An enforcement notice issued by the Information Regulator against Sibanye-Stillwater may offer one of the clearest recent indications of how the Regulator intends to deal with disputes under the Promotion of Access to Information Act (PAIA) involving private companies.
According to law firm ENS, the significance of the notice – issued on 22 May 2026 – lies less in the immediate dispute over access to mining compliance records than in what it may reveal about the Regulator’s approach to enforcement.
Wilmari Strachan, an executive in the technology, media and telecommunications practice at ENS, said the decision suggests the Regulator is prepared to do more than investigate and conciliate complaints. In this case, it issued a binding notice compelling disclosure, rejected the argument that only a court can meaningfully determine whether an exemption applies, and found that the company’s claims of commercial harm had not been supported by sufficient facts.
The notice does not establish an entirely new legal position. PAIA already empowers the Regulator to issue enforcement notices, and the statute already provides that failure to comply with such a notice is an offence. What the notice shows is that the Regulator was prepared to use those powers against a listed private company in a contested access dispute and to set out, in detailed terms, why it considered the refusal grounds insufficient.
The notice also raises a broader question about the standard private companies may be expected to meet when refusing access under PAIA on commercial-confidentiality grounds.
The Regulator repeatedly found that Sibanye had not put forward enough factual material to show that disclosure of the requested records would be likely to cause commercial harm or could reasonably be expected to place it at a disadvantage in negotiations.
The dispute that gave rise to the notice
The dispute arose from a request submitted by the Centre for Applied Legal Studies (CALS) on 10 August 2023 for annual compliance reports linked to Sibanye’s 2019 to 2023 Social and Labour Plans (SLPs) for its Eastern and Western Platinum Mines, along with any amendments made to those plans under the Mineral and Petroleum Resources Development Act (MPRDA).
Sibanye refused access on 22 August 2023, relying on sections 68(1)(b) and 68(1)(c)(i) of PAIA, both of which concern the commercial information of a private body.
CALS lodged a complaint with the PAIA Division of the Information Regulator on 15 September 2023.
The dispute narrowed during the Regulator’s process. A conciliation meeting took place on 28 February 2024. The parties and the PAIA Division accepted an affidavit from Sibanye’s Deputy Information Officer stating that approved amendments under section 102 of the MPRDA for the relevant mining operations did not exist. That meant the annual compliance reports were the only records still in dispute by the time the matter reached the Enforcement Committee.
The PAIA Division found in favour of CALS and recommended that Sibanye’s refusal be set aside. According to the notice, the Division found that CALS had complied with PAIA’s procedural requirements, had identified the rights it sought to exercise or protect, and had shown that the records were reasonably required for that purpose. It also found that Sibanye had failed to provide sufficient evidence to justify the exemptions on which it relied.
CALS accepted those provisional findings, while Sibanye rejected them and made further submissions to the Enforcement Committee.
The legal framework in the notice
The notice emphasises that PAIA gives effect to the constitutional right of access to information and extends, in appropriate circumstances, to records held by private bodies. The notice states that PAIA proceeds on the basis that information in private hands with a “demonstrable and sufficient connection to the exercise or protection of any rights” “legitimately belongs in the public domain”. It also refers to section 9(e) of PAIA, which is intended to promote “transparency, accountability, and effective governance of all public and private bodies”.
The Regulator restated the principles it says govern the assessment of requests for records held by private bodies. It said that “access to information is the norm and PAIA must be interpreted to promote this objective”, and “exemption from disclosure is the exception”.
The burden of justifying a limitation of the right of access to information falls on the party seeking to withhold the record, and the burden must be discharged “on a balance of probabilities by providing evidence that the record in question falls within the description of the ground of refusal that is claimed”.
Why CALS was entitled to seek the records
Before addressing Sibanye’s exemption grounds, the Regulator had to decide whether CALS was entitled to seek the records under section 50 of PAIA. That section requires, among other things, that the record be required for the exercise or protection of a right.
The notice records that CALS identified several constitutional rights in support of its request, including the right of access to information, the right to academic freedom and freedom of scientific research, the right to have the environment protected for present and future generations, and the right to administrative justice.
Sibanye challenged both CALS’ standing and the authority of CALS researcher RD Krause to act on its behalf. It argued that CALS, because of its relationship with the University of the Witwatersrand, could not rely both on its own rights and on the public interest, and further contended that Krause lacked authority because no power of attorney had been filed with the complaint.
The Regulator rejected those objections. It found that CALS had the necessary locus standi to request records from a private body and that Krause had acted in his professional capacity in the same access process Sibanye had already entertained on the merits.
The notice places the annual compliance reports in the context of the MPRDA and the SLP regime. It explains that a holder of a mining right must submit a SLP, that the plan is valid and binding for five years, and that annual compliance reports must then be submitted under the regulatory framework. It distinguishes between the approved SLPs themselves, which the parties accepted were public documents, and the annual compliance reports dealing with implementation. CALS’ concern, the Regulator said, was with the latter question: whether the commitments in those plans were being carried out and what that meant for affected communities and other beneficiaries.
The Regulator concluded that the records were required for two linked purposes. The first was “determining how the compliance (or failure to comply) with the SLP is impacting the affected community and beneficiaries of the SLP”. The second was “determining if the Department of Mineral Resources and Energy (DMRE) is properly regulating compliance with the licence conditions, insofar as it relates to the respective SLPs or whether its capacity is limited”.
The notice says those purposes were aligned with CALS’ work and were therefore sufficient for the exercise of the rights it had identified. It also found that the records were required for the exercise of affected communities’ rights under the SLPs.
ENS drew out the significance of that part of the ruling for the mining sector. The notice shows the Regulator’s accepting that SLP compliance reports, although they may contain commercial information, are records in which affected communities have a legitimate interest.
Strachan added that the public interest in transparency and accountability in the mining sector is “considerable”, and the ruling “may open the door to further requests for access to similar records across the mining industry”.
The commercial-information exemptions
The central dispute nonetheless remained Sibanye’s reliance on PAIA’s commercial-information exemptions.
Section 68(1)(b) permits refusal where a record contains financial, commercial, scientific, or technical information the disclosure of which “would be likely to cause harm” to the body’s commercial or financial interests. Section 68(1)(c)(i) permits refusal where disclosure “could reasonably be expected” to place the private body at a disadvantage in contractual or other negotiations. Sibanye contended that the annual compliance reports fell within those protections.
The company said the reports measure progress and expenditure on a year-by-year basis, even though compliance with SLP obligations is assessed over five years. On that basis, it argued that annual “snapshots” could be misunderstood if viewed without the broader context, particularly if shortfalls in a given year were highlighted without noting that they were later addressed.
It also argued that disclosure could harm Sibanye’s reputation, affect its share price, and place it at a disadvantage in discussions with suppliers and in its engagements with the DMRE.
The Regulator accepted that the reports may contain commercial information, thereby satisfying what it treated as the first part of the section 68(1)(b) enquiry. But it found that Sibanye had not established the second part of the test: that disclosure would be likely to cause the type of harm contemplated by the statute.
The notice states that Sibanye’s “suspicions of what the complainant intends to do with the content of the compliance reports, or whether they will be properly understood, does not constitute an independent ground of refusal under PAIA”.
It also says that the company had “not set out a factual basis for its contention that disclosure is likely to cause harm to its commercial or financial interests”, and its contention was “mere speculation”.
The same approach was taken to section 68(1)(c)(i). The Regulator found that, “in the absence of any facts”, that submission amounted to “mere conjecture and speculation”. It added that public disclosure of the reports was “more likely to promote transparency and accountability, which could offset any potential disadvantage to Sibanye”. On that basis, the Regulator concluded that Sibanye had failed to justify refusal under either exemption.
This is the aspect of the decision that ENS treats as particularly important for private bodies generally. Strachan said the ruling suggests that organisations resisting access on commercial grounds will have to provide “specific, factual evidence” showing why the exemption applies.
She added that “bare assertions of commercial harm, speculation about the requester’s intentions, or generalised claims about reputational damage will not suffice”. Read this way, the ruling has practical implications for how companies assess and document refusal decisions under PAIA.
At the same time, Strachan noted that PAIA speaks in terms of information that would be “likely to” cause harm or that “could reasonably be expected” to place a company at a disadvantage, and said one could argue that those formulations admit a degree of prediction rather than the level of factual substantiation apparently demanded by the Regulator in this case. Accordingly, the ruling is “worth challenging” on that point.
The Regulator’s powers
Another significant section of the notice concerns the Regulator’s powers. Sibanye argued that the PAIA Division had overreached by asking it to substantiate its reliance on section 68 and contended that whether an exemption applied was ultimately a question for a court under section 81 of PAIA. The Regulator rejected that argument.
The notice states the submission “entirely negates the role of the Regulator” and points to section 77J, which empowers it to issue enforcement notices, and section 77K, which makes non-compliance with such notices an offence.
It also notes that section 78 allows an aggrieved requester to choose between approaching a court and using the statutory complaint procedure, a structure that would make little sense if the Regulator could only investigate without deciding anything.
The notice does not explicitly label the Regulator an adjudicative body. But it does make clear that the Regulator does not regard its role as limited to investigation or conciliation. It sees itself as entitled to assess the facts, determine whether the refusal grounds advanced have been established, and issue binding enforcement notices where they have not.
The order
Once the Regulator rejected Sibanye’s reliance on section 68, several other issues fell away. The notice states that severability under section 59 did not arise because Sibanye had not identified any portions of the records that could be severed and because its reliance on the section 68 exemptions had been rejected. It also says it was unnecessary to consider the public-interest override in section 70.
The notice further records that the PAIA Division had considered whether the records might be automatically available under Sibanye’s PAIA manual, but the Regulator regarded that point as moot because CALS had not made the request on that basis.
The notice directed Sibanye’s Deputy Information Officer to grant CALS access to the annual compliance reports for the 2019 to 2023 SLPs for the Eastern and Western Platinum Mines upon payment of the prescribed fee.
