paia manual.

PAIA gives people a formal way to request access to records held by private and public bodies in South Africa. XMwize has prepared a PAIA Manual to explain what records we hold, how access requests can be made, who to contact, and how personal information requests are handled.

This page is a simple guide. The full PAIA Manual remains the formal document.

What the manual covers

The XMwize PAIA Manual explains:

• Who our Information Officer is
• How to contact XMwize for PAIA and POPIA requests
• What categories of records XMwize may hold
• Which records may be available without a formal PAIA request
• How to request access to a record
• How fees and timelines may apply
• How POPIA data subject requests are handled
• How the manual is updated and made available

Information Officer

The Information Officer for XMwize is Debi Potgieter, Chief Executive Officer and Founder.

For PAIA or POPIA requests, contact: privacy@xmwize.co.za
For general enquiries, contact: connect@xmwize.co.za

Need help?

If you are unsure whether your request is a PAIA request, a POPIA request or a general enquiry, please email privacy@xmwize.co.za and we will guide you to the right process.

XMWIZE SOLUTIONS (PTY) LTD
Registration Number: 2024/161409/07

PAIA MANUAL
Prepared in terms of section 51 of the
Promotion of Access to Information Act, 2 of 2000 (as amended)

Date of compilation: 3 June 2026
Date of last revision: 3 June 2026
Version: 1.0

Approved by the Information Officer
Debi Potgieter, Chief Executive Officer

Table of contents

1. List of acronyms and abbreviations
2. Purpose of PAIA Manual
3. Key contact details for access to information of XMwize Solutions (Pty) Ltd
4. Guide on how to use PAIA and how to obtain access to the Guide
5. Categories of records of XMwize which are available without a person having to request access
6. Description of the records of XMwize which are available in accordance with any other legislation
7. Description of the subjects on which XMwize holds records and categories of records held on each subject
8. Processing of personal information
9. Procedure for requesting access to records
10. Fees
11. Remedies available to requesters
12. POPIA data subject requests
13. Availability of the manual
14. Updating of the manual

1. List of acronyms and abbreviations

2. Purpose of PAIA Manual

This PAIA Manual is useful for the public to:

• 2.1 check the categories of records held by XMwize Solutions (Pty) Ltd ("XMwize") which are available without a person having to submit a formal PAIA request;
• 2.2 have a sufficient understanding of how to make a request for access to a record of XMwize, by providing a description of the subjects on which XMwize holds records and the categories of records held on each subject;
• 2.3 know the description of the records of XMwize which are available in accordance with any other legislation;
• 2.4 access all the relevant contact details of the Information Officer and Deputy Information Officer (if any) who will assist the public with the records they intend to access;
• 2.5 know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;
• 2.6 know that XMwize processes personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;
• 2.7 know the description of the categories of data subjects and of the information or categories of information relating thereto;
• 2.8 know the recipients or categories of recipients to whom the personal information may be supplied;
• 2.9 know whether XMwize has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and
• 2.10 know whether XMwize has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3. Key contact details for access to information of XMwize Solutions (Pty) Ltd

3.1 Information Officer

In terms of section 1 of POPIA, the head of a private body is the Information Officer. The Information Officer of XMwize is:

3.2 Deputy Information Officer(s)

At the date of this Manual, XMwize has not designated a Deputy Information Officer in terms of section 17(1) of PAIA, read with section 56 of POPIA. The Information Officer fulfils these duties directly, supported operationally by the Information Risk and Privacy Coordinator.

3.3 Access to information general contacts

3.4 Head office

4. Guide on how to use PAIA and how to obtain access to the Guide

4.1 The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA ("the Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2 The Guide is available in each of the official languages and in braille.

4.3 The Guide contains the description of:

• (a) the objects of PAIA and POPIA;
• (b) the postal and street address, phone and fax number and, if available, electronic mail address of the Information Officer of every public body, and every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA;
• (c) the manner and form of a request for access to a record of a public body contemplated in section 11, and access to a record of a private body contemplated in section 50;
• (d) the assistance available from the Information Officer of a public body in terms of PAIA and POPIA;
• (e) the assistance available from the Regulator in terms of PAIA and POPIA;
• (f) all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging a complaint to the Regulator and an application with a court against a decision by the information officer of a public body, a decision on internal appeal, or a decision by the Regulator or a decision of the head of a private body;
• (g) the provisions of sections 14 and 51 requiring a public body and a private body, respectively, to compile a manual, and how to obtain access to a manual;
• (h) the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records by a public body and a private body, respectively;
• (i) the notices issued in terms of sections 22 and 54 regarding fees to be paid in relation to requests for access; and
• (j) the regulations made in terms of section 92.

4.4 Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.

4.5 The Guide can also be obtained:

• (k) upon request to the Information Officer;
• (l) from the website of the Regulator at https://inforegulator.org.za.

The Information Regulator's contact details are:

Note: Confirm the current Information Regulator contact details on the Regulator's website before publishing this Manual, as these details are amended from time to time.

5. Categories of records of XMwize which are available without a person having to request access

In terms of section 52(2) of PAIA, a private body may publish a notice describing the categories of records which are automatically available without a person having to request access under PAIA.

At the date of this Manual, XMwize has not issued a formal section 52(2) notice in the Government Gazette. The following categories of records are nevertheless voluntarily made available without a formal PAIA request:

6. Description of the records of XMwize which are available in accordance with any other legislation

The following records are created and held by XMwize in accordance with the legislation indicated. Access to these records is governed primarily by the relevant legislation listed below, and may also be requested under PAIA where applicable.

7. Description of the subjects on which XMwize holds records and categories of records held on each subject

XMwize holds records relating to the operation of its consulting business. The subjects on which records are held, and the categories of records on each subject, are as follows:

8. Processing of personal information

8.1 Purpose of processing personal information

XMwize processes personal information for the following purposes:

• to deliver consulting, advisory, research and related professional services to clients under contract;
• to manage client engagements, including project administration, billing and communication;
• to manage business development and marketing activities, including prospect engagement, events and approved marketing communications;
• to manage the employment relationship with employees, including recruitment, payroll, benefits administration, performance management and training;
• to manage relationships with suppliers, contractors and freelance consultants, including onboarding, contract administration, payment and assurance;
• to comply with legal, regulatory and statutory obligations, including tax, employment, company law and POPIA obligations;
• to protect the rights, property and safety of XMwize, its clients, employees and third parties; and
• for any other purpose that has been disclosed to the data subject and for which an appropriate lawful basis under section 11 of POPIA applies.

8.2 Description of the categories of data subjects and of the information or categories of information relating thereto

XMwize processes personal information relating to the following categories of data subjects:

8.3 The recipients or categories of recipients to whom the personal information may be supplied

Personal information may be supplied to the following categories of recipients, where required and in accordance with the lawful basis on which XMwize processes the relevant information:

8.4 Planned transborder flows of personal information

Personal information processed by XMwize may be transferred outside the Republic of South Africa in the following circumstances:

Note: Confirm the Microsoft 365 tenant region (Microsoft 365 admin centre → Settings → Org settings → Organisation profile → Data location) and update the table above before publishing. The applicable cross-border safeguards are recorded in the Microsoft Data Protection Addendum and Online Services Terms held on file.

Where any new transborder transfer of personal information is contemplated, XMwize will assess and record the section 72 basis relied on before the transfer takes place.

8.5 General description of information security measures

XMwize implements technical and organisational measures, appropriate to its size and risk profile, to ensure the confidentiality, integrity and availability of personal information processed by it. These measures are detailed in the XMwize Information Risk, Data Privacy Governance and Acceptable Use Policy and include, among others:

• role-based access control applying least privilege and need-to-know principles, with documented access provisioning, review and removal procedures;
• multi-factor authentication on Microsoft 365 and other approved business systems where supported;
• encryption of data in transit and at rest within approved cloud platforms;
• endpoint security, including device password or biometric authentication, device encryption where available, current operating system and application patching, and antivirus or endpoint protection where applicable;
• backup arrangements provided by approved cloud platforms;
• acceptable use, confidentiality and bring-your-own-device requirements for employees, contractors, sub-contractors and freelance consultants, supported by written contracts, non-disclosure agreements and policy acknowledgements;
• security screening and vetting of relevant directors, employees, temporary employees, contractors and sub-contractors before commencement of contracted work, according to the role to be performed;
• third-party due diligence and contractual data protection terms (including section 21 operator obligations) for service providers that process personal information for XMwize;
• documented incident management and security compromise procedures, including escalation, containment, assessment, notification and remediation;
• clean-desk and secure-disposal practices, including secure destruction of paper records and secure deletion of electronic records when no longer required;
• annual review of policies, registers and assurance evidence by senior management, supported by the Information Risk and Privacy Coordinator; and
• a standalone Disaster Recovery Plan addressing availability, recovery time and recovery point objectives, with testing and review.

Further detail is available on request, subject to applicable confidentiality, contractual and security considerations.

9. Procedure for requesting access to records

9.1 A requester who wishes to obtain access to a record held by XMwize must submit a written request on the form prescribed in the PAIA Regulations (Form 2: Request for Access to Record of Private Body) to the Information Officer at the address set out in section 3 above.

9.2 The request must:

• (a) provide sufficient particulars to enable XMwize to identify the record and the requester;
• (b) indicate the form of access required;
• (c) specify a postal address or electronic mail address of the requester in the Republic;
• (d) identify the right that the requester seeks to exercise or protect, and provide an explanation of why the requested record is required for the exercise or protection of that right (this requirement is set out in section 53(2)(d) of PAIA and is mandatory for requests to private bodies);
• (e) if the request is made on behalf of another person, be accompanied by proof of the capacity in which the requester is making the request, to the satisfaction of the Information Officer; and
• (f) be accompanied by the prescribed request fee where applicable (see section 10 below).

9.3 If a requester is unable to read or write, or has a disability, the request may be made orally to the Information Officer, who will reduce the request to writing and provide a copy to the requester.

9.4 The Information Officer must, within 30 days of receipt of the request, decide whether to grant or refuse the request, and notify the requester of the decision and, where access is granted, the access fee payable.

9.5 The 30-day period may be extended once for a further period of not more than 30 days in the circumstances contemplated in section 57 of PAIA.

9.6 Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including but not limited to the mandatory protection of the privacy of third parties who are natural persons, the mandatory protection of commercial information of third parties, the mandatory protection of confidential information of third parties, the mandatory protection of the safety of individuals and protection of property, the mandatory protection of records privileged from production in legal proceedings, the protection of commercial information of XMwize, and the protection of research information.

9.7 Where a request is refused, XMwize will provide the requester with written reasons for the refusal and inform the requester of the right to lodge a complaint with the Information Regulator or to apply to a court.

10. Fees

The fees payable in respect of a PAIA request are set out in Annexure B of the PAIA Regulations. At the date of this Manual the prescribed fees include a request fee and an access fee, calculated according to the form of access, reproduction cost and search time. If a deposit is required, the requester will be notified in writing of the amount and the basis for the calculation.

Note: Confirm the current prescribed fees against the latest PAIA Regulations published in the Government Gazette before publishing this Manual. The prescribed fees are amended from time to time by the Minister.

11. Remedies available to requesters

A requester who is dissatisfied with a decision of XMwize under PAIA may:

• lodge a complaint with the Information Regulator in terms of section 77A of PAIA; or
• apply to a court for appropriate relief in terms of section 78 of PAIA.

XMwize, as a private body, does not operate an internal appeal procedure under PAIA. Recourse is via the Information Regulator or the courts.

The contact details of the Information Regulator are set out in section 4 above.

12. POPIA data subject requests

12.1 Where the request relates to a data subject's rights under POPIA, including access to personal information under section 23, correction or deletion under section 24, objection to processing under section 11(3), or any other right conferred by POPIA, the request will be handled in accordance with the XMwize Data Subject Rights and Request Handling procedure set out in the Information Risk, Data Privacy Governance and Acceptable Use Policy.

12.2 Requests for access to personal information under POPIA are facilitated through the PAIA request procedure set out above, with appropriate adjustment for the rights conferred by POPIA.

12.3 The prescribed POPIA forms are:

• Form 1: Objection to processing of personal information in terms of section 11(3) of POPIA;
• Form 2: Request for correction or deletion of personal information or destruction or deletion of record of personal information in terms of section 24(1) of POPIA;
• Form 3: Application for the consent of a data subject for the processing of personal information of a child for the purpose of section 35(1)(a) of POPIA;
• Form 4: Submission of a complaint to the Information Regulator;
• Form 5: Application for the issuing of an enforcement notice.

13. Availability of the manual

13.1 A copy of this Manual is available:

• a) on the XMwize website at https://xmwize.co.za/ (pending website update)
• b) at the registered office of XMwize, for public inspection during normal business hours;
• c) to any person, upon request and on payment of a reasonable prescribed fee for a printed copy, or free of charge in electronic form; and
• d) to the Information Regulator, upon request.

13.2 A fee for a copy of the Manual, as contemplated in Annexure B of the PAIA Regulations, is payable per each A4-size photocopy made.

14. Updating of the manual

The Information Officer will, on a regular basis and at least annually, update this Manual. The Manual will also be updated whenever any material change occurs in the information set out in it. Superseded versions of the Manual will be archived for at least five years.

Issued by:

Debra Ann (Debi) Potgieter
Information Officer
Chief Executive Officer
XMwize Solutions (Pty) Ltd

Date: 3 June 2026