The head of a private body must make available a manual containing the head's postal and street address, phone and email; any other prescribed information; a description of the Regulator's guide and how to obtain it; any voluntary disclosure description; records available under other legislation; enough detail to facilitate a request, with the subjects on which records are held and the categories on each; and, for POPIA, the purposes of processing, categories of data subjects and their information, recipients, planned cross-border flows and a general description of information security measures. The manual must be updated regularly and made available on the website (if any), at the principal place of business during business hours, to anyone on request for a reasonable amount, and to the Regulator on request. According to the Information Regulator's Guide, the Minister's exemptions for smaller private bodies ended on 31 December 2021, so from 1 January 2022 every private body needs one. Wilful or grossly negligent failure is an offence punishable by a fine or up to two years' imprisonment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.