POPI and the Employment Life Cycle

POPI and the Employment Life Cycle

1. Engagement (advertising, recruitment and selection)

Examples of PI in the Engagement Process

Curriculum vitae; identity document; educational qualifications and transcripts; interview forms; psychrometric test results; email addresses; cell phone number; criminal and background checks. 

Notes for the engagement process

The personal information (PI) of applicants’ must be obtained directly from them, unless derived from a public platform.

Where an employer makes use of a recruitment agency, the applicant must consent to his/her PI being obtained from the recruitment agency.

The PI of unsuccessful applicant(s) must be destroyed once a decision has been taken not to employ the applicant(s). 

2. Employee onboarding, induction & Training

Examples of PI in the Onboarding process

Contract of employment; residential address; next of kin contact details; medical aid details; biometrics; email address; cell phone number; bank account details; payslips; and SARS tax  records. 

Notes for the onboarding process

• The nature of the information required pertaining to a next of kin constitutes PI in terms of POPI, as it is information related to an identifiable, living, natural person.
• Accordingly, an employer must (i) notify the next of kin that their PI is being processed and (ii) only process PI pertaining to a next of kin with their consent. 
• The onus of proof rests with the employer to prove that consent was received from a next of kin.

3. Day to day employee management and engagement with unions 

Examples of PI in day to day management  

Screening records in the context of COVID-19; Employee personnel file; disciplinary records; leave applications; Doctors notes; Drug & Alcohol test results; performance reviews and the processing of information related to Trade Union membership. 

Notes for day to day management 

Recommended action to be taken by employers:

• Ongoing analysis of PI to verify the quality, accuracy and completeness of the PI;
• Conduct risk assessments to determine loopholes in the protection of PI;
• Revise HR policies and contractual arrangements; and
• Revise and update contractual arrangements.

4. Termanation of Employment

Examples of PI  the Termination process 

The following  should be retained on termination for the applicable periods as per legislation: Contract of employment  (3 years); Arbitration Awards (3 years); SARS employee records (5 years); OHSA Incident records (3 years); Employee disciplinary records (indefinite) 

Notes for termination of employment 

• Save for the information that must be retained in terms of applicable legislation, an employer must dispose of information where an employment relationship is terminated.
• PI retained for further processing in terms of section 15(e) of POPI must be processed solely for that purpose and should not be published in an identifiable form.