PAIA reports and Information Officer registration

There is an annual return most South African businesses have never heard of, have never filed, and don't know applies to them.

Every private body in the country is required to register an Information Officer with the Information Regulator and submit an annual report on access-to-information requests. That includes companies, close corporations and trusts. It includes businesses that have never received a single request — the return is still required, it simply reflects zero.

If this is the first you're hearing of it, you're in the majority. Nobody sends you a letter about it.

Who this is for

• Any registered company, close corporation or trust
• Businesses that have never registered an Information Officer, which is most of them
• Anyone who missed a filing window and wants to be current before the next one
• Existing clients who'd rather this ran automatically alongside their other annual filings

What's included

• Information Officer registration with the Information Regulator, on the eServices portal
• Annual PAIA report preparation and submission, including nil returns
• Registration of deputy Information Officers where your business needs them
• A standard PAIA manual for your business, where you don't already have one
• A request register set up so that if you ever do receive a request, you have somewhere to record it
• A diary note each year, so the filing happens without you having to remember it exists

What we don't do

Information law has a specialist end, and we'll tell you when you've reached it rather than working it out at your expense.

We handle the registration and the filing. We don't do POPIA gap analyses, data mapping exercises, bespoke manuals for complex or regulated businesses, data breach response, or prior authorisation applications. Those are legal work, and if your situation needs them we'll say so and point you to someone who does them properly.

For the overwhelming majority of small businesses, none of that applies. You need to be registered and you need to file.

How the timing works

The reporting period runs from 1 April to 31 March, regardless of your own financial year end. The submission window opens in April and closes at the end of June. The Regulator has not granted extensions once it closes.

Registration of your Information Officer can happen at any time, and has to happen before any return can be submitted. If you're not registered, you can't file — so that's where we start.

Because the window is fixed and short, we register clients through the year and file the returns as a batch when the portal opens. You don't need to think about it in June.

What it costs

Price on request

Information Officer registration is a once-off fee. The annual return is priced per filing, and for existing monthly clients it's cheaper — we already hold everything needed to complete it.

Getting started

1. Tell us your entity details — company name, registration number, who your Information Officer will be
2. We register them on the Regulator's portal and confirm when it's done
3. We file the return when the next window opens, and every year after that

Common questions

Nobody has ever asked my business for information. Do I still have to file? Yes. A nil return is still a return. For most small businesses every field on the form is zero, which makes the filing quick — but not optional.

What actually happens if I don't file? Honestly: not what some compliance consultants will tell you. You won't be fined millions for a late nil return. What can happen is that the Regulator initiates its own compliance assessment of your business, which means scrutiny you didn't ask for and would rather avoid, and it puts you on the wrong side of an obligation that costs very little to meet. It's worth doing because it's cheap and simple, not because of a penalty headline.

I missed this year's window. Can I still submit? Not until the next one opens. What you can do now is get your Information Officer registered, so that you're ready to file the moment it does rather than scrambling in June.

Is this the same as POPIA compliance? No, though they're related and the same Regulator oversees both. This is the access-to-information side — registration and annual reporting. Broader POPIA work, if your business needs it, is a separate exercise and largely a legal one.

I'm a sole proprietor. Does this apply to me? The obligation attaches to private bodies, which is broader than most people assume. Tell us how you're structured and we'll tell you whether it applies rather than selling you something you don't need.

Talk to us about PAIA compliance →