Compliance and governance · · 7 min read · 1,613 words
POPIA for HR teams: the five records that matter
By the LabourLink editorial team. Last reviewed 17 October 2026.
The short answer
HR files hold special personal information such as health, union and biometric data. Start with an information map, an employee privacy notice, security safeguards, a retention schedule, a registered Information Officer and a breach plan.
The short answer
The Protection of Personal Information Act applies to almost everything an HR department does. Recruitment, onboarding, payroll, leave, discipline and exit all involve personal information, and much of it is special personal information. HR teams do not need to become privacy specialists, but they do need to know where employee information is, why they hold it, who can see it, how long they keep it and what to do if it leaks.
Why HR is a high-risk area
POPIA prohibits the processing of special personal information unless an exception applies. Special personal information includes, among other things, a person's race or ethnic origin, trade union membership, health and biometric information, and criminal behaviour[1]. A typical HR file contains several of these: a medical certificate, a union deduction on a payslip, a fingerprint template for a time clock, an employment equity declaration, a criminal record check.
The exceptions exist and are workable. Processing is allowed, for example, with the consent of the data subject or where it is necessary for the establishment, exercise or defence of a right or obligation in law[1]. There are also specific authorisations: employers may process health information where it is necessary to implement laws, pension regulations or collective agreements that create rights dependent on health, or to support the reintegration of workers in connection with sickness or work incapacity, and the information must then be processed subject to an obligation of confidentiality[1]. The point is not that HR cannot hold sensitive information. It is that every category needs a lawful basis, and someone should be able to explain it.
The lawful basis for ordinary HR processing
For ordinary personal information, POPIA allows processing where, among other grounds, the data subject consents, the processing is necessary to perform a contract with the data subject, it complies with an obligation imposed by law, or it is necessary for the legitimate interests of the responsible party[1]. Most HR processing rests on the employment contract and on legal obligations such as payroll tax, the Basic Conditions of Employment Act and employment equity reporting. Consent is usually the weakest basis in employment, because employees may withdraw it at any time[1] and because the employment relationship makes genuinely free consent harder to show.
Five things every HR team should do
1. Map the information
List the categories of employee information you hold, where each sits (payroll system, HR platform, shared drive, paper files, email), who has access and why you need it. This map is the foundation for everything else.
2. Tell employees
When personal information is collected, the responsible party must take reasonably practicable steps to make sure the data subject is aware of certain matters, including what information is collected, the purpose, whether supply is voluntary or mandatory, and their rights[1]. In practice, that means an employee privacy notice, given at recruitment and onboarding and kept up to date.
3. Secure it
POPIA requires a responsible party to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures[1]. It must identify foreseeable risks, maintain safeguards, verify that they work and update them[1]. For HR, that usually means role-based access to HR systems, encrypted laptops, locked filing cabinets, clean desk rules and care with email attachments.
4. Keep it only as long as needed
Records of personal information must not be kept longer than necessary for the purpose for which they were collected, unless retention is required or authorised by law, reasonably required for lawful purposes, required by contract or consented to[1]. Some HR records have statutory minimums. The Basic Conditions of Employment Act, for example, requires an employer to keep records of time worked and remuneration paid for three years from the date of the last entry[4]. Build a simple retention schedule that sets out each category, its legal basis and its retention period, and follow it.
5. Plan for a breach
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and, in most cases, the affected data subjects[1]. The notification must be made as soon as reasonably possible after the discovery of the compromise[1]. Do not wait to discover how to do this during an incident. Agree in advance who decides, who drafts the notifications and who speaks to employees.
The Information Officer
Every responsible party has an Information Officer. In a private company, that is ordinarily the head of the business, who may designate deputies. The Information Officer's duties include encouraging compliance with the conditions for lawful processing, dealing with requests made under the Act and working with the Information Regulator during investigations[1]. POPIA states that officers take up their duties only after the responsible party has registered them with the Regulator[1]. The Information Regulator's website explains the registration process[3].
The PAIA manual
The Promotion of Access to Information Act requires private bodies to compile a manual describing, among other things, how to request access to their records[2]. HR is often asked to contribute to it, because employee records are among the records most often requested.
Practical scenarios
Medical certificates
Keep medical certificates separate from the general personnel file, limit access to the people who process sick leave, and do not circulate diagnoses by email. The authorisation for employers to process health information depends on necessity and confidentiality[1].
Biometric time clocks
Biometric information is special personal information[1]. Explain to employees why the system is used, what is stored, who can access it and how long it is kept. Make sure the vendor's contract deals with security and deletion.
Reference checks
Tell candidates that you will check references and obtain their agreement before contacting referees. Share with prospective employers only what is necessary and accurate.
Disciplinary records
Disciplinary records are necessary for consistency in discipline, but they should still be secure and kept only for as long as there is a purpose. Your disciplinary code should say how long warnings remain valid, and your retention schedule should say how long the records themselves are kept.
A worked example
An HR officer at a manufacturing company emails a spreadsheet of employee names, ID numbers, salaries and medical aid details to a personal address so that she can finish a task at home. Her account is later compromised. The company's breach plan is triggered: IT confirms what was in the spreadsheet and when the account was accessed, the Information Officer decides that there are reasonable grounds to believe the information was accessed by an unauthorised person, and notifications are prepared for the Regulator and the affected employees[1]. The company then reviews its rules on personal email, introduces data loss prevention on outgoing mail and retrains the HR team. The incident is serious, but the response is orderly because the plan existed.
A checklist
- Map employee information and access.
- Issue an employee privacy notice[1].
- Confirm a lawful basis for each category, especially special personal information[1].
- Secure systems and paper files[1].
- Adopt a retention schedule[1][4].
- Register the Information Officer[1][3].
- Update the PAIA manual[2].
- Prepare and test a breach plan[1].
Operators: payroll, HR software and recruiters
Many HR teams rely on outside providers: payroll bureaux, HR platforms, recruitment agencies, background screening companies and benefits brokers. When a provider processes personal information on your behalf, it is acting for you, and your security duties extend to the arrangement. POPIA requires a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control[1]. In practice, that means a written agreement with each provider that deals with confidentiality, security measures, notification of breaches and return or deletion of information at the end of the contract.
Ask each provider four questions:
- Where is our employees' information stored, and who can access it?
- What security measures protect it?
- How quickly will you tell us if there is a compromise?
- What happens to the information when our contract ends?
Recruitment
Recruitment is where many organisations collect the most information about people they never employ. Collect only what you need at each stage. Tell candidates what will happen to their information[1]. Decide how long unsuccessful applications are kept, and delete them when that period ends[1]. If you want to keep CVs for future vacancies, tell the candidate and give them the choice.
Access requests from employees
Employees may ask what information you hold about them. Agree internally who handles such requests, how identity is verified and how quickly you will respond. Your Information Officer is responsible for dealing with requests made under the Act[1], so route requests through that office rather than letting line managers answer them informally.
Training
Most HR privacy incidents begin with an ordinary mistake: a spreadsheet sent to the wrong person, a file left on a printer, a laptop without encryption. Short, practical training for HR and line managers, repeated each year, does more than a long policy that nobody reads.
Key points
- Much HR information is special personal information and needs a specific lawful basis[1].
- Tell employees what you collect and why, at the point of collection[1].
- Secure the information, including with your service providers[1].
- Keep it only as long as you need it, subject to legal minimums[1][4].
- Notify the Regulator and affected people as soon as reasonably possible after a compromise[1].
When to get specialist help
A consultant can help map HR information, draft privacy notices and retention schedules, train HR and line managers and prepare a breach plan. Book a LabourLink consultation before an incident, not after it. If a compromise does occur, the Act requires notification as soon as reasonably possible after discovery[1], so get help on the day you find out.