Information Regulator turns to SAPS over PAIA non-compliance

The Information Regulator (IR) has referred cases to the South African Police Service against information officers for failing to comply with its enforcement notices.

Law firm Webber Wentzel described this is a notable shift in how the IR is approaching compliance with the Promotion of Access to Information Act (PAIA) and “has significant personal consequences for individuals who have been appointed as information officers or heads of private bodies”. Upon conviction, an information officer or the head of a private body may be liable to a fine or imprisonment for up to three years, or both.

On 13 November, the Regulator provided the media with an extensive briefing on high-profile cases related to the Protection of Personal Information Act and PAIA, as well as other compliance-related matters.

Advocate Pansy Tlakula (pictured), the chairperson of the IR, said the session “comes at a significant time as we commemorate 25 years of PAIA, a law that promotes transparency, good governance, and accountability”.

Tlakula told the briefing that the Regulator has referred the following three PAIA-related cases to SAPS:

1. OUTA versus RTMC

The Organisation Undoing Tax Abuse (OUTA) had requested access to records from the Road Traffic Management Corporation (RTMC) relating to how fees in the RTMC’s January 2022 regulations were composed.

OUTA’s request was refused, and the organisation lodged a complaint with the Regulator.

The IR issued an enforcement notice setting aside the RTMC’s denial, but the RTMC did not comply. As a result, the IR has registered a criminal case with SAPS against the RTMC’s information officer for contravention of PAIA.

2. Pieter-Louis Myburgh versus State Security Agency

Investigative journalist Pieter-Louis Myburgh requested disclosures from the State Security Agency (SSA) regarding financial disbursements made to a service provider between 2015 and 2019.

Myburgh did not receive the requested records and submitted a PAIA complaint to the IR. The Regulator concluded that the SSA’s claims – that release would compromise national security or ongoing criminal investigations – were not sufficiently justified and issued an enforcement notice compelling the SSA to disclose the records.

The SSA failed to comply. Consequently, the IR lodged a criminal complaint with SAPS against the former acting director-general of the SSA.

3. Kudung Communal Property Association

In August this year, the IR issued an enforcement notice to the Kudung Communal Property Association following a complaint about a “refusal” to provide access to records.

The complainant had asked for a variety of financial and governance documents: financial books, invoices, receipts, contracts, and attendance registers.

The IR found that the Association had not shown any valid PAIA-based ground for withholding the records and ordered full disclosure within 31 days.

The Association failed to comply, and the IR is in the process of referring the matter to SAPS for criminal investigation.

Release of Zuma’s tax records

In the most high-profile PAIA-related case to date, the IR ordered the South African Revenue Service to release former president Jacob Zuma’s tax records.

In February 2019, the amaBhungane Centre for Investigative Journalism and Warren Thompson, then a journalist at the Financial Mail, filed PAIA requests for access to Zuma’s tax records for the years 2010 to 2018.

After SARS refused the request, amaBhungane and Thompson took their battle all the way to the Constitutional Court. In May 2023, the Court ruled that the tax legislation and PAIA were unconstitutional to the extent that they did not provide for disclosure of taxpayer information if the public interest demanded it.

amaBhungane and Thompson then filed new requests for information – for Zuma’s tax returns and for various other documents related to his tax affairs. In December 2023, SARS again refused to the information, stating the requested documents did not disclose evidence of a contravention of or failure to comply with the law.

Tlakula said that following an extensive investigation, the IR found that SARS was not justified in denying access to the requested records. On 12 November, the Regulator issued an enforcement notice directing SARS to disclose Zuma’s tax returns, assessments, and records of correspondence.

Oceana Empowerment Trust dispute

The Regulator also issued an enforcement notice to the Oceana Empowerment Trust, directing it to release information relating to a dispute with three former employees.

Nigel Lawrence, Samuel Williams, and Michel Consalves requested access to information regarding the Oceana Group Black Employee Trust Share Trust in which they are employee beneficiaries.

The Trust disclosed some of the records but denied access to others on the basis that the requesters had not shown how the requested information was needed for them to exercise or protect their rights.

Tlakula said the IR set aside the decision and ordered the release of the up-to-date list of beneficiaries and all documents relating to the sourcing of R292m, more specifically, any agreements and all documents pertaining to any loan or capital contributions that had been made.

Battle with tech giants over jurisdiction

The IR is in “a battle” with multinational big tech companies and owners of digital platforms such as Google and Meta on the question of the jurisdiction of PAIA, Tlakula said.

She said these companies are refusing to grant access to their records on the basis that PAIA does not apply beyond South Africa’s borders, despite their conducting business in the Republic.

The complainants had requested access to records relating to the classification of elections, risk assessments concerning South Africa’s electoral integrity, and the entities’ application of global policies to the local context.

“We are of the firm view that PAIA applies to foreign persons or companies doing business with South Africans and those who live in it even if they are physically located elsewhere. To resolve this sticky question, we have sought a legal opinion on the jurisdictional issue on our enforcement powers in relation to entities domiciled abroad but doing business in South Africa. If the legal opinion informs us that we have good prospects of success, we’ll test this matter in our courts,” Tlakula said.

DA complaint against Gauteng Premier

The Regulator is investigating a PAIA complaint by the Democratic Alliance against Gauteng Premier Panyaza Lesufi’s office.

The DA requested 177 forensic investigation reports dating from 2016. After refusing access, the Office later disclosed some of them. As of mid-2025, 47 of those reports were made public, according to Gauteng government statements. The 47 released reports include investigations into fraud, corruption, maladministration, and other irregularities – and the Premier said these cases led to disciplinary measures, criminal referrals, and recovery of some misused funds.

In its preliminary investigation, the IR found that the Premier’s office had not provided sufficiently detailed grounds for refusal – specifically failing to articulate which PAIA refusal provisions applied.

The investigation continues in relation to the outstanding reports.

PAIA compliance outcomes

Last year, the IR conducted 80 PAIA compliance assessments across the public and private sectors, including social media companies, Parliament, provincial legislatures, constitutional bodies, and medical schemes.

One of the key findings was that many bodies still fail to make PAIA manuals publicly accessible, which is a criminal offence and hinders the public’s right to information, Tlakula said.

The non-submission of PA annual reports remains a widespread problem, “undermining transparency and accountability”.

The annual reports provide information on the number of requests for access to information received and access granted or denied, among other access-to-information activities. Tlakula said the reports are critical for the Regulator to carry out its obligation to monitor and enforce compliance with PAIA.

There was a slight improvement in the submission of the 2024/25 annual reports by both private and public bodies compared with 2023/24.

The IR received 91 096 reports from private bodies, compared with only 34 460 reports in the previous year. Public body submissions increased to 41.66% (2023/24: 33%). Of 853 public bodies, 358 submitted reports to the Regulator.

The Regulator is particularly concerned about the non-submission of reports by municipalities and Technical and Vocational Education and Training (TVET) colleges. Of 257 municipalities, only 69 submitted their annual reports – a 27% submission rate. Only six out of fifty TVET colleges submitted reports.

There was also a decline in the submission of reports by provincial government business enterprises – from 33% to 28%.

The Regulator had “robust engagements” with public and private bodies on their obligation to comply with PAIA on 29 September, when it commemorated the International Day for Universal Access to Information.

“We informed them that we are in the process of developing proposals for reforming PAIA to make it fit for purpose in the digital era and to strengthen our enforcement powers, including the ability to impose sanctions and administrative fines on those who contravene PAIA,” Tlakula said.