PAIA Manual | Cosslett & Associates Inc.

Date of Compilation: 1 January 2026 | Date of Revision: 27 May 2026

1. List of Acronyms and Abbreviations

Acronym	Meaning
CA(SA)	Chartered Accountant (South Africa)
CIPC	Companies and Intellectual Property Commission
DIO	Deputy Information Officer
FICA	Financial Intelligence Centre Act 38 of 2001
IO	Information Officer
PAIA	Promotion of Access to Information Act 2 of 2000
POPIA	Protection of Personal Information Act 4 of 2013
Regulator	Information Regulator of South Africa
SARS	South African Revenue Service
SAICA	South African Institute of Chartered Accountants

2. Purpose of This PAIA Manual

This PAIA Manual is prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended) and addresses the requirements of the Protection of Personal Information Act 4 of 2013 ("POPIA").

This Manual is useful for the public to:

Check the categories of records held by Cosslett & Associates Inc. which are available without having to submit a formal PAIA request
Have a sufficient understanding of how to make a request for access to a record of Cosslett & Associates Inc.
Know the description of the records available in accordance with any other legislation
Access all relevant contact details of the Information Officer and Deputy Information Officer
Know the description of the guide on how to use PAIA, as updated by the Regulator
Know whether Cosslett & Associates Inc. processes personal information, and if so, the purpose of processing, the categories of data subjects, and the categories of information relating thereto
Know the recipients or categories of recipients to whom personal information may be supplied
Know whether Cosslett & Associates Inc. has planned to transfer or process personal information outside the Republic of South Africa
Know whether Cosslett & Associates Inc. has appropriate security measures to ensure the confidentiality, integrity, and availability of personal information

3. About Cosslett & Associates Inc.

Full Name: Cosslett & Associates Inc.

Registration Number: 2024/337603/21

Type of Entity: Private Company / Sole Proprietorship

Principal Place of Business: Remote — South Africa Nationwide

Website: cainc.africa

Email: info@cainc.africa

Telephone: +27 69 042 4733

4. Key Contact Details for Access to Information

4.1 Information Officer

In terms of section 1 of PAIA and section 55 of POPIA, the Information Officer is:

Detail	Information
Name	Managing Director, Cosslett & Associates Inc.
Email	info@cainc.africa
Telephone	+27 69 042 4733

4.2 Deputy Information Officer

Currently, no Deputy Information Officer has been designated. Should the need arise, a Deputy Information Officer will be appointed in terms of section 17(1) of PAIA and section 56 of POPIA.

4.3 General Contact for Access to Information

Email: info@cainc.africa

Telephone: +27 69 042 4733

5. Guide on How to Use PAIA

The Information Regulator has published a Guide on how to use PAIA, which is available in all official South African languages. The Guide contains:

The objects of PAIA and POPIA
The contact details of Information Officers and Deputy Information Officers
The manner and form of a request for access to records
The assistance available from Information Officers and the Regulator
All remedies available in law regarding acts or failures to act in respect of rights or duties conferred by PAIA and POPIA

The Guide may be obtained from:

Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

6. Categories of Records Available Without a Formal Request

The following categories of records are available without the need to submit a formal PAIA access request:

Category	Type of Record	Available on Website	Available Upon Request
Company Information	Company profile, services overview, team information	Yes	Yes
Legal Documents	PAIA Manual, Privacy Notice, Disclaimer, Terms of Use	Yes	Yes
Professional Credentials	SAICA membership, SARS Tax Practitioner registration, Xero certifications	Yes	Yes
Service Information	Service descriptions, pricing information, process guides	Yes	Yes
Legislation	Relevant tax and company legislation (links to official sources)	Yes	No

7. Description of Subjects and Categories of Records Held

Cosslett & Associates Inc. holds records relating to the following subjects and categories:

Subject	Categories of Records
Client Records	Engagement letters, service agreements, correspondence, financial statements, tax returns, payroll records, bookkeeping records, advisory reports
Financial Records	Accounting records, bank statements, invoices, receipts, payment records, general ledgers
Tax Records	SARS correspondence, tax returns (ITR14, ITR12, VAT201, EMP201), provisional tax calculations, SARS dispute documentation
Human Resources	Employment contracts, CVs, qualifications, performance records, payroll records (for employees)
Administrative Records	Company policies, minutes of meetings, internal correspondence, IT and security records
Compliance Records	FICA documentation, POPIA compliance records, professional indemnity insurance, SAICA membership records
Third-Party Records	Service provider agreements, vendor information, subcontractor records

8. Records Available in Accordance with Other Legislation

The following records are created and maintained in accordance with applicable South African legislation:

Category of Records	Applicable Legislation
Company registration and annual returns	Companies Act 71 of 2008
Tax returns and SARS correspondence	Tax Administration Act 28 of 2011; Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991
Payroll and employee records	Basic Conditions of Employment Act 75 of 1997; Employment Equity Act 55 of 1998
FICA compliance records	Financial Intelligence Centre Act 38 of 2001
Personal information processing records	Protection of Personal Information Act 4 of 2013
Accounting records	Companies Act 71 of 2008; International Financial Reporting Standards (IFRS)

9. Processing of Personal Information (POPIA)

9.1 Purpose of Processing Personal Information

Cosslett & Associates Inc. processes personal information for the following purposes:

Provision of accounting, tax, payroll, bookkeeping, and business advisory services
Tax compliance and submission of returns to SARS
Company secretarial and CIPC compliance
Client communication and relationship management
Internal administration and quality assurance
Legal and regulatory compliance
Fraud prevention and detection

9.2 Categories of Data Subjects and Personal Information

Categories of Data Subjects	Personal Information Processed
Clients (individuals)	Name, identity number, contact details, banking details, income and employment information, tax reference number
Clients (companies/trusts)	Company name, registration number, VAT number, director details, financial information, banking details
Employees	Name, identity number, contact details, qualifications, employment history, remuneration, banking details, tax reference number
Service Providers	Name, company name, registration number, contact details, banking details, VAT number
Prospective Clients	Name, contact details, enquiry information

9.3 Recipients of Personal Information

Category of Personal Information	Recipients or Categories of Recipients
Tax-related information	South African Revenue Service (SARS)
Company registration and compliance information	Companies and Intellectual Property Commission (CIPC)
Employee tax and UIF information	SARS; Department of Labour
Financial information for auditing/verification	External auditors; professional indemnity insurers
Cloud-stored data	Cloud service providers (Xero, QuickBooks, Google Workspace, Microsoft 365)
IT and security services	IT support and cybersecurity service providers

9.4 Planned Transborder Flows of Personal Information

Cosslett & Associates Inc. may transfer personal information outside the Republic of South Africa in the following circumstances:

Category of Personal Information	Country of Transfer	Basis for Transfer
Client accounting data (via cloud platforms)	United States, European Union, United Kingdom, Australia	Cloud accounting platform hosting (Xero, QuickBooks Online); contractual safeguards and adequacy determinations
Email and communication data	United States, European Union	Cloud email services (Google Workspace, Microsoft 365); adequacy determinations and standard contractual clauses
Backup and disaster recovery data	United States, European Union	Cloud backup services; contractual safeguards

All transborder transfers are conducted in compliance with section 72 of POPIA.

9.5 Information Security Measures

Cosslett & Associates Inc. implements the following technical and organisational security measures to ensure the confidentiality, integrity, and availability of personal information:

Encryption: AES-256 encryption for data at rest; TLS 1.3 for data in transit
Access Controls: Multi-factor authentication (MFA); role-based access control (RBAC); principle of least privilege
Network Security: Firewalls; intrusion detection and prevention systems; secure VPN access
Endpoint Security: Anti-virus and anti-malware solutions; endpoint detection and response (EDR)
Physical Security: Secure access to premises and devices; device encryption
Administrative Controls: Information security policies; staff training on data protection and POPIA; confidentiality agreements
Monitoring and Auditing: Regular security audits; access logs; vulnerability assessments
Incident Response: Breach notification procedures; incident response plan

10. How to Request Access to a Record

10.1 Form of Request

A request for access to a record must be made on the prescribed Form C, available from the Information Regulator's website at www.inforegulator.org.za.

10.2 Requirements for a Valid Request

The request must:

Be made in writing (including email)
Provide sufficient detail to enable the Information Officer to identify the record
Specify the form of access required (e.g., copy, inspection)
Provide the requester's full name, physical address, and contact details
Indicate the right that is sought to be exercised or protected and explain why the requested record is required for the exercise or protection of that right (in the case of a private body)
Be accompanied by proof of payment of the prescribed fee, if applicable

10.3 Submission of Request

Requests should be submitted to:

Email: info@cainc.africa

Attention: Information Officer

10.4 Prescribed Fees

The following fees apply in terms of the regulations made under PAIA:

Item	Fee
Request fee (payable on submission of request)	As prescribed by the Minister from time to time
Access fee (payable before access is granted)	As prescribed by the Minister from time to time
Photocopy per A4 page	As prescribed by the Minister from time to time
Search and preparation time	As prescribed by the Minister from time to time

Current fee schedules are available on the Information Regulator's website.

11. Grounds for Refusal of Access

Access to a record may be refused in terms of PAIA on the following grounds:

Privacy: Disclosure would constitute an unreasonable invasion of privacy of a third party
Commercial Information: Disclosure would likely harm the commercial or financial interests of Cosslett & Associates Inc. or a third party
Confidential Information: Disclosure would breach a duty of confidence owed to a third party
Safety: Disclosure could reasonably be expected to endanger the life or physical safety of an individual
Legal Privilege: The record is subject to legal professional privilege
Research: Disclosure would prejudice research
Third-Party Information: The record contains personal information of a third party who has not consented to disclosure
Law Enforcement: Disclosure would prejudice the detection, prevention, or investigation of an offence
Defence, Security, and International Relations: Disclosure would prejudice the defence, security, or international relations of the Republic

12. Remedies Available

If a request for access to a record is refused, or if you are dissatisfied with the manner in which your request was handled, the following remedies are available:

Internal Appeal: You may lodge an internal appeal with the Information Officer or head of Cosslett & Associates Inc.
Complaint to the Information Regulator: You may lodge a complaint with the Information Regulator in the prescribed form. The complaint must be lodged after exhausting the internal appeal procedure.
Court Application: You may approach a court with appropriate jurisdiction for relief, including an order compelling disclosure.

Information Regulator Contact:

Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

13. Availability and Updating of This Manual

A copy of this PAIA Manual is available:

On our website at cainc.africa/paia-manual.php
Upon request, free of charge, by contacting the Information Officer
To the Information Regulator upon request

The Information Officer will review and update this Manual on a regular basis, or whenever there are material changes to the information contained herein.

14. Services Available to the Public

Cosslett & Associates Inc. provides the following professional services to the public:

Accounting and financial reporting
Tax compliance and advisory (VAT, PAYE, income tax, provisional tax)
Bookkeeping (local and international clients)
Payroll support and processing
Business advisory and consulting
Cloud systems setup and optimisation (Xero, QuickBooks, Sage)

These services can be accessed by contacting us via email, telephone, or the contact form on our website.

15. Issued By

Information Officer
Cosslett & Associates Inc.