PAIA & POPIA Manual (South Africa)
The manual required of private bodies under section 51 of the Promotion of Access to Information Act 2 of 2000, covering how to request access to records held by the Registry in South Africa and how personal information is processed under POPIA.
1. Introduction
This manual is published by K2025/850330/07 (the "Private Body"), which delivers EBRICS Registry services in the Republic of South Africa, in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") and the Protection of Personal Information Act 4 of 2013 ("POPIA").
2. Contact details
| Private Body | K2025/850330/07 |
| Information Officer | NA |
| privacy@eurabeltfuels.com | |
| Website | https://ebrics.eurabeltfuels.com |
3. Guide on how to use PAIA
The Information Regulator has published a Guide on how to use PAIA. It is available from the Information Regulator, and the Information Officer will provide a copy on request.
4. Records available without a request
The Registry's policies, including this manual, the Privacy Notice and the Verification Standard, are freely available in the Legal Centre.
5. Categories of records held
| Subject | Categories of records |
|---|---|
| Company | Incorporation documents, statutory registers, board minutes and resolutions |
| Registry operations | Applications, due-diligence records, the Reserve Ledger, ATVs, seal records, verification logs, audit logs |
| Compliance | Sanctions screening records, AML/CTF records, reports to authorities (access may be refused where disclosure is prohibited by law) |
| Finance | Accounting records, invoices, tax records |
| Personnel | Employment contracts, payroll, disciplinary and training records |
| Suppliers | Contracts, due diligence and correspondence |
6. Processing of personal information (POPIA)
- Purpose: verification and codification of fuel-industry participants, sanctions screening, fraud prevention, and disclosure to counterparties authorised by the code holder.
- Data subjects and categories: as set out in sections 2 and 3 of the Privacy Notice.
- Recipients: authorised counterparties; service providers; the Registry's group entities in the United Kingdom, Canada and Trinidad and Tobago; and authorities where the law requires it.
- Cross-border transfers: made under section 72 of POPIA, using binding agreements that provide an adequate level of protection.
- Security measures: encryption at rest (AES-256-GCM), keyed hashing of identifiers, role-based access with two-factor authentication, audit logging and integrity monitoring. See the Security Overview.
7. Requesting access to a record
- Complete the prescribed request form (Form 2 of the PAIA Regulations) and send it to the Information Officer.
- Provide proof of identity and, if you are acting for someone else, proof of your authority.
- Identify the record and the right you wish to exercise or protect.
- Pay any prescribed fee. The Information Officer will tell you if a fee applies.
The Information Officer will decide on the request within 30 days. This period may be extended once, by up to 30 days, in the circumstances set out in PAIA.
8. Grounds for refusal
Access may be refused on the grounds in Chapter 4 of Part 3 of PAIA, including to protect the privacy of third parties, commercial information of third parties, confidential information, the safety of individuals and property, records privileged from production in legal proceedings, and research information. Records of reports to the Financial Intelligence Centre may not be disclosed.
9. Remedies
If you are not satisfied with a decision, you may complain to the Information Regulator or apply to a court under PAIA.
10. Availability
This manual is available in the Legal Centre and, on request, from the Information Officer. It is reviewed annually.