There is a phrase reached for almost automatically in South African boardrooms, whenever a request for a record in terms of the Promotion of Access to Information Act 2 of 2000 (PAIA) lands on the CIO’s desk: “It’s commercially sensitive information”. For those using it, it has a comforting sound of a slamming door, and for years, it has largely functioned as such.
However, a recent enforcement notice from the Information Regulator elicits a hard reconsideration of that automatic response.
In one of her decisions of 22 May 2026, the Regulator ordered Sibanye-Stillwater Ltd (Sibanye) to deliver certain records it had refused to disclose to the Centre for Applied Legal Studies (Cals) and set aside Sibanye’s reliance on the commercial and financial information exemptions in PAIA.
The reasoning of the Regulator is a useful, albeit slightly uncomfortable, illustration of how slender a PAIA refusal becomes when such refusal relies on instinct or reflex, rather than evidence.
The decision is worth consideration for anyone responsible for deciding what their entity will and will not disclose.
The facts
Cals is a research centre and law clinic associated with University of the Witwatersrand.
In August 2023, Cals made a written request to Sibanye, a JSE-listed mining company, for two sets of records relating to its platinum mines, namely its annual compliance reports relating to its social and labour plans (SLPs) for the period 2019 to 2023 under the Mineral and Petroleum Resources Development Act (MPRDA).
Under the MPRDA, the holder of a mining right must submit an SLP to the Department, and once it is approved, the SLP is binding for a five-year period, with the holder’s being obliged to file annual compliance reports during that period.
SLPs are public documents; however, the annual compliance reports, which are not public, were what Cals was requesting for research purposes based on various constitutional rights.
Sibanye refused to grant access to these reports, citing protection of a private body’s commercial and financial information under PAIA.
As a consequence, Cals lodged a complaint with the Regulator in September 2023.
The Regulator’s PAIA division investigated the matter; issued a report, recommending that Sibanye disclose the records; and after Sibanye rejected those findings before the Enforcement Committee, the Regulator issued this enforcement notice, ordering Sibanye to release these records.
Analysis of the decision
The first point that the Regulator made in its decision is that disclosure is the default position; and nondisclosure the exception.
PAIA does not treat access to a record as a begrudging concession made by the holder of the record. Section 9(e) of PAIA details transparency, accountability and effective governance of public and private bodies among PAIA’s objectives, and the courts have interpreted it in line with this principle.
In Smuts N.O. v MEC, Eastern Cape, the court provided three guiding principles, which the Regulator applied in this enforcement notice:
- Access to a record or information is the default and exemption is the exception;
- rounds of refusal must be construed narrowly, because they limit a constitutional right, and where there is doubt, this is to be resolved in favour of disclosure; and
- the burden of proving a ground of refusal resides with the party refusing access to a record, which burden is to be discharged on a balance of probabilities.
There is one wrinkle for private bodies. Smuts concerned a public body to which section 11 of PAIA applies.
For a record held by a private body, the requester must show that the record is required for the exercise or protection of a right.
It has become settled law that the word “required” implies a requester must set out the right relied upon, the information sought, and how that information will assist in the exercise or protection of that right.
Through the citation of numerous supporting judgments, Cals was found to have adequately identified its rights (access to information, academic freedom, the environmental right, and just administrative action).
While Sibanye relied on Carolina Local Economic Development Centre v Ilima Coal Company, where a request for SLPs failed because the applicants had not stated their right with sufficient precision, Cals’ argument drew the distinction Ilima never made: the difference between the obligation to develop an SLP (public, undisputed) and the obligation to implement it and report on compliance (the records in issue in this matter).
The Regulator was satisfied the reports were required, both for Cals’ own research function and to advance the affected communities’ rights.
However, Sibanye did not lose because the information wasn’t commercial. The Regulator accepted that it was, satisfying the first leg of section 68(1)(b) of PAIA. It lost on the second leg, ie. harm, because it had not proved any.
Where's the evidence?
Sibanye needed evidence; not mere regurgitation of the grounds of refusal.
What Sibanye put up in support of its grounds for refusal ran along familiar lines: it is a listed company; the figures could be read out of context; its share price could suffer; and activists had used annual shortfalls selectively in the past.
Whilst plausibly sounding, in the Regulator’s view, this was only speculation. Mere conjecture does not discharge the onus, and quoting the exemption is not the “adequate reasons” section 56(3)(a) requires.
There is something pointed in one of the Regulator’s obiter. Sibanye had argued that Cals would misuse the reports by highlighting bad years without context. The Regulator found it strange that a company of the size of Sibanye would suggest it could not simply respond and correct the record.
“People might say unfair things about this” has never been a recognised ground of refusal, and a business with the context on its side is usually better off supplying it than burying the underlying numbers.
The same reasoning sank the section 68(1)(c)(i) argument: that disclosure would disadvantage Sibanye in negotiations and in its relationship with the Department.
Absent facts, the Regulator treated it as further conjecture and noted that disclosure was in any event more likely to promote the transparency and accountability that could offset any disadvantage. With both grounds lost, severability fell away, and the public-interest override never had to be entertained.
Overreach of power?
Sibanye argued that whether a record falls within a ground of refusal is reserved for a court, and that the Regulator may only play an investigatory role.
The Regulator rejected this argument, pointing to its power to issue a binding enforcement notice, as well as to the offence created by section 77K of PAIA, under which the head of a private body who ignores a notice faces a fine or up to three years’ imprisonment.
The Regulator also declined to run the proceedings as a full adversarial exchange (which would allow the parties to have sight of the other’s submissions and the opportunity to respond).
Under section 77E(b) the record-holder responds to the complaint, and under section 77G(2) read with section 81 of the Protection of Personal Information Act 4 of 2013 (PoPIA), the Regulator may receive whatever evidence it deems appropriate.
Sibanye was not given a right of reply to every Cals submission, and the Regulator held this caused no prejudice to Sibanye, because it had been heard comprehensively before the Enforcement Committee.
Authorised party
In a last-ditch effort, Sibanye challenged whether the Cals researcher who made the initial request and laid the complaint was authorised to make the request in the first place, claiming that without a power of attorney, the complaint form was allegedly defective ab initio.
The Regulator gave this argument short shrift.
Section 18(2)(f) lets an information officer require proof of the capacity in which a requester acts, but Sibanye never invoked it (at the time of refusing access), choosing instead to engage on the merits under section 68. Having done so, it was deemed to be satisfied with the requester’s authority, and the procedural requirements were met.
Two smaller points complete the picture: section 3(b) means PAIA reaches a record whenever it came into existence, so age is no shield; and the Regulator scrutinised Sibanye’s PAIA manual, where the way records were categorised (ie. annual reports, regulatory reports, automatically available) nearly destroyed the grounds of refusal on its own.
Recommendations for information officers
None of this means genuinely commercially sensitive records can never be protected. The exemptions in Chapter 4 of Part 3 of PAIA are real and they work, when supported by adequate evidence.
What this enforcement notice signals is a higher standard of discipline. For information officers, a few practical points follow:
- Identify the specific information, the specific harm, and why that harm is likely to happen. Treat every refusal as something you may one day have to defend on affidavit. Citing the exemption alone is fatal.
- Fears that a record will be taken out of context, dent the share price, or be used by an activist are not recognised grounds of refusal. If you have the context, the better course is usually to disclose and explain.
- If you doubt a requester’s authority, invoke section 18(2)(f) and ask for proof at the request stage, in writing. If you engage on the merits, you are taken to have accepted the requester’s authority.
- Section 59 obliges you to release what can be separated from genuinely exempt material, which can be redacted. A blanket refusal that ignores severability is hard to defend.
- The categories you assign records can bind you. Records flagged as “automatically available” are difficult to withhold later. Review your PAIA manual rather than leaving it to gather dust.
- Put your evidence up at the outset. There is no guaranteed right of reply to every submission, and the Regulator can act on a limited record if you leave one.
- Under section 82, you must notify the Regulator within 10 working days of any intention to take their decision on review, with the application itself brought within 180 days. Missing the notification deadline is preventable self-sabotage.
Before reaching for the comfortable phrase “it’s confidential”, ask whether you could actually finish the sentence: “... and this would cause us harm, specifically, because...”. If you can’t, the door you think you’re shutting is actually left wide open.
