PAIA and POPIA Manual

Manual prepared for: Alpha Kilo Security Services (Pty) Ltd
Prepared in terms of: Promotion of Access to Information Act 2 of 2000 and Protection of Personal Information Act 4 of 2013
Effective date: 26 June 2026
Review cycle: At least annually or when there is a material legal, operational or company-information change

1. Introduction

This Manual explains how members of the public may request access to records held by Alpha Kilo and how Alpha Kilo processes personal information. It is intended to support transparency, lawful access to information and responsible personal-information governance.

2. Company details

3. Information Officer

The Information Officer is the Information Officer or another duly authorised Alpha Kilo representative. Requests, privacy enquiries and PAIA/POPIA correspondence should be sent to admin@alphakilosec.co.za.

4. PAIA Guide

The Information Regulator has published a PAIA Guide explaining how to exercise rights under PAIA and related personal-information rights under POPIA. A copy may be obtained from the Information Regulator's website or requested from the Information Regulator.

5. Applicable legislation

Alpha Kilo may hold records under legislation that includes the Companies Act, Income Tax Act, VAT legislation where applicable, Labour Relations Act, Basic Conditions of Employment Act, Employment Equity Act where applicable, Skills Development legislation, Occupational Health and Safety Act, Compensation for Occupational Injuries and Diseases Act, Private Security Industry Regulation Act, Broad-Based Black Economic Empowerment Act, Promotion of Access to Information Act, Protection of Personal Information Act and other laws applicable to private security operations.

6. Categories of records held by Alpha Kilo

Alpha Kilo may hold the following records:

6.1 Company and governance records

Company registration documents, CIPC records, director information, resolutions, governance records, policies, insurance records, compliance certificates, tax records, PSIRA records, COIDA records, CSD records and B-BBEE evidence.

6.2 Financial and procurement records

Invoices, statements, quotations, purchase orders, bank records, supplier records, payment records, accounting records, asset registers, audit records and tax records.

6.3 Human resources records

Employment contracts, personnel files, job applications, CVs, interview notes, training records, PSIRA records, qualification records, payroll records, leave records, disciplinary records, performance records, health and safety records and termination records.

6.4 Client and operational records

Client contracts, site instructions, risk assessments, service level agreements, occurrence books, duty rosters, incident reports, patrol reports, access-control records, visitor logs, site communications, emergency contact lists, operational escalation records and client meeting records.

6.5 Legal, risk and compliance records

Contracts, claims records, complaints, correspondence with regulators, legal advice, dispute records, insurance claims, investigation records, internal audit records, risk registers and compliance reviews.

6.6 Information technology and website records

Website contact forms, email correspondence, system access logs, user records, device records, security logs, backup records and supplier support records.

7. Records automatically available

The following records may be made available without a formal PAIA request where appropriate: company profile, website pages, Privacy Policy, Terms of Legal Use, Terms and Conditions, PAIA and POPIA Manual, public marketing material, public compliance statements and general service descriptions.

8. Records not automatically available

Operational security records, site plans, incident reports, client confidential information, personnel information, CCTV footage, patrol records, disciplinary records, privileged legal records, security-sensitive information and third-party personal information are not automatically available and must be requested under PAIA where applicable.

9. How to request access to a record

A requester must submit the prescribed PAIA Form 2 or a substantially corresponding request to the Information Officer. The request must identify the record, identify the requester, provide proof of identity, provide proof of authority if acting for another person, state the right to be exercised or protected and explain why the record is required for that right.

10. Fees

Alpha Kilo may require payment of prescribed request fees, access fees, copying fees, search fees or deposits where allowed by PAIA and applicable regulations. The requester will be notified where fees are payable.

11. Decision and response period

Alpha Kilo will respond to a valid request within the period required by PAIA. Where allowed by law, the response period may be extended and the requester will be notified.

12. Grounds for refusal

Access may be refused where PAIA permits refusal, including for protection of third-party privacy, confidential commercial information, safety or security interests, law-enforcement or investigation interests, legal privilege, research information, operational vulnerability information, confidential client records, or where the request is frivolous, vexatious or otherwise not compliant with PAIA.

13. Remedies

A requester who is dissatisfied with a decision may lodge a complaint with the Information Regulator or approach a competent court where permitted by PAIA.

14. POPIA processing overview

Alpha Kilo processes personal information as a responsible party and, in some circumstances, as an operator acting on client instructions. Processing may include collection, receipt, recording, organisation, storage, use, consultation, disclosure, transfer, restriction, erasure or destruction of personal information.

15. Categories of data subjects

Alpha Kilo may process personal information relating to clients, prospective clients, client representatives, site visitors, suppliers, job applicants, employees, contractors, security officers, trainees, complainants, witnesses, emergency contacts, regulators, public officials and members of the public who interact with Alpha Kilo or client premises where Alpha Kilo operates.

16. Categories of personal information

Alpha Kilo may process identifying information, contact information, employment information, qualification information, PSIRA and training information, financial information, banking details, tax information, background-check information, access-control information, CCTV footage, photographs, incident information, communication records, complaint records, disciplinary records and technical website information.

17. Purpose of processing

Personal information is processed for service delivery, quotations, client management, access control, site operations, incident reporting, recruitment, employment, payroll, training, compliance, procurement, payment administration, fraud prevention, dispute management, insurance, safety and security, regulatory reporting, audit, legal compliance and business administration.

18. Recipients of personal information

Personal information may be shared with clients, service providers, payroll providers, banks, auditors, insurers, legal advisers, regulators, PSIRA, SARS, the Compensation Fund, training providers, verification providers, background-check providers, emergency services, law-enforcement agencies and other parties where necessary for a lawful purpose.

19. Cross-border transfers

Alpha Kilo will transfer personal information outside South Africa only where permitted by POPIA, required for service delivery, authorised by the data subject, required by law, protected through appropriate contractual safeguards or otherwise lawful.

20. Security safeguards

Alpha Kilo applies reasonable measures to protect personal information. Measures may include access controls, confidentiality undertakings, password protection, secure filing, limited access to personnel records, secure destruction, supplier due diligence, incident escalation, training and internal policies.

21. Retention and destruction

Records are retained for the period required by law, contract, operational need, audit requirement, insurance requirement, dispute risk or legitimate business purpose. Records no longer required are destroyed, deleted, archived or de-identified where appropriate.

22. Data subject participation

A data subject may request access to personal information held by Alpha Kilo, request correction of inaccurate information, request deletion or destruction where allowed, object to processing where permitted and complain to the Information Regulator.

23. Availability of this Manual

This Manual should be made available on the Alpha Kilo website and may be supplied on request by email or at the company's principal place of business.

24. Review and version control

This Manual must be reviewed at least annually and whenever there is a material change to Alpha Kilo's company information, operations, processing activities, legislation, regulatory guidance or contact details.

Last updated: 26 June 2026