POPIA and Employee Data: What South African Employers Must Know

Your staff records are the file you have thought about least

Most businesses put their POPIA effort into customer data. The employee file is usually older, messier, more sensitive, and held by more people than anyone has checked. It contains ID numbers, bank details, home addresses, medical certificates, disciplinary history and often biometric templates.

POPIA applies to all of it, and several categories attract the strictest treatment the Act has.

What you hold, and which parts are special

Ordinary employee personal information includes ID and passport details, bank and tax information, home address and contact details, performance reviews and employment history.

Some of it is special personal information under section 26, which is prohibited unless an authorisation applies:

• Health information, including medical certificates and disability details. Authorisation under section 32, or the general grounds in section 27. A practice holding patient records has a fuller treatment in POPIA for medical practices.
• Biometric data, including fingerprint and facial templates used for access or attendance. Section 33.
• Criminal behaviour, from background checks. Section 33.
• Race or ethnic origin, which most employers collect for employment equity reporting. Section 29 permits it for compliance with laws designed to protect or advance people disadvantaged by unfair discrimination.
• Trade union membership, section 30.

Getting the right section matters, because each authorises a different thing. Mixing them up is common.

Consent is the wrong instinct here

Employers reach for consent forms. In employment that is the weakest available ground, because consent must be voluntary, and agreement from someone who needs the job is difficult to characterise that way.

You usually do not need it. Most employee processing rests on section 11(1)(b), necessary for the conclusion or performance of the employment contract, or section 11(1)(c), compliance with a legal obligation such as PAYE, UIF and employment equity reporting. Those grounds do not evaporate when someone changes their mind, which is precisely why they are better.

Where you genuinely do rely on consent, such as a biometric clocking system, you need a real alternative for anyone who refuses. See is fingerprint clocking legal in South Africa.

Recruitment starts before employment

The obligations begin when a CV arrives. Collect only what is relevant to the role, restrict who can see applications, and delete unsuccessful applications once the purpose has ended, which is when the role is filled. Many employers keep a short window afterwards for a failed appointment or a dispute, which is defensible if the period is written down and applied.

If you want a talent pool, ask separately and clearly, set an end date, and honour withdrawal under section 11(2)(b). POPIA and hiring covers what you may ask, what background checks require, and the section 57 trap around criminal record checks.

Who can see the file

Section 10 requires processing to be adequate, relevant and not excessive, and section 19 requires appropriate technical and organisational security measures. Together they make access control a legal requirement rather than good housekeeping.

• Payroll and bank details: finance only
• Medical certificates: kept separately from the general personnel file, given they are special personal information
• Disciplinary records: HR and the relevant manager, not the whole management team
• Former employees: revoke access on the last day, including shared drives, email and any HR system

Monitoring, and the statute employers forget

POPIA does not prohibit monitoring. It requires that you tell people, under section 18, that the purpose is defined under section 13, and that what you do is not excessive under section 10.

The provision employers overlook is not in POPIA at all. Intercepting communications, including reading employee email or recording calls, engages RICA, the Regulation of Interception of Communications Act. Recording a conversation you are not a party to, without consent from a party to it, can be a criminal offence quite separately from any POPIA analysis. The same applies to CCTV systems that capture audio, which is covered in CCTV and POPIA.

Practically: put monitoring in a written policy rather than a line in a contract, say what is monitored and why, never monitor bathrooms or rest areas, and do not quietly reuse a security system for performance management. That is a different purpose, and section 13 does not allow the switch without telling anyone.

RICA has three exceptions an employer might stand in, and the conditions attached to the business one are specific. See employee monitoring under POPIA and RICA.

Employees can ask for their file

Section 23 gives every data subject the right of access, and an employee or a former employee is a data subject. A request for a personnel file, a disciplinary record or the reasoning behind a decision runs on the same rules and the same 30 day period as a customer request.

These arrive most often from people who have just left or are in dispute with you, which is uncomfortable but not a ground for refusal. Decide in advance who handles them. See how to respond to a POPIA access request.

Your payroll bureau is an operator

Outsourced payroll, HR software, recruitment agencies, medical aid administrators and background checking providers all process employee information on your behalf. Section 21 requires a written contract with each, obliging them to maintain the section 19 safeguards and to notify you immediately of unauthorised access. Very few standard service agreements contain this. See operator agreements under section 21.

How long to keep it

• Basic Conditions of Employment Act: certain employment records for three years from the date of the last entry in the record.
• SARS: five years for payroll and tax records.
• Employment Equity Act: records relevant to the employment equity plan, kept for that purpose and separately.
• Unsuccessful applicants: delete once the role is filled, plus any short window you have written down.

Section 14 requires actual destruction, deletion or de-identification once you are no longer authorised to hold the record, in a manner that prevents reconstruction. A personnel folder on a nightly-backed-up shared drive is not deleted because someone moved it to the bin.

POPIA Ready generates a privacy policy, a PAIA manual and five other documents customised to your business, free to preview. The free checklist will show you what else is missing.

General guidance on South African law as at August 2026, not legal advice. Employee data sits across POPIA, RICA and employment law, and dismissal or discrimination questions deserve a professional opinion.