The section 33 framework
Criminal-behaviour and biometric information may be processed by responsible parties “who have obtained that information in accordance with the law”, with employee vetting governed by labour legislation.
Both categories sit inside the special-information regime — prohibited by section 26, permitted through the gateways — and section 33 is their sector authorisation. The phrase doing the work is “in accordance with the law”: a SAPS clearance certificate the candidate obtained and tendered, an AFISwitch check run through the authorised channel, biometric data collected openly for a defined purpose. Information that reaches you sideways — a leaked docket, a tip-off database — fails at the threshold.
Biometric clocking and access control
Fingerprint clocking, facial-recognition entry, voice authentication — all biometric processing, all lawful when built properly: a real purpose (payroll fraud was costing money; the server room needs strong access control), proportionality (would a card have done? — answer the question honestly and record the answer), hardened storage (templates, hashed, segregated — a biometric can’t be reissued after a breach), and openness with the people enrolled. What the system must not become is a general surveillance asset repurposed at will — the purpose limitation binds biometrics hardest of all.
Background checks — and the section 57 trap
The critical distinction is whose processing it is. An employer vetting its own candidates processes under section 33 and labour law. A business whose service is screening — running criminal and conduct checks on behalf of client companies — processes “information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties”, which is one of the four prior-authorisation triggers in section 57(1). Such businesses must apply to the Regulator once-off before processing — and since 1 February 2022, section 58(2) bars proceeding until the Regulator has responded. Clients of screening firms should ask to see the authorisation: an unauthorised screener is itself processing unlawfully, with your candidates’ data.