BOUDOIR BY BRENT PHOTOGRAPHY · SOUTH AFRICA · REVISED 16 OCTOBER 2026
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended, and relevant requirements of the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Business particulars and Information Officer
| Particular | Detail |
|---|---|
| Trading name | Boudoir by Brent Photography |
| Legal form | Sole proprietor / natural-person private body |
| Head and Information Officer | Brent Abrahamse |
| Principal business address | 500 Appelblaar, Hoedspruit Wildlife Estate, Hoedspruit, Limpopo, South Africa |
| Contact email | brent@boudoirbybrent.co.za |
| Telephone | +27 83 655 6972 |
| Website | boudoirbybrent.co.za |
| Deputy Information Officer | None designated |
2. Purpose and availability of this manual
This manual assists people wishing to obtain records from Boudoir by Brent Photography under PAIA and explains the main categories of records and personal-information processing undertaken by the studio. A category appearing here does not mean every record is automatically accessible: disclosure is subject to PAIA, POPIA and applicable protection of third-party privacy and other rights.
A copy of this manual is made available without charge on the business website, at the principal place of business for inspection during normal business hours, and to the Information Regulator and requesters where required by law. An electronic copy may also be requested from the Information Officer. Printed copies may attract only prescribed or lawful reproduction charges.
3. The Information Regulator’s PAIA Guide
The Information Regulator publishes a Guide explaining how PAIA and POPIA work, request forms, applicable fees, complaints and legal remedies. The Guide is available on the Regulator’s website and in at least two South African official languages for inspection at the studio’s principal business address. Copies and assistance may be requested from the Information Officer.
Official PAIA Guide, prescribed forms and resources
4. How to request access to a record
- Complete the prescribed PAIA Form 02 (Request for Access to Record), or supply the information lawfully required by the form, and send it to brent@boudoirbybrent.co.za.
- Identify the record, explain the right to be exercised or protected and why the record is required for that purpose, and specify the preferred access method or format.
- Provide adequate proof of identity and, if acting for someone else, authority to act. We aim to avoid collecting unnecessary copies of identity documents.
- The Information Officer will consider statutory grounds for refusal and third-party confidentiality, and provide the decision and any applicable fee information using prescribed Form 03 or another compliant notice.
- A decision is generally due within the statutory period of 30 days, subject to lawful extensions, fees and other applicable procedures. The requester will be notified of a valid extension.
Private-body record requests must satisfy the requirements of PAIA, including that the record is required to exercise or protect a right and disclosure is not barred by a lawful refusal ground. Access to one’s own personal information may also be governed by POPIA.
5. Fees, refusals and remedies
PAIA provides for prescribed request and access fees, deposits in qualifying circumstances and exemptions, including for qualifying personal requesters. The Information Officer applies the current official fee schedule and provides notice before seeking a lawful fee.
Access may be refused or limited where PAIA requires or permits this, including protection of another person’s privacy, confidential information and privileged material. A person dissatisfied with a private body’s decision may complain to the Information Regulator or pursue available remedies, including court proceedings where applicable. There is generally no internal appeal for private bodies.
PAIA forms, fees and complaint information
6. Records available without a formal PAIA request
| Record category | Method of access |
|---|---|
| Public website, service descriptions, contact details and public FAQs | Website, where published |
| Authorised public portfolio examples | Public website and display channels, where permitted |
| Public Privacy Policy and PAIA manual | Website and on request, once issued |
| PAIA Guide and request forms | Regulator website, office Guide copy and on request |
Private client records, signed permissions, photographic working files and confidential correspondence are not automatically public simply because the studio holds them.
7. Record categories held subject to lawful access
| Record category | Examples |
|---|---|
| Business administration | Business correspondence, supplier orders and operational documents |
| Clients and bookings | Enquiries, Booklink bookings, instructions and client communications |
| Agreements and consents | Photography agreements, permission records and releases |
| Photographic material | RAW and edited files, selected artwork, gallery and delivery records |
| Verification and questionnaires | Minimal verification records, temporary identification copies and questionnaires |
| Accounting and finance | Invoices, payment references and tax records |
| Website and security | Privacy preferences, relevant security logs and incident records |
8. Legislation that may require records to be kept
Depending on the activities and records concerned, the studio may retain records under the Tax Administration Act 28 of 2011, PAIA, POPIA, applicable contractual, consumer and electronic-transaction law, or other relevant legislation. Listing a law does not mean every record category under it is held by the studio.
9. Personal-information processing under POPIA
| Data-subject category | Types and purposes |
|---|---|
| Clients, models and prospective clients | Contact and booking information, photographs, instructions, agreements, permissions and verification records; fulfilling projects and managing permissions |
| Suppliers and business contacts | Business contacts, orders, communications and payment records; procuring and administering services |
| Website users and enquirers | Enquiries, technical/security records and optional analytics according to consent |
Processing, retention and rights
The studio seeks to process only information necessary for specified lawful purposes. Photographic working files are normally deleted one year after project completion, unless a lawful exception applies or a written extension of up to five years from completion is agreed. Identity-document copies are retained only while necessary for verification or another lawful purpose. Agreements and financial records have separate retention triggers. Requests for access, correction, deletion and objection are assessed under applicable POPIA and PAIA requirements.
10. Recipients and international processing
Google Drive synchronises photographic files, Microsoft OneDrive synchronises client records, Adobe Lightroom provides Invite Only galleries, WeTransfer provides password-protected expiring file-transfer links, Booklink handles bookings and Payfast processes payments. Orms Print Room, Rapid Studio and Canvas & More may receive selected photographs and manufacturing specifications under the studio name, not client names or addresses. Artwork is delivered to the proprietor for quality control and personally handed to clients. The studio performs its own editing without routine external retouchers.
Cloud, payment, website and delivery providers may process personal information outside South Africa. International transfers must satisfy applicable section 72 POPIA requirements and safeguards. Exact processing locations and contractual terms depend on the selected services.
11. Security safeguards
Safeguards include encryption of drives containing client information, two-step verification on Google and Microsoft accounts, restricted access, separate verification records, Invite Only gallery access, expiring password-protected file transfers, optional website analytics subject to consent and WordPress security controls. Adopted internal policies address deletion and security incidents. The studio periodically reviews risks and service providers.
12. Review and contact
The Information Officer reviews this manual when business records, contact details, processes or legal requirements change. Requests for access or an accessible copy of this manual can be sent to the contact details in section 1.