PAIA manual
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA).
| Private body | World Risk Global |
|---|---|
| Date compiled | 25 September 2026 |
| Date last revised | 6 October 2026 |
1. Abbreviations
| Term | Meaning |
|---|---|
| World Risk, we, us | World Risk Global |
| Guide | The Guide on how to use PAIA and POPIA, published by the Information Regulator under section 10 of PAIA |
| Information Officer | The head of our business for the purposes of PAIA and POPIA |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| PAIA Regulations | Regulations Relating to the Promotion of Access to Information, 2021 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| POPIA Regulations | Regulations Relating to the Protection of Personal Information, 2018, as amended on 17 April 2025 |
| Regulator | Information Regulator (South Africa) |
2. Purpose of this manual
This manual helps you to:
- see which of our records you can get without a formal request
- understand the subjects on which we hold records, and the categories of records on each subject, so that you can make a request
- find the Regulator's Guide and contact details
- learn how to request access to a record, what it costs, and what you can do if we refuse
- understand how we process personal information: why, about whom, who receives it, whether it leaves South Africa, and how we protect it
3. Our contact details
3.1 Information Officer
Send requests for our Information Officer to yasmin@worldrisk.co.za.
3.2 Business details
| Name | World Risk Global |
|---|---|
| yasmin@worldrisk.co.za | |
| PSIRA registration details | Available on request |
4. The Regulator's Guide on how to use PAIA
The Regulator has published a Guide, under section 10 of PAIA, that explains how to use PAIA and POPIA. It sets out how to make a request, what it costs, the time limits, and the remedies if a request is refused. It is available in all eleven written official languages.
You can get the Guide:
- from the Regulator's website, inforegulator.org.za
- at the Regulator's office during office hours
- from us. We will give you a copy free of charge if you ask for one, using Form 1 of the PAIA Regulations or a clear written request (regulation 3 of the PAIA Regulations)
The Regulator's contact details are:
| General enquiries | enquiries@inforegulator.org.za |
|---|---|
| PAIA complaints | PAIAComplaints@inforegulator.org.za, or online at eservices.inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za, or online at eservices.inforegulator.org.za |
| Website | inforegulator.org.za |
5. Records available without a request
There is no notice under section 52(2) of PAIA for our records. The following records are available to anyone without a formal request, as section 52(1) allows:
- the pages of our website, including descriptions of our services, how we work, where we work, and our guides
- our privacy notice, website terms of use and this manual, all on our website
As regulation 5 of the PAIA Regulations requires, we keep this list up to date and make it available on our website, at our office and to the Regulator. If you want a printed copy of one of these records, you pay only the reproduction fee in Annexure B of the PAIA Regulations.
6. Records available under other laws
We keep records that other laws require, and some of them are available as those laws allow.
| Records | Law |
|---|---|
| Memorandum of incorporation, share register, directors' records, and filings with the Companies and Intellectual Property Commission | Companies Act 71 of 2008 |
| Accounting records, invoices, tax registrations and tax returns | Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011 |
| VAT records, if we are registered for VAT | Value-Added Tax Act 89 of 1991 |
| Registration with the Private Security Industry Regulatory Authority, and records the Act requires, where it applies to a service we provide | Private Security Industry Regulation Act 56 of 2001 |
| Employment contracts, and records of working time and pay | Basic Conditions of Employment Act 75 of 1997 |
| Employment equity records, if we are a designated employer | Employment Equity Act 55 of 1998 |
| Collective agreements and arbitration awards, where they apply | Labour Relations Act 66 of 1995 |
| Registration with the Compensation Fund, returns of earnings, and records of injuries at work and claims | Compensation for Occupational Injuries and Diseases Act 130 of 1993 |
| Health and safety records and incident records | Occupational Health and Safety Act 85 of 1993 |
| Unemployment Insurance Fund registration, contributions and employee declarations | Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002 |
| Skills development levy registration and returns, if the Act applies to us | Skills Development Levies Act 9 of 1999 |
| Agreements with consumers, and records of complaints, where the Act applies | Consumer Protection Act 68 of 2008 |
| The business information on our website, and electronic communications with clients | Electronic Communications and Transactions Act 25 of 2002 |
| This manual, and requests for access to records and our replies | Promotion of Access to Information Act 2 of 2000 |
| Records about our Information Officer, our privacy notice, and requests, objections and consents about personal information | Protection of Personal Information Act 4 of 2013 |
A record on this list is not necessarily available to the public. The law it is kept under decides who may see it.
7. Subjects and categories of records we hold
| Subject | Categories of records |
|---|---|
| Company and governance | Registration documents, memorandum of incorporation, share register, directors' resolutions and minutes, filings with the Companies and Intellectual Property Commission, this manual, records about our Information Officer |
| Finance and tax | Accounting records, bank statements, invoices issued and received, tax registrations and returns, budgets |
| Clients | Enquiries, proposals, quotes, service agreements, risk assessments and reports, correspondence, invoices, payment records and complaints |
| Operations | Live tracking and command centre records, route and alert records, incident and response records, recovery records, investigation files and evidence records, and reports to clients |
| Licences and compliance | Registrations and licences that apply to our services, staff registrations, and records of the providers we appoint and what we confirmed about them |
| Staff | Employment contracts, payroll and tax records, Unemployment Insurance Fund records, leave records, training records, disciplinary records, and job applications |
| Insurance | Insurance policies and claims |
| Suppliers and service providers | Contracts, orders, invoices and correspondence with suppliers and service providers, including our web developer and email provider |
| Website | Website content and settings, analytics settings and domain records |
| Legal and compliance | Privacy notice, terms of use, operator agreements, POPIA and PAIA requests and replies, legal correspondence |
A category on this list does not confirm that a particular record exists, or that we must release it. We may or must refuse access on the grounds in Chapter 4 of Part 3 of PAIA (sections 62 to 70), for example to protect another person's privacy, a third party's commercial or confidential information, someone's safety, the security of property or a means of transport, or legally privileged records. If only part of a record is protected, we will release the rest.
8. How we process personal information
This section sets out the information that section 51(1)(c) of PAIA requires about how we process personal information under POPIA. Our privacy notice gives more detail for website visitors and people who contact us.
8.1 Why we process personal information
- to answer enquiries and prepare proposals and quotes
- to carry out the services a client appoints us for, keep service records and report to the client
- to invoice, receive payments and keep accounting and tax records
- to meet our licensing, health and safety and other legal duties
- to employ and pay staff, and to recruit
- to appoint and manage suppliers, insurers and service providers
- to run and secure our website
- to handle complaints, insurance claims and legal claims
8.2 About whom we process information, and what information
| Data subjects | Personal information |
|---|---|
| Website visitors | Technical information such as IP address, pages requested, browser and device type, and security signals. The visitor's sound setting, stored in their browser |
| People who enquire | Name, company name, email address, phone number, what they tell us, and any correspondence |
| Clients, and contact people at business clients | Names, contact details, job titles, correspondence, service agreements, reports, invoices and payment records |
| People connected to a service we provide, such as a client's drivers and staff | Names, contact details, and the information a service needs, such as vehicle and route information, locations from tracking devices, and incident records |
| People involved in an incident or investigation | The information an investigation or recovery needs, which may include information about alleged offences, handled only as the law allows |
| Staff and job applicants | Names, identity numbers, contact details, addresses, tax and bank details, employment and pay records, training and registration records, and, where the law requires it, information about injuries at work |
| Suppliers and service providers, and their contact people | Names, contact details, company details, registrations and licences, bank details, contracts and correspondence |
8.3 Who may receive personal information
- the web developer who built our website, when they fix a major fault for us
- Cloudflare, Inc., which hosts and protects our website
- our email provider, which hosts our email
- the service providers we appoint for a client's service, such as response, recovery, air, K-9 or forensic providers, only as much as that service needs
- our clients, in the reports we give them about their service
- our accountant, bank, insurers and legal advisers
- the South African Revenue Service, the Private Security Industry Regulatory Authority, the Unemployment Insurance Fund, the Compensation Fund, the Department of Employment and Labour and other public bodies, where the law requires it
- the police, courts and other authorities, where the law requires or allows it
8.4 Planned transfers outside South Africa
Cloudflare processes information in many countries, including the United States. It is bound by data processing terms that protect personal information to a standard substantially similar to POPIA (section 72(1)(a) of POPIA).
We work in countries in Africa and Europe. When a client's service runs in another country, we send the people doing that work only the information the service needs, and only on a ground section 72 of POPIA allows, such as a binding agreement that protects it to a standard substantially similar to POPIA.
8.5 How we protect personal information
- Our website is served only over encrypted (HTTPS) connections, with strict browser security settings.
- Only the people who need personal information to do their work can see it.
- Our web developer, Cloudflare and our service providers may process personal information only on our instructions, and must keep it confidential and secure, as sections 20 and 21 of POPIA require.
- We keep personal information only as long as we need it or the law requires, and then delete or destroy it.
- If we believe personal information has been accessed without permission, we will tell the Regulator and the people affected, as section 22 of POPIA requires.
9. How to request access to a record
9.1 Your own personal information
You can ask whether we hold personal information about you, and ask for it, under section 23 of POPIA, without the PAIA request form. Our privacy notice explains your rights and how to use them.
9.2 Other records
- Complete Form 2 of the PAIA Regulations (Request for access to record). You can download it from the Regulator's PAIA forms page, or ask us for a copy.
- Send it to our Information Officer by email, at the address in section 3.
- Give enough detail for us to identify the record and you, say in what form you want access, and give a postal address or fax number in South Africa where we can reach you, and an email address if you have one.
- Say which right you want to use or protect, and explain why you need the record to do so (section 53 of PAIA).
- If you are asking on behalf of someone else, include proof that you may act for them.
If you cannot read or write, or have a disability that makes the form difficult, you may make your request orally. Our Information Officer will complete Form 2 for you and give you a copy (regulation 7 of the PAIA Regulations). Our Information Officer will also help you with any other part of your request.
9.3 Fees
The fees are set in Annexure B of the PAIA Regulations. For a private body like ours, they are:
| Item | Fee |
|---|---|
| Request fee, payable before we process the request (section 54(1) of PAIA). To ask for your own personal information, use section 9.1 instead | R140.00 |
| Photocopy or printed copy of an A4 page | R2.00 per page or part of a page |
| Copy on a flash drive you provide | R40.00 |
| Copy on a compact disc you provide | R40.00 |
| Copy on a compact disc we provide | R60.00 |
| Transcription of an audio record | R24.00 per A4 page |
| Copy of an audio record on a flash drive you provide, or a compact disc you provide | R40.00 |
| Copy of an audio record on a compact disc we provide | R60.00 |
| Transcription or copy of visual images | The cost quoted by the service provider we use |
| Search for and preparation of a record, for each hour or part of an hour after the first hour | R145.00, up to R435.00 in total |
| Deposit, if the search will take more than six hours | One third of the access fee |
| Postage, email or other electronic transfer | The actual cost |
We will tell you in writing what fees apply. We may keep a record until the fees are paid. If we refuse your request after you paid a deposit, we will repay it. If you disagree with a fee or deposit, you may complain to the Regulator.
9.4 Time limits and our decision
We will decide on your request and tell you within 30 days of receiving it with all the required details (section 56 of PAIA). If the request involves many records, needs a search in another place, or needs us to consult others, or if you agree, we may extend this once, by up to 30 more days. We will tell you in writing before the first 30 days end (section 57). If we do not decide in time, the law treats your request as refused (section 58).
If a record concerns someone else, we must first tell that person and give them 21 days to respond before we decide (section 71). We will let you know if this applies.
If we refuse your request, we will give you the reasons and the sections of PAIA we rely on, without revealing what the record contains.
9.5 If you are not satisfied
You may complain to the Regulator within 180 days of our decision (section 77A of PAIA), using the Regulator's PAIA complaint form (Form 5), sent to PAIAComplaints@inforegulator.org.za. After the complaint process, you may apply to court within 180 days (section 78).
10. Availability of this manual
As section 51(3) of PAIA requires, this manual is available:
- on our website, at /paia
- at our principal place of business, for anyone to inspect during normal business hours
- to anyone who asks for a copy, for a reasonable fee to cover the cost of copying
- to the Regulator, on request
11. Updating this manual
We review this manual regularly, as section 51(2) of PAIA requires, and whenever our records, service providers or contact details change. The dates at the top show the current version.
Issued by the Information Officer of World Risk Global.