POPIA and Hiring: What You May Ask, Keep, and For How Long

The CV folder problem

Almost every South African business has one: a folder, a mailbox, or a filing cabinet holding every CV it has ever received. Some go back a decade. Nobody has looked at most of them since the week they arrived.

Under POPIA that folder is a liability. A CV is dense with personal information: an ID number, an address, employment history, sometimes a photograph, marital status and dependants. Section 14 says you may not keep records longer than is necessary for the purpose you collected them for. Once a role is filled, the purpose for holding the unsuccessful applications has ended.

This article covers what POPIA actually permits during recruitment, because the rules are more specific than most employers realise. For the broader employment picture, see POPIA and employee data, which deals with people you have already hired.

Recruitment is processing, and you need a lawful ground

The moment you receive a CV you are processing personal information, and section 11 requires a lawful ground. Consent is one of six, and in recruitment it is usually not the one you need.

The ground that ordinarily fits is section 11(1)(b): processing that is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party. The candidate applied. Assessing them is a step towards the contract they are asking you to conclude.

That covers reading the CV, shortlisting, interviewing and checking the referees they gave you, for the role they applied for. It does not automatically cover everything else employers do with applications, which is where the problems start.

What you may ask, and what you may not

Section 10 is the minimality condition: processing must be adequate, relevant and not excessive for the purpose. In practice, ask yourself for each question, could I decide on this candidate without knowing this? If yes, do not ask.

Usually defensible:

• Qualifications, work history and skills relevant to the role
• Whether the person is legally entitled to work in South Africa
• Notice period and availability
• Contact details for the recruitment process

Questions that need care, because they touch special personal information under section 26. Section 26 prohibits processing these outright, and you have to find an authorisation, either the general ones in section 27 or the category-specific one. Each category has its own section, and they are easy to mix up:

• Race and ethnic origin. The authorisation is section 29, which permits processing to comply with laws designed to protect or advance people disadvantaged by unfair discrimination. That is what employment equity reporting rests on. If you collect it, collect it for that purpose, say so, and keep it out of the selection decision.
• Health or disability. The authorisation is section 32, or one of the general grounds in section 27. You may ask about accommodations needed for the interview, and about the inherent requirements of the job. You may not ask for a general medical history.
• Criminal history. Also special personal information. Covered below, because it carries a trap.
• Religious or philosophical beliefs (section 28), trade union membership (section 30), political persuasion (section 31). There is no legitimate recruitment purpose in almost every case. Do not ask.

Some habits from older application forms are now hard to defend: marital status, number of children, and date of birth where age is not an inherent requirement of the job. If your form still asks, remove the questions rather than collecting information you cannot justify holding.

Background checks need more than a tick box

This is the part employers most often get wrong.

Criminal record checks. Information about criminal behaviour is special personal information under section 26. Section 33 lifts that prohibition for responsible parties who have obtained the information in accordance with the law, and section 27 supplies the general authorisations, including the candidate's consent. In practice you want explicit, informed consent, and you should be able to explain why the role justifies the check. A cashier handling money is defensible. A graphic designer is harder.

The trap is section 57, and it is widely misunderstood. Prior authorisation from the Information Regulator is required to process information on criminal behaviour, or on unlawful or objectionable conduct, on behalf of third parties. Those last four words matter. An employer running a check for its own hiring decision is generally not the one who needs the authorisation. The screening company you engage is, because it processes that information on your behalf.

So the practical obligation is the reverse of what people assume. You do not apply to the Regulator. You verify that your background checking provider holds prior authorisation, and you should ask them for evidence of it before you send them a single candidate's details. The Regulator has indicated that criminal behaviour here includes a criminal record enquiry, and that unlawful or objectionable conduct can extend to reference checks about past conduct or disciplinary action.

Credit checks. The restriction comes from the National Credit Act rather than from employment legislation. Its regulations limit the purposes for which credit bureau information may be released, and the relevant one is considering a candidate for a position that requires honesty in dealing with cash or finances. That is the test. A credit check on a warehouse assistant does not meet it, whatever your application form says. You also need the candidate's consent, and the Employment Equity Act remains relevant on the other side of the decision, since rejecting someone on a poor credit record without a justification tied to the role invites an unfair discrimination claim.

Reference checks. Get consent and contact only the referees the candidate gave you. Phoning someone's current employer without permission can cost them their job and will not end well for you. Note also the point above: probing past disciplinary action may stray into territory where your provider needs authorisation.

Social media screening. Lawful, but it is still processing. Whatever you find is personal information you now hold, it has to be relevant to the role, and you should be able to justify the search if asked. Screening someone's public professional profile is a different proposition from trawling family photographs.

How long may you keep applications?

POPIA does not name a number. Section 14 says records must not be retained longer than is necessary to achieve the purpose, unless a law requires or authorises longer retention, a contract requires it, or the data subject has consented.

That gives you a workable framework:

• The successful candidate. Their application becomes part of the employment record and is kept under employment legislation. The Basic Conditions of Employment Act requires certain employment records to be kept for three years.
• Unsuccessful candidates who did not agree to be kept on file. The purpose ends when the role is filled. Delete them. Many employers keep a short window afterwards in case the appointment falls through or a decision is challenged, which is defensible if you write the period down and stick to it.
• Unsuccessful candidates who agreed to be kept on file. This is the clean way to build a talent pool. Ask separately and clearly whether they are happy for you to keep their details for future roles, set an end date rather than keeping them indefinitely, and remember that consent can be withdrawn at any time under section 11(2)(b), so you need a way to act on that.
• Employment equity records. The Employment Equity Act requires designated employers to keep records relevant to their employment equity plan, which can include applicant demographic data. Keep that separately, for that purpose, rather than as a reason to retain whole applications.

Section 14 also requires you to actually destroy, delete or de-identify records once you are no longer authorised to hold them, in a manner that prevents reconstruction. Dragging a folder to the recycle bin on a shared drive that is backed up nightly is not that.

Tell candidates what you are doing

Section 18 requires you to inform a person, when you collect their information, of what you are collecting, why, whether providing it is voluntary or mandatory, who it may be shared with, and their rights. In recruitment the natural place is a short privacy notice on the careers page, linked from the application form.

It does not need to be long. It needs to say what you collect, what you use it for, who sees it including any recruitment agency or applicant tracking system, how long you keep it, whether it leaves South Africa, and how someone can ask you to delete it. If you intend to keep unsuccessful applications for future roles, say so there as well as asking on the form.

Recruitment agencies and applicant tracking systems

If you use an external recruiter or a hiring platform, they are almost certainly your operator, processing candidate information on your behalf. Section 21 requires a written contract with every operator, obliging them to maintain the security safeguards in section 19 and to notify you immediately of any unauthorised access.

Most employers using an applicant tracking system or a local recruitment agency have never signed one specifically. See operator agreements under section 21 for what that contract has to contain.

If the platform stores data outside South Africa, section 72 applies to that transfer as well, and your privacy notice should say so.

A practical starting point

If you do nothing else after reading this:

• Set a retention period for unsuccessful applications, and actually apply it
• Add a separate, optional tick box asking whether you may keep someone on file for future roles
• Put a short privacy notice on your careers page
• Remove questions from your application form that you cannot justify
• Ask your background checking provider for evidence of its prior authorisation
• Get written operator contracts with your recruiter and your hiring software

The privacy notice is the part we can help with. POPIA Ready generates a privacy policy customised to what your business actually collects, along with six other documents, free to preview. The free checklist will show you what else is missing.

General guidance on the Act as at August 2026, not legal advice. POPIA, the Employment Equity Act, the Basic Conditions of Employment Act and the National Credit Act all bear on hiring, and dismissal or discrimination questions deserve a professional opinion.