Table of contents



1.1 CMS RM Partners Incorporated (Registration Number: 2018/243548/21) and CMS RM Partners (Proprietary) Limited (registration number: 2018/221212/07) and its associated businesses (collectively referred to as "CMS South Africa") provides a full spectrum of legal, tax and transaction advisory services to clients in a variety of industries. CMS RM Partners Inc is a member firm of CMS Legal Services EEIG (“CMS EEIG”), a European Economic Interest Grouping that coordinates an organisation of independent law firms. CMS EEIG and each of its member firms are separate and legally distinct entities, and no such entity has any authority to bind any other.

1.2 As part of its operations and services, CMS South Africa holds certain records (information and documents), including personal information. The Promotion of Access to Information Act No 2 of 2000 ("PAIA") and the Protection of Personal Information Act No 4 of 2013 ("POPI") provide for certain records and/or information to be accessed where certain circumstances are met and in accordance with certain procedures and at prescribed fees, giving effect to the right of access to information in terms of the Constitution of the Republic of South Africa.

1.3 This PAIA and POPI Manual ("the Manual") (which includes all annexures and amendments thereto as made available by CMS South Africa from time to time) has been prepared in accordance with section 51 of PAIA as read with POPI.  It provides an overview of the records (information and documents) held by CMS South Africa and details of how such records may be accessed, including in relation to giving effect to the rights granted under POPI terms of which a data subject may access its personal information, object to processing and request the correction of any of its personal information held by CMS South Africa.

1.4 CMS South Africa may amend this manual from time to time. It is available and accessible at cms.law or on request to CMS South Africa' designated Information Officer (being the person duly authorised by the management of CMS South Africa and appointed by CMS South Africa to act in this capacity).

1.5 CMS South Africa has appointed an Information Officer in accordance with POPI. In addition to its obligations prescribed under POPI, the designated Information Officer is also responsible for assessing any requests to CMS South Africa for access to information in terms of PAIA as well as to oversee any other obligations which CMS South Africa may have under PAIA. The Information Officer may appoint Deputy Information Officers to assist it in the fulfilment of its obligations.


(Information to be provided in terms of section 51(1)(a) of PAIA)


CMS RM Partners Inc

CMS RM Partners (Proprietary) Limited

Physical address

5th Floor, 85 Grayston Drive

Sandton, Johannesburg


South Africa

Postal address

Postnet Suite No. 1012

Private Bag X9

Benmore, 2010

Information Officer

Zaakir Mohamed

Telephone: +27 (0) 87 210 0711

Email: popi@cms-rm.com


3.1 The South African Human Rights Commission (SAHRC) has issued a guide on how to use the Act (as prescribed by section 10 of PAIA) and is available on the SAHRC website (www.sahrc.org.za). This Manual complies with the requirements of the guide (defined below) and recognises that the Information Regulator established under POPI will be responsible for regulating compliance with PAIA, POPI and their regulations.

3.2 See contact details below:



South African Human Rights Commission

Promotion of Access to Information Act Unit

Research and Documentation Department

Private Bag 2700




Telephone: +27 11 887 3600

Email: paia@sahrc.org.za

Information Regulator

Physical address:

JD House

27 Stiemens Street




Postal address:

P.O Box 31533







General enquiries:



4.1 Records which are freely available (section 51(1)(c) of paia)

4.1.1 The following records are automatically available to the general public and need not be requested in accordance with the procedure outlined in this Manual:

  • brochures;
  • information available on CMS South Africa's website. 

4.2 Records held by CMS South Africa in terms of other legislation (section 51(1)(d) of PAIA)

4.2.1 CMS South Africa retains a number of records in accordance with legislation which applies to it, including but not limited to:

  • Basic Conditions of Employment Act No 75 of 1997;
  • Companies Act No 71 of 2008;
  • Compensation for Occupational Injuries and Diseases Act No 130 of 1993;
  • Consumer Protection Act No 68 of 2008;
  • Copyright Act No 98 of 1978;
  • Electronic Communications and Transactions Act No 25 of 2002;
  • Employment Equity Act No 55 of 1998;
  • Financial Intelligence Centre Act No 38 of 2001;
  • Income Tax Act No 58 of 1962;
  • Labour Relations Act No 66 of 1995;
  • Medical Schemes Act No 131 of 1998;
  • National Credit Act No 34 of 2005;
  • Occupational Health and Safety Act No 85 of 1993;
  • Pension Funds Act No 24 of 1956;
  • Protection of Personal Information Act No 4 of 2013;
  • Regulation of Interception of Communications and Provision of Communication‑Related Information Act No 70 of 2002;
  • Skills Development Act No 97 of 1998;
  • Skills Development Levies Act No 9 of 1999;
  • Unemployment Insurance Act No 63 of 2001;
  • B-BBEE Act No 53 of 2003; andValue Added Tax Act No 89 of 1991.

4.2.2 Where any information contained in any records retained by CMS South Africa in terms of the above legislation is of a public nature, such records may be available for inspection without a person having to request access thereto in terms of PAIA.

4.3 Records held by CMS South Africa (section 51(1)(e) of PAIA)

The records held by CMS South Africa include but are not necessarily limited to:

4.3.1 Human resources 

  1. Employee information including personal information, employment history and health records that CMS South Africa may hold from time to time;
  2. Disciplinary records;
  3. Employment equity plan;
  4. Records of pension and provident funds;
  5. Training and development information;
  6. General files containing information on employee benefits and employee recruitment and selection information;
  7. List of employees;
  8. Employment contracts;
  9. Tax records;
  10. Training records;
  11. Payroll; and
  12. Applicable internal policies and procedures.

4.3.2 Client related records

  1. FICA records; and
  2. Correspondence.

4.3.3 Property

  1. Lease agreements;
  2. Insurance records; and
  3. Asset register.

4.3.4 Operations

  1. Function records and related costings;
  2. Stock sheets;
  3. List of suppliers; and
  4. Supplier agreements.

4.3.5 Information technology 

  1. Licence agreements;
  2. Records relating to systems;
  3. Domain information;
  4. Usage statistics;
  5. Equipment details; and
  6. Costings of hardware and software.

4.3.6 Company information

  1. CMS South Africa secretarial records; and
  2. Incorporation documents, including Memorandum and Articles of Association.

4.3.7 Finance/Accounts department

  1. Accounting records;
  2. Annual financial statements;
  3. Tax returns;
  4. Creditors and debtors;
  5. Invoices;
  6. Salary information;
  7. Banking records;
  8. Bank account details;
  9. Fixed assets register;
  10. Audit reports; and
  11. Fidelity fund certificates.

4.3.8 Marketing department

  1. CMS South Africa brochures and publications;
  2. Documents relating to public relations events; and
  3. CMS South Africa media releases.


5.1 Any requests for access to records of CMS South Africa are subject to PAIA and, in respect of personal information, POPI.

5.2 In terms of PAIA, a request for access is to be made on the prescribed form accessible at https://www.justice.gov.za/forms/paia/J752_paia_Form%20C.pdf with a copy being set out in Annexure A to this Manual. The request is to be made to the Information Officer addressed to the contact details set out above (section 53(1) of PAIA).

5.3 The requester must provide sufficient detail on the form to enable the Information Officer to identify the record and the requester. The requester should also indicate which form of access is required and specify a postal address, fax number in the Republic or email address. The requester should also indicate if, in addition to a written reply, any other manner is to be used to inform the requester and state the necessary particulars to be so informed (section 53(2)(a) and (b) and (c) and (e) of PAIA). 

5.4 The requester must identify the right that is sought to be exercised or protected and provide an explanation of why the requested record is required for the exercise or protection of that right (section 53(2)(d) of PAIA).

5.5 In circumstances where the request for access is being made on behalf of another person, the requestor is obliged to prove the capacity in which the request is being made, with any submissions in support thereof being subject to the satisfaction of CMS South Africa (section 53(2)(f) of PAIA). Section 71 of PAIA makes provision for a request for information or records about a third party. In considering such a request, CMS South Africa will adhere to the provisions of sections 71 to 74 of PAIA. The requestor is to note the provisions of Chapter 5 of Part 3 of PAIA in terms of which CMS South Africa is obliged, in certain circumstances, to advise third parties of requests lodged in respect of information applicable to or concerning such third parties. In addition, the provisions of Chapter 2 of Part 4 of PAIA entitle third parties to dispute the decisions of CMS South Africa by referring the matter to the High Court.

5.6 The Information Officer will decide on whether or not to grant the request as soon as is reasonably possible (but in any event within thirty days of the request having been submitted) and notify the requester accordingly.

5.7 The Information Officer may decide to extend the period of thirty days for another period of not more than thirty days if:

5.7.1 the request is for a large number of records;

5.7.2 the search for the records is to be conducted at premises not situated in the same town or city as the head office of CMS South Africa;

5.7.3 consultation among divisions or departments; as the case may be, of CMS South Africa is required;

5.7.4 the requester consents to such an extension in writing; or

5.7.5 the parties agree in any other manner to such an extension.

Should CMS South Africa require an extension of time, the requester shall be informed in the manner stipulated in the prescribed form of the reasons for the extension.

5.8 If the Information Officer fails to respond (or extend the period within which the respond) within thirty days after a request has been received, it will, in terms of PAIA, be deemed to have refused the request (section 58 read together with section 56(1) of PAIA).

5.9 Where access is granted:

5.9.1 the Information Officer will advise the requester of:

  1. the access fee to be paid for the information (in accordance with paragraph 6 of this Manual below) prior to CMS South Africa being able to process the request and grant the access (section 54(1) of PAIA);
  2. the format in which access will be given;
  3. the fact that the requester may lodge an appeal with a court of competent jurisdiction against the access fee charged or the format in which access is to be granted (section 56(2) of PAIA); and

5.9.2 access to the record requested will be given as soon as reasonably possible.

5.10 The following access and reproduction fees apply:

5.10.1 the request fee payable by a requester, other than a personal requester (being a requester who seeks access to a record containing personal information about that requester) is R50,00. The requester may lodge an application to the court against the tender or payment of the request fee (section 54(3)(b) of PAIA); and

5.10.2 where the Information Officer is of the opinion that the number of hours required to search, reproduce and/or prepare the information requested will exceed 6 hours, it may require that a deposit be paid, calculated in accordance with PAIA.

5.10.3 Access and Reproduction fees respectively:

For every photocopy of an A4 size page or part thereof


For every printed copy of an A4 size page or part thereof



For a copy of a compact disc



For a transcript of visual images for an A4 size page or part thereof



For a copy of visual images


For a transcript of an audio record, for an A4 size page or part thereof


For a copy of an audio record


5.11 If the request for access is refused, the Information Officer shall advise the requester in writing of the refusal, including adequate reasons for the refusal and that the requester may lodge an appeal with a court of competent jurisdiction against the refusal of the request (section 56(3) of PAIA).

5.12 Upon the refusal by the Information Officer, any deposit paid by the requester will be refunded.

5.13 The requester may lodge an appeal with a court of competent jurisdiction against any process set out in this paragraph 5.


6.1 If a record cannot be found or if the records do not exist, the Information Officer shall notify the requester (providing full details of steps taken to find the record or determine its existence) that it is not possible to give access to the requested record.

6.2 If the record in question should later be found, the requester shall be given access to the record unless access is refused by CMS South Africa.


7.1 CMS South Africa may refuse to grant access on certain grounds, including the following (Part 3, Chapter 4 of the PAIA): 

7.1.1 that the record constitutes privileged information for the purposes of legal proceedings or is subject to professional privilege;

7.1.2 to protect the commercial information or the confidential information of a third party or CMS South Africa;

7.1.3 that it is necessary to protect the safety of individuals or property;

7.1.4 that it is necessary to protect the research information of a third party or CMS South Africa; or

7.1.5 that granting access would result in the unreasonable disclosure of personal information about a third party.


8.1 Introduction

8.1.1 Chapter 3 of POPI provides for the minimum conditions for lawful "processing" of "personal information" by a "responsible party" (as such terms are defined under POPI). These conditions may not be derogated from unless specific exclusions apply as outlined in POPI.

8.1.2 CMS South Africa requires personal information relating to both natural and legal persons in order to carry out its business and organizational functions.

The manner in which this information is processed and the purpose for which it is processed is determined by CMS South Africa. Accordingly, CMS South Africa is a responsible party for the purposes of POPI and will ensure that the personal information of a "data subject" (as defined in POPI), amongst other things as prescribed by POPI:

  1. is processed lawfully, fairly and transparently. This includes the provision of appropriate information to data subjects when their data is collected by CMS South Africa, in the form of privacy or data collection notices. CMS South Africa must also have a legal basis (for example, but not limited to, consent) to process personal information;
  2. is processed only for the purposes for which it was collected;
  3. will not be processed for a secondary purpose unless that processing is compatible with the original purpose;
  4. is adequate, relevant and not excessive for the purposes for which it was collected;
  5. is accurate and kept up to date;
  6. will not be kept for longer than necessary;
  7. is processed in accordance with integrity and confidentiality principles – this includes physical and organizational measures to ensure that personal information, in both physical and electronic form, is subject to an appropriate level of security when stored, used and communicated by CMS South Africa, in order to protect against access and acquisition by unauthorised persons and accidental loss, destruction or damage; and
  8. is processed in accordance with the rights of data subjects, where applicable.

8.2 Data Subject Rights

8.2.1 Data Subjects have the right to:

  1. be notified that their personal information is being collected by CMS South Africa. The data subject also has the right to be notified in the event of a data breach;
  2. know whether CMS South Africa holds personal information about them and to access that information. Any request for information must be handled in accordance with the provisions of this PAIA Manual;
  3. request the correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information;
  4. object to CMS South Africa's use of their personal information and request the deletion of such personal information (deletion would be subject to CMS South Africa’s record keeping requirements);
  5. object to the processing of personal information for purposes of direct marketing by means of unsolicited electronic communications; and 
  6. complain to the Information Regulator regarding an alleged infringement of any of the rights protected under POPI and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its personal information.

8.3 Purpose of the Processing of Personal Information by CMS South Africa

As noted above, personal information held by CMS South Africa can only be processed for a specific purpose. The purpose for which CMS South Africa processes or will process personal information is set out in section of A of Annexure B to this Manual, provided however that this is not an exhaustive list.

8.4 Categories of Data Subjects and Personal Information relating thereto

In terms of section 1 of POPI, a data subject may either be a natural or a juristic person. The various categories of Data Subjects that CMS South Africa processes personal information in respect of and the types of personal information relating thereto includes but is not limited to those detailed in section B of Annexure B to this Manual.

8.5 Sharing of Personal Information

CMS South Africa may share a data subject’s Personal Information in accordance with section C of Annexure B to this Manual.

8.6 Cross-border flows of Personal Information

8.6.1 Section 72 of POPI provides that Personal Information may only be transferred out of the Republic of South Africa if the:

  1. recipient country can offer such data an “adequate level” of protection. This means that its data privacy laws must be substantially similar to the Conditions for Lawful Processing as contained in POPI; or
  2. data subjects' consent to the transfer of their personal information; or
  3. transfer is necessary for the performance of a contractual obligation between the data subject and the responsible party; or
  4. transfer is necessary for the performance of a contractual obligation between the responsible party and a third party, in the interests of the data subject; or
  5. the transfer is for the benefit of the data subject, and it is not reasonably practicable to obtain the consent of the data subject, and if it were, the data subject, would in all likelihood provide such consent.

8.6.2 Planned cross-border transfers of personal information and the justifications therefor includes but is not limited to those detailed in section D of Annexure B to this Manual.

8.7 Description of information security measures to be implemented by CMS South Africa

Section E of Annexure B to this Manual sets out the types of security measures to be implemented by CMS South Africa in order to ensure that personal information is respected and protected. This is not an exhaustive list and is subject to change. A preliminary assessment of the suitability of the information security measures implemented or to be implemented by CMS South Africa may be conducted in order to ensure that the personal information that is processed by CMS South Africa is safeguarded and processed in accordance with the Conditions for Lawful Processing under POPI.

8.8 Objection to the Processing of Personal Information by a Data Subject

Section 11(3) of POPI and regulation 2 of the POPI Regulations provides that a Data Subject may, at any time object to the processing of his/her/its personal information in the prescribed form attached to this manual as Annexure C subject to exceptions contained in POPI.

8.9 Request for correction or deletion of Personal Information 

Section 24 of POPI and regulation 3 of the POPI Regulations provides that a data subject may request for their personal information to be corrected/deleted in the prescribed form attached as Annexure D.


Annexure A
DOCX 19.7 kB
Annexure B
DOCX 16.1 kB
Annexure C
DOCX 16.8 kB
Annexure D
DOCX 32.3 kB