PAIA Manual
Introduction
This Manual is prepared by ECOassure Environmental Advisory (Pty) Ltd (“ECOassure”) in accordance with section 51 of the Promotion of
Access to Information Act 2 of 2000 (“PAIA”), as amended, and the relevant provisions of the Protection of Personal Information Act 4 of 2013 (“POPIA”).
PAIA gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of rights, subject to the procedures, grounds of refusal and other provisions of PAIA.
Purpose of this Manual
The purpose of this Manual is to assist members of the public to understand the nature of ECOassure and the contact details of its
Information Officer; the categories of records held by ECOassure; records that may be available without a formal PAIA request; how to request access to records; legislation under which records may be held; the categories and purposes of personal information processed; recipients and service providers involved; cross-border information flows; general security safeguards; and remedies available where a requester is dissatisfied with the outcome of a PAIA request.
Company and Information Officer Details
Registered name: ECOassure Environmental Advisory (Pty) Ltd
Trading name: ECOassure
Registration number: 2026/456997/07
Country: South Africa
Website: www.ecoassure.co.za
Head / Information Officer: Simon Peter Clark
Email: simon.clark@ecoassure.co.za
Postal / Physical Address: Available from ECOassure on request and to be updated when a dedicated public business address is adopted.
PAIA requests and enquiries concerning this Manual should be directed to the Information Officer using the details above.
Information Regulator's PAIA Guide
The Information Regulator has published a Guide on how to use PAIA. The Guide explains the objects of PAIA, how to make requests, assistance available, applicable forms, remedies and related matters.
The current Guide and prescribed PAIA forms are available from the Information Regulator's official website and eServices resources. A requester may also contact the Information Regulator directly for assistance.
Records Available Without a Formal PAIA Request
Certain information that ECOassure makes publicly available may be accessed without submitting a formal PAIA request. Depending on current publication and business activities, this may include:
Public website content; public service descriptions and business contact information; published company profile and marketing material; public privacy and PAIA information; publicly issued articles, notices or professional information; and other records expressly identified by ECOassure as automatically or publicly available.
The fact that a category is listed here does not require disclosure of confidential, privileged, third-party or otherwise protected information contained within a related record.
Records Held in Terms of Legislation
ECOassure may hold records under legislation applicable to its activities, including where applicable:
Companies Act 71 of 2008; Companies Regulations, 2011; Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011; Value-Added Tax Act 89 of 1991; Basic Conditions of Employment Act 75 of 1997; Employment Equity Act 55 of 1998; Unemployment Insurance Act 63 of 2001; Compensation for Occupational Injuries and Diseases Act 130 of 1993; Occupational Health and Safety Act 85 of 1993; Protection of
Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000; Electronic Communications and Transactions Act 25 of 2002; National Environmental Management Act 107 of 1998 and applicable specific environmental management Acts; environmental, planning, heritage, water, biodiversity and other legislation relevant to individual projects; and other legislation applicable to ECOassure's professional, contractual, tax, corporate or project activities.
Inclusion of legislation does not imply that every listed statute applies to ECOassure at all times or that every record created under such legislation is automatically accessible under PAIA.
Categories of Records Held by ECOassure
Corporate and Governance: Incorporation records, constitutional records, statutory submissions, director and beneficial ownership records, resolutions, governance and compliance records.
Financial and Tax: Accounting records, invoices, quotations, banking records, expense records, tax records, financial statements and supporting documents.
Client and Contractual: Client enquiries, proposals, appointments, contracts, purchase orders, instructions, correspondence, deliverables and project administration records.
Environmental and Project: Screening and feasibility records, environmental assessment and permitting records, applications, reports, environmental authorisations and permits, EMPrs, compliance and audit records, specialist studies and project correspondence.
Stakeholder and Public Participation: Stakeholder databases, interested-and-affected-party records, landowner and occupier information, notices, comments, responses, attendance records and consultation records.
GIS and Technical: Spatial datasets, maps, geodatabases, screening outputs, technical data, project drawings and supporting digital information.
Suppliers, Specialists and Contractors: Supplier details, specialist appointments, subcontractor records, qualifications, professional registrations, contracts, invoices and correspondence.
Marketing and Business Development: Prospective client enquiries, professional contacts, marketing lists, consent and preference records, website enquiries, campaign records and public communications.
Personnel: Employment, contractor and recruitment records where applicable, including identity, qualification, payroll and statutory records.
POPIA and PAIA Compliance: Privacy policies and notices, personal-information inventory, data-subject requests, PAIA requests, security incident records, operator assessments, impact assessments, consent and objection records.
Information Technology and Security: Account records, system configurations, access records, security logs, backups, incident evidence and technology-provider records.
Legal, Insurance and Risk: Insurance policies, claims, legal correspondence, complaints, disputes, risk assessments and professional advice.
Requesting Access to a Record
A person seeking access to a record that is not automatically available must submit the prescribed PAIA request form to the Information Officer. The current prescribed form for a request for access to a record is Form 2 under the PAIA Regulations.
The request must contain sufficient information to enable ECOassure to identify the requester, the record requested, the preferred form of access and the right the requester seeks to exercise or protect, together with the explanation required by PAIA.
Where a requester acts on behalf of another person, reasonable proof of authority must be provided. ECOassure may request reasonable identity verification before disclosing records containing personal or confidential information.
Fees
Fees will be charged only where permitted or required under PAIA and the applicable prescribed fee structure.
Where a fee is payable, the requester will be informed in accordance with the prescribed process before access is provided.
The current prescribed PAIA fee structure published by the Information Regulator applies.
Decision on a Request
ECOassure will process a valid request in accordance with the timeframes and procedures prescribed by PAIA. Where PAIA permits an extension, the requester will be informed as required.
If access is granted, ECOassure will communicate the applicable access arrangements and any prescribed fee. If access is refused, the requester will be provided with the decision and reasons to the extent required by PAIA.
Grounds for Refusal
Access to a record is not automatic merely because a request has been submitted. ECOassure must apply the mandatory and discretionary grounds for refusal contained in PAIA.
Depending on the record, grounds may include protection of the privacy of third parties; commercial or confidential information of third parties; safety of individuals and protection of property; legally privileged records; ECOassure's own protected commercial information; protected research information; and other interests protected by PAIA.
Where only part of a record is protected and the remainder can reasonably be severed, ECOassure will consider access to the severable portion as required by PAIA.
Remedies
ECOassure is a private body and does not have an internal PAIA appeal procedure equivalent to that applicable to certain public bodies.
A requester or affected third party who is dissatisfied with a decision may use the complaint mechanism available through the
Information Regulator, subject to PAIA's requirements and timeframes, or may approach a court where applicable.
Processing of Personal Information
ECOassure processes personal information for legitimate business, professional, statutory, contractual and project purposes in accordance with POPIA and its controlled privacy framework.
Purposes for Processing Personal Information
These purposes may include responding to enquiries and preparing proposals, quotations and tenders; establishing and managing client relationships; providing environmental, advisory, assessment, permitting and compliance services; project administration and specialist coordination; stakeholder engagement and public participation; landowner and interested-and-affected-party communication; regulatory submissions; supplier and contractor management; accounting and financial administration; corporate governance and regulatory compliance; information requests; information security; website operation; and lawful business development and marketing.
Categories of Data Subjects and Personal Information
ECOassure may process information relating to clients and prospective clients; client personnel and representatives; landowners and occupiers; interested and affected parties and stakeholders; government and regulatory officials; specialists, consultants and subcontractors; suppliers and service providers; employees, contractors and applicants; website visitors and enquirers; and professional and marketing contacts.
Information processed will depend upon the relationship and may include identity and contact information, professional and organisational information, correspondence, property relationships, stakeholder records, project information, qualifications and professional registrations, contractual and transaction information, banking information where required, and online enquiry information.
Categories of Recipients
Depending on the purpose and applicable legal basis, personal information may be supplied to clients and authorised project participants; competent authorities and regulatory bodies; specialists, consultants and subcontractors; banks, accountants, tax practitioners and financial service providers; technology, cloud, email, website and IT providers; professional advisers, insurers and legal representatives; courts, tribunals, regulators or law-enforcement bodies where required or permitted; and other lawful recipients.
Cross-Border Information Flows
Some technology, cloud or professional service providers may store or process information outside South Africa.
Where personal information is transferred to a recipient in another country, ECOassure considers the requirements of section 72 of POPIA and applies an appropriate lawful basis and safeguards.
Security Safeguards
ECOassure applies appropriate and reasonable technical and organisational measures designed to protect personal information against loss, damage, unauthorised destruction, unlawful access, unauthorised processing, alteration and disclosure.
Measures are proportionate to the nature and risk of processing and may include access controls, strong authentication, multi-factor authentication where appropriate, secured devices and cloud services, backups, software updates, controlled sharing, confidentiality obligations, operator oversight and security-incident procedures.
Availability of this Manual
This Manual is a public document. The current version is made available through the ECOassure website and may also be requested from the Information Officer.
A copy will be made available for inspection at ECOassure's office during normal business hours once a public-facing office is maintained, subject to reasonable arrangements.
Updating this Manual
The Information Officer will review this Manual at least annually and when material changes occur to ECOassure's contact details, processing activities, categories of records, systems, legislation or PAIA/POPIA requirements.
PAIA Request Register and Annual Reporting
ECOassure will maintain appropriate records of PAIA requests received and their outcomes.
Where annual PAIA reporting is required by the Information Regulator, ECOassure will submit the applicable report through the
Regulator's eServices portal during the prescribed reporting period.
Information Regulator
Information Regulator (South Africa)
Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
A requester should refer to the Information Regulator's current official channels for PAIA guidance, prescribed forms, complaints and current contact information.