Section 68 of the Promotion of Access to Information Act 2 of 2000 (PAIA) allows private bodies to refuse access to information where disclosure is, amongst other things, likely to cause commercial or financial harm. The Information Regulator's 2026 enforcement notice against Sibanye-Stillwater Limited serves as a timely reminder that this exemption cannot be invoked through broad claims of commercial sensitivity. In setting aside Sibanye's refusal to disclose Social and Labour Plans (SLP) compliance reports, the Regulator confirmed that a private body must present specific, verifiable evidence of probable harm. 

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information and promotes transparency, accountability, and openness. Access is the default position; secrecy is the exception. As a result, exemptions must be interpreted narrowly, and the party resisting access bears the burden of justifying non-disclosure. This is especially significant where records held by private bodies are sought to exercise or protect rights, as refusal may hinder communities, civil society organisations, and affected individuals from monitoring compliance and enforcing statutory obligations.

In practice, however, section 68 is sometimes relied upon as a convenient shield. Labels such as "commercially sensitive" are treated as though they are sufficient on their own. PAIA, however, requires more. Decisionmakers must determine whether disclosure would probably cause the specific harm contemplated by the Act. A mere assertion of confidentiality is insufficient. The private body must establish a clear connection between the information sought and a likely risk of commercial or financial harm.

The Information Regulator's enforcement notice against Sibanye-Stillwater, dated 22 May 2026, reinforces this principle. The Regulator directed the company to disclose SLP compliance reports and rejected its generalised claims of commercial harm. The decision does not create a new legal standard; rather, it confirms that commercial confidentiality must be supported by evidence demonstrating probable commercial or financial prejudice. Its significance lies in applying established PAIA principles to records relating to mining companies' social and community obligations.

PAIA treats private bodies differently from public bodies in one important respect. Under section 50(1)(a), a requester must show that the record of a private body is required for the exercise or protection of a right. Although Cape Metropolitan Council v Metro Inspection Services Western Cape CC and Others (10/99) [2001] ZASCA 56 was heard before PAIA came into operation and concerned the constitutional right of access to information under section 32 of the Constitution, the Supreme Court of Appeal articulated the principle that a requester must identify the right in question, specify the information sought, and explain how access will assist in exercising or protecting that right. In the context of section 50(1)(a) of PAIA, the requester must accordingly establish that the record is required for the exercise or protection of an identified right. Once this threshold is satisfied, section 81(3) places the burden on the private body to justify refusal under a recognised exemption. The enquiry therefore involves determining whether access is required to exercise or protect a right, and whether any refusal ground has been properly established.

Section 68 permits refusal where disclosure would be likely to harm the commercial or financial interests of the private body, place it at a disadvantage in negotiations, or prejudice it in commercial competition. The question is not whether the information is commercial in nature, but whether disclosure would cause the specific harm contemplated by the section

The dispute arose after the Centre for Applied Legal Studies requested annual SLP compliance reports relating to Sibanye's Eastern and Western Platinum Mines. The compliance reports contain details of the progress of SLP projects measured on a yearly basis. Sibanye refused access, relying primarily on section 68 and contending that disclosure could damage its reputation, affect perceptions of compliance, and negatively impact share price. Its argument therefore rested not on trade secrets or proprietary information, but on the potential consequences of public scrutiny.

The Regulator was not persuaded. Sibanye failed to demonstrate how disclosure would cause the alleged harm. The Regulator found concerns that the reports might be misunderstood, taken out of context, or create a misleading impression to be speculative. The decision highlights an important distinction: PAIA protects against genuine commercial harm, not the discomfort that may accompany scrutiny, criticism, or accountability. If reputational concerns alone were sufficient, many records relating to statutory compliance could be withheld merely because they might attract adverse comment, a result inconsistent with PAIA's purpose.

The notice also emphasises that not all information a company holds carries the same claim to confidentiality. Records documenting compliance with statutory obligations, particularly those intended to benefit affected communities, serve an important accountability function and engage a significant public interest. By contrast, trade secrets, proprietary technical information, commercially valuable methodologies, and genuinely confidential business arrangements may still qualify for protection where the requirements of section 68 are satisfied.

The same principle applies to severability. Even where parts of a record are legitimately exempt, information officers must consider whether the protected material can be redacted and the remainder disclosed. A private body cannot refuse access to an entire record simply because portions may be sensitive. It must grant access to the greatest extent reasonably possible and explain why partial disclosure would not sufficiently protect the relevant interest.

A party seeking to rely on section 68 should therefore identify the specific information at issue, explain the commercial context, and demonstrate how the alleged harm would probably arise from disclosure. In President of the Republic of South Africa and Others v M & G Media Ltd (CCT 03/11) [2011] ZACC 32, the Constitutional Court recognised that a respondent need not produce the best possible evidence, but must provide sufficient evidence to show, on a balance of probabilities, that the exemption applies. General references to misunderstanding, reputational damage, or market discomfort will seldom meet that standard. Information officers should therefore record the factual basis for any refusal at the time the decision is made, as any subsequent review will focus on whether the statutory requirements were properly satisfied.

The Sibanye-Stillwater decision ultimately reaffirms a fundamental PAIA principle: exemptions must be proven, not presumed. The enforcement notice does not weaken protections for genuine commercial confidentiality. Rather, it confirms the evidentiary burden required to invoke section 68 successfully. For private bodies, the lesson is straightforward: commercial sensitivity is not a talismanic phrase capable of defeating disclosure. It is an evidentiary claim that succeeds only when supported by specific, verifiable facts demonstrating real and probable harm.


Disclaimer: This article is the personal opinion/view of the author(s) and does not necessarily present the views of the firm. The content is provided for information only and should not be seen as an exact or complete exposition of the law. Accordingly, no reliance should be placed on the content for any reason whatsoever, and no action should be taken on the basis thereof unless its application and accuracy have been confirmed by a legal advisor. The firm and author(s) cannot be held liable for any prejudice or damage resulting from action taken based on this content without further written confirmation by the author(s).