What is POPIA?
POPIA, the Protection of Personal Information Act 4 of 2013, is South Africa’s data protection law. It sets the conditions for processing personal information, and an employer is the responsible party for what it holds on job applicants, employees and former employees, from CVs and contracts to payroll, leave and health records.
Need help navigating local labour compliance?
Schedule a strategy callThe conditions for lawful processing
POPIA sets eight conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. In HR terms, the employer should collect only what each purpose needs, tell employees why their information is processed, keep it accurate and secure, and give employees access to their own records.
Special personal information
Information about race or ethnic origin, religious beliefs, health, sex life, trade union membership, political persuasion, biometrics or criminal behaviour is special personal information. An employer may process it only under the exceptions in sections 27 to 33, such as the employee’s consent or the need to establish or exercise a right or obligation in law. Race data may also be processed to comply with laws that advance people disadvantaged by unfair discrimination, such as employment equity reporting.
Information officers, breaches and transfers abroad
Every employer has an information officer, by default the head of the organisation, who must be registered with the Information Regulator before taking up the role. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the employer must notify the Regulator, through its eServices portal, and the affected employees as soon as reasonably possible. The Regulator’s guidance is that every security compromise must be reported, whatever the level of risk.
Personal information may be sent to a third party in another country only under section 72: for example, where the recipient is bound by a law, binding corporate rules or a binding agreement that gives adequate protection, where the employee consents, or where the transfer is needed to perform the employee’s contract.
Penalties
The Regulator can issue enforcement notices and administrative fines of up to R10 million, and employees can claim damages in court. Some offences, such as failing to comply with an enforcement notice, carry up to 10 years’ imprisonment.
Employee data when you hire through an EOR
When you hire through TopSource as your Employer of Record in South Africa, we hold the HR and payroll records as the employer and process them under POPIA’s conditions, including the rules on special personal information. We agree with you how information can be shared with your team outside South Africa in line with section 72.
Frequently asked questions
Does POPIA apply to employee records in South Africa?
Yes. An employer is the responsible party for the personal information of applicants, employees and former employees, and must meet the Act’s conditions for lawful processing.
Can an employer process employees’ race data under POPIA?
Yes, where it is needed to comply with laws that advance people disadvantaged by unfair discrimination, such as employment equity reporting, or where another exception in sections 27 to 33 applies.
What are the fines under POPIA?
The Information Regulator can impose administrative fines of up to R10 million. Some offences, such as failing to comply with an enforcement notice, can also lead to up to 10 years’ imprisonment.
Related terms in South Africa
- Temporary Employment Services (South Africa)
- Section 198B Fixed-Term Rule (South Africa)
- BCEA Earnings Threshold (South Africa)
- Retrenchment (South Africa)
- Restraint of Trade (South Africa)
- Family Responsibility Leave (South Africa)
- Sick Leave Cycle (South Africa)
- Employment Equity Act Reporting (South Africa)
- B-BBEE Scorecard (South Africa)
- Critical Skills Work Visa (South Africa)
- EMP201 Monthly Return (South Africa)