PAIA Reporting Doesn’t Have to Be Hard—Here’s What You Need to Know

29 Mar

The Information Regulator has officially invited all public and private bodies to submit their PAIA Annual Reports for the 2024/2025 period. As confirmed in their latest media alert (17 March 2025), the submission portal will be open from 1 April to 30 June 2025. This is a perfect opportunity for accountants to help clients stay compliant and avoid unnecessary legal headaches.

If your client is running a business, even a small one, this article is for you.

What is PAIA and Why Does It Matter?

PAIA (the Promotion of Access to Information Act) is a law that allows people to request information from both public and private organisations. It supports our constitutional rights by promoting:

• Transparency

• Accountability

• Access to records and information

In other words, it helps to ensure organisations aren't hiding behind closed doors. They need to be open about their information, especially if it affects people’s rights.

Who Needs to Submit a Report?

The PAIA reporting requirement applies to:

Public Bodies – like government departments, municipalities, and state entities.
Private Bodies – like companies, NPOs, partnerships, and schools.

If your client is a private business, its CEO or MD is legally responsible for submitting the report (this person is known as the Head of the Private Body). The client can appoint a Deputy Information Officer to help, but the responsibility stays with the head.

What Information Should Be reported?

Businesses and organisations (both public and private bodies) must provide key information to the Information Regulator in their PAIA Annual Report. This isn’t just for compliance—it helps the Regulator assess how well people are using their rights to access information and how effectively organisations are responding. Below is a breakdown of what should be included in the report.

Whether the entity received any requests for access to information
- This is the most basic (but essential) part of the report. The organisation must state whether:
  - Did anyone (a customer, employee, or a member of the public) ask for access to a document or record during the past year?
  - If so, how many requests were received?
📌 Note: Even if no requests were made, the organisation must still submit a “nil report” to confirm that no requests were received during the period.
How did the organisation respond to the requests for information?
For each request received, the organisation must state whether:
- The request was granted in full.
- The request was refused—and if so, what was the reason (e.g., a record doesn’t exist, privacy concerns, or not enough information is provided)?
- The request was partially granted, meaning some information was given, but other parts were withheld (for example, due to confidentiality or data protection rules).
📌Note: This shows whether the organisation engages meaningfully with requests and does not simply ignore or dismiss them.
Did the organisation respond within the legal time frame
PAIA sets strict deadlines for responding to access to information requests:
- An initial response must generally be provided within 30 calendar days.
- Extensions are allowed in specific circumstances, but they must be properly documented.
In this section, the annual report must state whether the organisation meets the deadline. If there were delays, the reasons must be provided (e.g., lack of clarity in the request, technical issues, etc.).
📌Note: This helps the Regulator track whether organisations are following the process correctly and responding to the public in a timely manner.
Internal appeals and their outcomes
For public bodies, PAIA allows requesters to appeal an Information Officer’s decision if they feel it was unfair or incorrect. In their annual report, public entities must indicate:
- How many internal appeals were lodged
- The reasons for those appeals (e.g. access was refused)
- What the outcome of the appeal was (upheld, overturned, partially amended)
While private bodies do not have a formal internal appeal process under PAIA, the organisation should still note if a requester came back to challenge a decision or ask for a review and how that was handled.
📌Note: This section shows how disputes are being resolved and whether organisations are open to review and correction.
Annual Report Submission

The report must be submitted online using the submission link.
The submission portal opens on 1 April 2025 and closes on 30 June 2025.
Register an Information Officer (or Head of the Body) on the portal before you can submit a report.

Controls and Processes Organisations Must Have

Before an organisation can submit anything, it must have certain processes in place. These are explained below.

Register an Information Officer and any Deputy with the Information Regulator.
Create a PAIA Manual, outlining:
- The types of records the business holds
- What data they collect and why
- How people can request access to information held by the organisation, and
- Contact person’s details.
👉Download an editable version of the PAIA Manual Template for Private Bodies template, providing a simple, editable PAIA Manual aligned with the Regulator's expectations.
Track Access Requests
Keep a log of all requests received and how they were handled. Even if no requests were made, the report still must state this.
Test the Portal
Don’t leave it to the last minute. Log in early, check access, and avoid last-minute stress.

The role of accountants

You can offer real value to your clients by helping them:

Understand what PAIA is
Register their Information Officer
Prepare or review their PAIA Manual
Track their access request records
Submit their reports on time

It is another opportunity to help them stay compliant, avoid penalties, and strengthen their governance processes.

PAIA might sound complex, but it’s about openness and doing the right thing. As their accountant, you will be expected to do more than just handle their finances—you can help them stay on top of compliance and build a culture of transparency.