POPIA and Hiring: What You May Ask, Keep, and For How Long

The CV folder problem

Almost every South African business has one: a folder, a mailbox, or a filing cabinet holding every CV it has ever received. Some go back a decade. Nobody has looked at most of them since the week they arrived.

Under POPIA that folder is a liability. A CV is dense with personal information: ID number, address, employment history, sometimes a photograph, marital status, and dependants. Section 14 says you may not keep records longer than is necessary for the purpose you collected them for. Once a role is filled, the purpose for holding the unsuccessful applications has ended.

This article covers what POPIA actually permits during recruitment, because the rules are more specific than most employers realise. If you want the broader employment picture, see POPIA and employee data, which deals with people you have already hired.

Recruitment is processing, and you need a lawful ground

The moment you receive a CV you are processing personal information, and section 11 requires a lawful ground. In recruitment you usually have a good one without needing consent: processing is necessary to take steps at the request of the data subject prior to entering into a contract. The candidate applied. They want you to consider them.

That covers reading the CV, shortlisting, interviewing and checking references for the role applied for. It does not automatically cover everything else employers do with applications, which is where the problems start.

What you may ask, and what you may not

Section 9 requires that processing be adequate, relevant and not excessive. In practice, ask yourself for each question: could I decide on this candidate without knowing this? If yes, do not ask.

Questions that are usually defensible:

• Qualifications, work history, and skills relevant to the role
• Whether the person is legally entitled to work in South Africa
• Notice period and availability
• Contact details for the recruitment process

Questions that need care, because they touch special personal information under section 26:

• Race and ethnic origin. Prohibited in general, but section 28 permits it where processing is required to comply with employment equity law. If you collect it, collect it for that purpose, say so, and keep it separate from selection decisions.
• Health or disability. Prohibited under section 26 unless a section 27 or 30 exception applies. You may ask about accommodations needed for the interview or the inherent requirements of the job. You may not ask for a general medical history.
• Criminal history. Also special personal information. See below, because this one has a further trap.
• Religion, political persuasion, trade union membership. No legitimate recruitment purpose in almost every case. Do not ask.

Some habits from older application forms are now hard to defend: marital status, number of children, and date of birth where age is not an inherent requirement. If your application form still asks for these, that form needs a review.

Background checks need more than a tick box

This is the part employers most often get wrong.

Criminal record checks. Information about criminal behaviour is special personal information under section 26. Section 33 permits processing it where it is necessary to achieve a purpose that is in the public interest, or with the consent of the data subject. In practice you need the candidate's explicit, informed consent, and you should be able to explain why the role justifies the check. A cashier handling money is defensible. A graphic designer is harder.

There is a further requirement people miss entirely: section 57 requires prior authorisation from the Information Regulator before a responsible party processes information on criminal behaviour on behalf of third parties. If you are an employer checking your own candidates, this generally does not catch you. If you are a recruitment agency doing it for clients, take advice.

Credit checks. Governed by the National Credit Act as well as POPIA. Under the Employment Equity Act and case law, credit checks are only justifiable where the role involves financial responsibility or trust. Do not run them by default.

Reference checks. Get consent, and only contact the referees the candidate has given you. Phoning a candidate's current employer without permission can cost them their job and will not go well for you.

Social media screening. Legal, but it is still processing. Whatever you find is now personal information you hold, it must be relevant to the role, and you should be able to justify the search. Screenshotting someone's personal Facebook and filing it is difficult to defend.

How long may you keep applications?

POPIA does not name a number. Section 14 says records must not be retained for longer than is necessary for achieving the purpose, unless a law requires longer, a contract requires it, or the data subject has consented.

That gives you a workable framework:

• The successful candidate. Their application becomes part of the employment record and is kept under employment legislation. The Basic Conditions of Employment Act requires certain employment records to be kept for three years.
• Unsuccessful candidates, no consent to keep. The purpose ends when the role is filled. Delete. Many employers allow a short window afterwards for a failed appointment or a dispute, and can justify that.
• Unsuccessful candidates who agreed to be kept on file. This is the clean way to build a talent pool: ask, separately and clearly, whether they are happy for you to keep their details for future roles, and for how long. Six or twelve months is common. When it expires, delete or ask again.
• Employment equity records. The Employment Equity Act requires designated employers to retain records relevant to their employment equity plan, which can include applicant demographic data. Keep that separately and for the statutory purpose only.

Section 14 also requires you to actually destroy, delete or de-identify records once the retention period ends, in a way that prevents reconstruction. Dragging a folder to the recycle bin on a shared drive that is backed up forever does not achieve that.

Tell candidates what you are doing

Section 18 requires you to inform a person, at the time you collect their information, of what you are collecting, why, whether it is voluntary, and who it may be shared with. In recruitment that means a short privacy notice on your careers page or application form.

It does not need to be long. It needs to say what you collect, what you use it for, who sees it (including any recruitment agency or applicant tracking system), how long you keep it, and how someone can ask for their information back or deleted.

Recruitment agencies and applicant tracking systems

If you use an external recruiter or a hiring platform, they are almost certainly your operator, processing candidate information on your behalf. Section 21 requires a written contract with every operator, obliging them to maintain the security measures POPIA requires.

Most employers using Workable, BambooHR, or a local recruitment agency have never signed one specifically. See operator agreements under section 21 for what that contract must contain.

If the platform stores data outside South Africa, section 72 also applies. Say so in your privacy notice.

A practical starting point

If you do nothing else after reading this:

• Set a retention period for unsuccessful applications and actually apply it
• Add a separate, optional tick box asking whether you may keep someone on file for future roles
• Put a short privacy notice on your careers page
• Remove questions from your application form that you cannot justify
• Get written operator contracts with your recruiter and your hiring software

The privacy notice is the part we can help with. POPIA Ready generates a privacy policy customised to what your business actually collects, along with six other documents, free to preview. For everything else, the free checklist will show you where the gaps are.

This is general guidance on the Act as at July 2026, not legal advice. Employment law and POPIA interact in ways that depend on your circumstances, and dismissal or discrimination questions deserve a professional opinion.