 53 to 54
- Use the prescribed form. Complete Form 2 of the PAIA Regulations, 2021 — "Request for Access to Record", made under Regulation 7. The same form serves a request to a public body and to a private body; the 2021 Regulations do not prescribe a separate private-body form. The current form is published by the Information Regulator at https://inforegulator.org.za/paia/.
- Send it to the Information Officer at the address in clause 3.
- Say enough to identify the record — sufficient particulars for Erudite to find it, the form of access you want, and your contact details.
- State the right. Section 50 requires you to identify the right you are exercising or protecting and to explain why the record is required for it. A request that does not do this must be refused.
- Pay the request fee where one applies — see clause 10.
- Erudite responds within 30 days. That period may be extended by up to a further 30 days where the request is for a large number of records or requires a search through records held elsewhere, and Erudite will tell you if it is extended and why.
- Third parties. Where a record contains information about a third party, Erudite must notify that party and give it an opportunity to make representations before deciding.
- Outcome. Erudite will tell you the decision, the reasons for a refusal, the provisions relied on, and your remedies.
10. Fees — section 54
The fees payable for a PAIA request are the fees prescribed under the PAIA Regulations, as amended from time to time. Erudite does not set them and cannot vary them, and they have nothing to do with the fees Erudite charges its clients for its services. The amounts in the tables below are the prescribed amounts current at the date of this manual. If the prescribed tariff is amended, the amended tariff applies and this manual is corrected at its next review.
Source: Annexure B to the Regulations Relating to the Promotion of Access to Information, 2021, published under GN R.757 in Government Gazette 45057 of 27 August 2021, as published by the Information Regulator.
10.1 Request fee
| Fee | Amount |
|---|---|
| Request fee, payable by every requester | R140.00 |
No request fee is payable where you are asking for personal information about yourself. A public body requesting information from Erudite also pays no request fee.
10.2 Access fees — reproduction
Payable before the record is released.
| Form of reproduction | Amount |
|---|---|
| Photocopy or printed black-and-white copy, per A4 page or part of a page | R2.00 |
| Copy in computer-readable form on a flash drive, where the requester provides the flash drive | R40.00 |
| Copy in computer-readable form on a compact disc, where the requester provides the disc | R40.00 |
| Copy in computer-readable form on a compact disc, where Erudite provides the disc | R60.00 |
| Transcription of visual images, per A4 page | Outsourced service, charged at the service provider's quotation |
| Copy of visual images | Outsourced service, charged at the service provider's quotation |
| Transcription of an audio record, per A4 page | R24.00 |
| Copy of an audio record on a flash drive or compact disc supplied by the requester | R40.00 |
| Copy of an audio record on a compact disc supplied by Erudite | R60.00 |
| Postage, email or other electronic transfer | Actual cost |
10.3 Search and preparation
| Item | Amount |
|---|---|
| Time reasonably required to search for and prepare the record, per hour or part of an hour, excluding the first hour | R145.00, to a maximum total charge of R435.00 |
Stated in full: search and preparation of the record for disclosure is charged at R145.00 for each hour or part of an hour reasonably required, excluding the first hour, subject to a maximum total charge of R435.00. The maximum is prescribed by Annexure B. It is a ceiling on what Erudite may charge for search and preparation however long the search actually takes.
10.4 Deposit
Where searching and preparing the record is likely to take more than six hours — the number of hours prescribed by Annexure B for the purposes of section 54(2) — Erudite may require a deposit before processing the request. The deposit is not more than one third of the access fee that would be payable if the request were granted, calculated in accordance with the prescribed fee table.
If the request is refused, the deposit is repaid in full (section 54(3)).
10.5 How Erudite applies this
- Erudite will give you a written estimate before incurring any fee, and you may withdraw the request rather than pay it.
- Erudite is not a VAT vendor, so no VAT is added to these amounts. A private body that is a VAT vendor may add VAT; Erudite currently may not.
- Erudite may not charge more than the prescribed fee. Charging above it is unlawful.
- You may lodge an internal appeal or complain to the Information Regulator about a fee you consider incorrectly calculated.
11. Grounds on which access may or must be refused — Chapter 4
Erudite may or must refuse access where PAIA requires or permits it, including to protect:
- the personal information of a third party (section 63);
- the commercial information of a third party or of Erudite — trade secrets, financial, commercial, scientific or technical information whose disclosure would harm commercial or financial interests, and information supplied in confidence whose disclosure could put a party at a disadvantage in negotiations or commercial competition (sections 64 and 68);
- information whose disclosure would breach a duty of confidence owed to a third party (section 65);
- the safety of individuals and the protection of property (section 66);
- records privileged from production in legal proceedings (section 67); and
- research information of a third party or of Erudite (section 69).
Access must be granted despite a refusal ground where section 70 applies — where disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.
Where part of a record may be refused, Erudite must grant access to the remainder if it can reasonably be severed.
12. Remedies
There is no internal appeal against a decision of a private body under PAIA.
If Erudite refuses your request, fails to respond within the period, or you are unhappy with a fee or the form of access, you may:
- complain to the Information Regulator under section 77A, using Form 5 of the PAIA Regulations, 2021, within 180 days of the decision; or
- apply to a court with jurisdiction under section 78.
Complaints go to PAIAComplaints@inforegulator.org.za or the Regulator's address in clause 4.
13. Availability of this manual
A copy of this manual is available:
- on Erudite's website at https://erudite.co.za/paia-manual/, in HTML and as a downloadable PDF;
- from the Information Officer on request, by email, free of charge. Annexure B allows a private body to charge the prescribed photocopy fee for a printed copy; Erudite does not charge for an electronic one; and
- to the Information Regulator on request.
Erudite has no premises open to the public. Where a requester wants to inspect the manual in person rather than receive a copy, that is arranged by appointment with the Information Officer.
14. Updates
Erudite will review this manual at least annually and whenever the entity details, the Information Officer, or the categories of records held change materially. The version and date at the top of this manual identify the current version.