Private bodies - such as hospitals, medical practices, banks and everyday employers - regularly receive requests for access to information under the Promotion of Access to Information Act 2 of 2000 ("PAIA"). Many recipients assume they have no choice but to comply with every request placed before them. That assumption is wrong. A recent High Court judgment from the KwaZulu-Natal Division dismissed a former employee’s application for access to his personnel records on multiple procedural and substantive grounds - each of which carries a practical lesson for any institution fielding PAIA requests. This article distils those lessons into a working checklist for private bodies. It is not a substitute for legal advice, but it is intended to equip those on the receiving end of such requests to spot non-compliant requests - and to understand when the law permits, and indeed requires, that they push back.