The Constitution of the Republic of South Africa (Act 108 of 1996) protects the right to privacy, as espoused in Section 14 therein. It is in this pursuit that the Protection of Personal Information Act 4 of 2013 (POPIA) was promulgated, which provides the regulatory framework under which the collection and processing of personal information must be done. Provided in Section 2 of POPIA is its purpose, which is to give “effect to the constitutional right to privacy, by safeguarding personal information when processed by a responsible party, subject to justifiable limitations.”

The Act (POPIA) came into effect on 1 July 2020, save for some sections which had already commenced back in 2014. However, the full enforcement of POPIA and its regulations will come into effect on 1 July 2021 as by then the 12 month grace period given to entities to put structural mechanisms in place to comply would have come to an end.

POPIA applies to all entities (responsible parties) that collect and process personal information from data subjects. Against this backdrop it is evident that it also applies in the workplace where personal information is collected and processed for work related operations. Employers collect personal information of job applicants, existing employees as well as former employees whereby this information is retained for various purposes. Even though the right to privacy is protected in the Constitution, such right is also subject to limitation much in the same way and manner as others rights, to the extent that such limitation is amenable to the tenets of freedom, equality, fairness and justice in a democratic constitutional order.

For operational reasons, employers require personal information of employees be they current, former or those in candidacy. However in doing so the regulatory effect of POPIA and its conditions apply to the manner in which this information is gathered and processed. Employers ought to protect the integrity and privacy of the personal information of their employees as required by POPIA in particular, and the Constitution in general.

The lawful gathering and processing of personal information must comply with the eight (8) conditions contained under the regulations of POPIA and employers as responsible parties, must put in place measures in the workplace to achieve this. The eight (8) conditions for lawful gathering and processing of personal information under POPIA are as follows;

1. Accountability
2. Processing limitation

• Purpose specification

1. Further processing limitation
2. Information quality
3. Openness

• Security safeguards
• Data subject (e.g employee) participation

Employers must ensure that the personal informaton they retain is processed only for the purpose for that which the information was collected for, together with any other reason ancillary to the main purpose. In the event that the retained information is not of particular use anymore to the employer, it is advisable for such information to be obliterated in a responsible manner as envisaged by POPIA.

Non-compliance with POPIA and its regulations can invite hefty financial penalties running into millions of Rands or even imprisonment of wrongful parties, depending on the circumstances of each particular case.

We assist companies and entities to come up and put in place comprehensive information processing systems that comply with POPIA, to avoid hefty financial penalties that could have been put to better use in this harsh economic environment. Contact us for consultation.

The information contained in this site is provided for informational purposes only, and should not be construed as legal advice on any subject matter. One should not act or refrain from acting on the basis of any content included in this site without seeking legal or other professional advice. The contents of this site contain general information and may not reflect current legal developments or address one’s peculiar situation. We disclaim all liability for actions one may take or fail to take based on any content on this site.