Access to Information

• The Promotion of Access to Information Act, 2 of 2000 (PAIA) requires Standard Bank to compile and publish a manual that contains information on the records it holds.
• PAIA gives effect to everyone’s constitutional right to access information held by private bodies which is required for the exercise of the requester’s rights.
• Standard Bank, (we, us, the Bank) has implemented the Access to Information Manual (Manual) which is compiled to comply with both PAIA and the Protection of Personal Information Act 4 of 2013 (POPIA). The Manual provides an outline of the types of records held by the Bank as well as the procedure to access these records.
• Publication of the Manual does not give rise to any rights to access information except in terms of PAIA.

• This Manual is applicable to Standard Bank of South Africa Limited and all its subsidiaries including special purpose vehicle companies as well as Standard Bank Group (SBG) subsidiaries incorporated in South Africa.
• This Manual is applicable to Standard Bank of South Africa Limited and all its subsidiaries (as listed under the “Applicability” tab) including special purpose vehicle companies as well as Standard Bank Group (SBG) subsidiaries incorporated in South Africa.
• SBG’s simplified legal structured entities highlights the major subsidiaries and businesses and access to the PAIA manual can be accessed or viewed on the PAIA | Standard Bank.
• You can request access to information if you have complied with all procedural requirements in PAIA relating to the request for access to that record, such as completing the prescribed request form (Form 2) and/ or complete form electronically.

The data subject and/or authorised person may exercise their rights in respect of these legal entities by submitting a PAIA request.

We value your trust and want you to be familiar with your rights under the legislation and to know how you can exercise them in your interactions with the Standard Bank South Africa.

You have the right to:

• Access the personal information we hold about you and update your information
• Object to processing your personal information, where applicable
• Request that we correct, destruct or delete your personal information, where appropriate  
• Be notified that your personal information is being collected by us or has been accessed or acquired by an unauthorised person.  
• To restrict processing of personal information, where appropriate  
• Object to the processing of personal for the purposes of direct marketing
• Not be subject to automated decision making in respect of products/or services, except under certain circumstances
• Lodge a complaint
• Institute civil proceedings

This Manual is useful for the public to:

• check the categories of records held by the Bank which are available without a person having to submit a formal PAIA request,
• have a sufficient understanding of how to request access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject,
• know the description of the records of the body which are available in accordance with any other legislation,
• access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access,
• know the description of the guide on how to use PAIA, as updated by the Information Regulator, South Africa (Regulator) and how to obtain access to it,
• know if the body will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto,
• know the description of the categories of data subjects and of the information or categories of information relating thereto,
• know the recipients or categories of recipients to whom the personal information may be supplied,
• know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied, and
• know whether the body has appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

A copy of the Manual is also available :

• on the Standard Bank website.
• At the below offices for public inspection during normal business hours:

 5 Simmonds Street, Marshalltown
30 Baker Street, Rosebank 

• to any person upon request and upon the payment of a reasonable prescribed fee; and
•  to the Information Officer upon request.

A fee for a copy of the Manual shall be payable.

The Bank’s data subjects are categorised as employees, customers and third parties and these include former, current and potential employees, customers and third parties as defined in the various authoritative instruments. Tabulated below is the personal information we may process. The list is not exhaustive.

Information will be shared for various reasons, some of which are stipulated in our Privacy Statement as well as to persons duly appointed by yourself or another person, such as a court with jurisdiction. This will be done where legally permitted and when required. Personal information may be shared as follows:

• Internally within Standard Bank,
• With board members and committees established by the board,
• With external organisations such as credit bureaus as well as relevant authorities,
• regulatory or industry bodies to meet due diligence and regulatory requirements, or
• With third parties or counterparties in accordance with appropriate agreements entered with those parties.

Standard Bank holds the below records:

We make some records available without following the PAIA process. The below list is not exhaustive:

The following records are currently available on BizPortal

Certain records relating to the administration of all companies are available from BizPortal, via BizProfile, a search tool for all companies registered on the Companies and Intellectual Property Commission (CIPC). The below information for Standard Bank can be accessed from BizPortal:

• Company registration
• Directors’ names
• Tax registration
• B-BEE certificates
• Compensation Fund (CF) registration
• Unemployment Insurance Fund (UIF) Registration
• Records relating to appointment of directors, auditor, secretary, public officer, or other officers

In compliance with other legislation, Standard Bank allows access to records as prescribed in the applicable legislation and different to the PAIA process. The below listed are some of the laws and is not exhaustive

• Financial Advisory and Intermediary Services Act 37 of 2002
• Securities Services Act 36 of 2004
• Companies Act 71 of 2008
• Banks Act 94 of 1990
• Collective Investment Schemes Control Act 45 of 2002
• Home Loan and Mortgage Disclosure Act 63 of 2002
• Basic Conditions of Employment Act 75 of 1997
• Cybercrimes Act 19 of 2020  
• Regulation of Interception of Communications and Provision of Communication related Information Act 70 of 2002
• Basic Conditions of Employment Act 75 of 1997
• Employment Equity Act 55 of 1998
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Promotion of Administrative Justice Act 3 OF 2000
• Employment Equity Act 55 of 1998
• Insurance Act 18 of 2017
• Long-Term Insurance Act 52 of 1998
• Short-Term Insurance Act 53 of 1998
• Financial Sector Regulations Act 09 of 2017
• Banks Act 94 of 1990
• Basic Conditions of Employment Act 75 of 1997
• Basic Conditions of Employment Act 75 of 1997
• Collective Investment Schemes Control Act 45 of 2002
• Companies Act 71 of 2008
• Cybercrimes Act 19 of 2020
• Employment Equity Act 55 of 1998
• Employment Equity Act 55 of 1998
• Financial Sector Regulations Act 09 of 2017
• Financial Intelligence Centre Act 38 of 2001
• Home Loan and Mortgage Disclosure Act 63 of 2002
• Insurance Act 18 of 2017  
• Labour Relations Act 66 of 1995
• Long-Term Insurance Act 52 of 1998  
• Occupational Health and Safety Act 85 of 1993
• Promotion of Administrative Justice Act 3 of 2000
• Regulation of Interception of Communications and Provision of Communication related Information Act 70 of 2002  
• Securities Services Act 36 of 2004
• Short-Term Insurance Act 53 of 1998

• Due to the integrated nature of the Standard Bank Group’s business and to provide you with efficient access to our products and services, we may process your personal information in South Africa or in countries where we have a presence and where our products or services are provided or where our thirdparty service providers operate.
• We will only process and transfer personal information to countries that we are satisfied will provide adequate data protection, and we ensure our third-party service providers comply with the minimum data protection standards of the Standard Bank Group.

• The Bank has implemented information security measures to ensure the protection of all information in its possession in line with its Privacy Statement.
• The security of your personal information is important to us, and we take reasonable steps to keep your personal information safe and to prevent loss, destruction of and damage or unlawful access to your personal information by unauthorised parties. We require the same level of security to be implemented by our service providers and other third-parties.
• However, please do not share or send us any personal information through unauthorised channels, as these are not secured and carry the risk of interception and unauthorised access.

• Requesters have the right to receive a response in the form of an affidavit or affirmation where records cannot reasonably be located.
• Requesters have the right to receive a response in the form of an affidavit or affirmation where records do not exist.
• The affidavit or affirmation must outline the steps taken to locate the records.

• SBSA maintains an Information Asset Register that governs the retention and restriction of personal information records. Access to personal information is strictly limited to employees whose roles necessitate such access, based on a “need to know” and “need to have” basis.
• Personal information is securely destroyed, deleted, or de-identified as soon as it is no longer lawfully required. SBSA employs various secure methods for deletion, including the use of accredited third-party service providers. For example, the third-party service provider appointed to carry out a destruction of information will furnish SBSA with a destruction certificate or an attestation.
• Customers must note that the processing of personal information will be restricted under the following circumstances:
  • Where the accuracy of the personal information is contested;
  • Where the original purpose for collection has expired but retention is required for evidentiary purposes;
  • Where processing is unlawful and the customer objects to destruction, requesting restriction instead;
  • Where the customer requests transmission of the personal information to another automated processing system.
• Restricted personal information may only be processed with the consent of the customer or a competent person in respect of a child, or where such processing is necessary to protect the rights of another individual or is in the public interest.
• Where restrictions are lifted, SBSA will notify the affected customer accordingly on processing of their personal information. This is in accordance with section 14(8) of POPIA.

• SBSA reserves the right to lawfully dispose certain records in terms of applicable law, where retention is no longer necessary for achieving the purpose for which the information was collected or subsequently processed.
• Requesters will be advised whether a particular record has been disposed, where this is relevant to the records requested.

• Please submit the completed PAIA request form (together with the relevant request fee which we explain below) to our information officer’s email address or our physical address, using the details we provide.
• We will evaluate and consider all requests we receive in a proper manner, timeously

THE PROCESS

To request access to a record, please complete the prescribed Request for Access Form (Form 2). Alternatively, complete the form electronically on our digital plaform. Please ensure that the completed form:

• has enough information for the Information Officer to identify you, the requested records, and how you want to receive it,
• specifies your address, (email or postal address),
• describes the right that you seek to exercise or protect,
• explains why you need the requested record to exercise or protect that right,
• provides any other manner you would like to be informed of our decision in addition to written form, and
• provides, to the satisfaction of Standard Bank or as required by law, proof of the capacity in which you are making the request if you are making it on behalf of someone else.

Bear in mind, we may not be able to proceed with your request:

• if you do not use the correct form/ submit your request digitally,
• if you do not comply with the process set out in this manual,
• if you do not provide sufficient information on the form/ digitally, or,
• if you delay in providing any additional information, we require from you,
• Do not pay the prescribed request fee payable by every requester within 10 days from the date you submitted your request.

THE COST

Request fees

• The request fee of R140.00 is payable by every requester.
• The account details are available upon request.
• Please attach proof of payment to the request form

Access fees

Should access to the records be granted, an access fee may be payable for:

• the time it takes us to handle your request, or if the time has exceeded the prescribed hours to search and prepare the record for disclosure
• the costs of making the record, or transcription of the content of a record, and a postal fee (if applicable)

The fee structure applicable to PAIA requests is provided in Information Regulator site, link which is attached herein below:

https://inforegulator.org.za/paia-fees-structure-2/

Data Subjects have the right to make a request to SBSA to: 

• Verify, update, or amend their personal information by calling the Standard Bank Contact Centre on 0860 123 000 (Personal Clients) and 0860 109 075 (Business Clients) or visiting Standard Bank branch.  
• The request for correction or deletion must be submitted by completing FORM 2 or via our digital plaform in terms of section 24 POPIA.
• Upon receipt of a request for correction, deletion or destruction, SBSA will assess the validity of Data Subject’s request and as soon as reasonably practical notify the Data Subject of its decision, which may include a decision to:
  • Correction the Personal Information and
  • Destroy or delete the personal information
• Where the request does not accord with the dictates of POPIA, SBSA may refuse the request for correction, deletion or destruction of personal information and such decision will be communicated to the data subject.

• The Data Subject has the right to object to SBSA processing his/her/its personal information. The right to object is subject to exceptions contained in POPIA such as:
  • where processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party; or
  • where processing complies with an obligation imposed by law on SARS. 1.2
• The objection must be submitted on Form 4, alternatively, or completing the form digitally on our digital plaform (objection to the processing of personal information in terms of section 11(3) POPIA read together with POPIA Regulation 2(1)).
• You may submit your objection to [email protected]
• The objection can be raised against the processing of personal information in the following circumstances:
  • Where SBSA is processing your personal information for direct marketing purposes;
  • the processing of personal information is based on protection of legitimate interest of the data subject;
  • the ground for the processing of personal information is for pursuing SARS legitimate interest or interest of a third party to whom the information is supplied.
• Reasons, in sufficient detail, for the objection based on the data subject's particular circumstances must be provided to allow SBSA to assess the validity of such objection.
• SBSA may, depending on applicable provisions of POPIA refuse the objection to it processing your personal information
• Upon receipt of the objection, SBSA will assess the validity of the Data Subject’s objection and, if satisfied, will within a reasonable time cease processing the Data Subject’s personal information and will render proof to the Data Subject to this effect.
• Where an objection does not accord with the dictates of POPIA, SBSA may refuse the objection.

We may refuse you access to certain information in terms of PAIA to protect:

• someone else’s privacy,
• another organisation’s commercial information,
• someone else’s confidential information,
• research information,
• the safety of individuals and property, or
• records privileged from production in legal proceedings.

Some of these grounds are explained in further detail below.

We will notify you in writing if your request has been approved or denied, within 30 calendar days, after assessing your request. If we cannot find the record you asked for or it does not exist, we will notify you by way of affidavit that it is not possible to give you access to tha trecord and the reasons for such refusal.

The Information Regulator South Africa (Regulator) has made available the Guide on how to use the Promotion of Access to Information Act 2 of 2000 Guide) on their website. This Guide will moreover assist a data subject to access their personal information in terms of section 23 of POPIA.

The Guide is available in each of the official languages on request, using Request or PAIA Guide Form which can be

• emailed to [email protected]
• submitted to any of the Standard Bank offices listed in paragraph 4

A copy of the Guide is also available in all the official languages, from:

• from the website of the Regulator (https://inforegulator.org.za) or
•  from the Standard Bank website

The Guide contains the description of the objects of PAIA and POPIA.

The postal and street address, phone, and fax number and, if available, electronicmail address of:

• the Information Officer of every private body, and
• every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA.

the manner and form of a request for access to a record
the assistance available from the Information Officer
the assistance available from the Regulator

All remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging:

• an internal appeal
• a complaint to the Regulator and
• an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body

the provisions of section 51 requiring the compilation of a manual, and how to obtain access to a manual
the provisions of section 52 providing for the voluntary disclosure of categories of records
the notices regarding fees to be paid in relation to requests for access
the regulations made in terms of section 92
Members of the public can inspect or make copies of the Guide from the offices
listed in paragraph 4, including the office of the Regulator, during normal working hours.

The Regulator can be contacted as per below

• If the requester or third party is aggrieved by the decision of the Information Officer, he or she may lodge an appeal against the decision taken.
• The process begins by formally notifying the Information Officer of an intent to appeal, often requiring the completion of the prescribed form or letter detailing the decision in question.
• Lodge an internal appeal by completing the manual Form 4 and submit.
• Email to [email protected] within 60 working days of decision.

Strict Appeal Timeframe:

• Appeals must be submitted within a set timeframe, after which the right to appeal may lapse.

Clearly Defined Grounds For Appeal:

• The appeal must state the specific basis for the appeal, such as errors of law or fact, rather than just dissatisfaction. 1.7 Together with the relevant supporting documents, such as documents relating to PAIA being appealed.

Examination Of The Records:

• An appeal typically focuses on the evidence and arguments presented in the initial case rather than introducing new witnesses or evidence.
• The Information Officer will allocate the appeal to the appropriate internal authority for review and an outcome or decision will be applied, which will be communicated within 30 working days of receipt of the appeal.

Independent Decision-Making Panel:

• The case is heard or reviewed by our designated internal authority and Information Officer separate to ensure fairness and impartial evaluation of the complaint.
• Alternatively, the requester may lodge a complaint with the Information Regulator at [email protected], via www.inforegulator.org.za, or approach a court of competent jurisdiction.  
• The Regulator can be contacted as per below

Internal Complaints Remedies available