HR purposes mapped to their grounds
| HR purpose | Ground / gateway |
|---|---|
| Payroll, leave, benefits administration | Contract (s 11(1)(b)) + legal obligation (s 11(1)(c) — tax, UIF, BCEA records) |
| Disciplinary records and grievance files | Contract + rights/obligations gateway for any special information (s 27(1)(b)) |
| Sick notes and medical certificates | Rights and obligations in law (s 27(1)(b)); employer health-status laws (s 32(1)(f)) |
| Race and ethnicity for EE / B-BBEE reporting | Section 29(b) — laws protecting or advancing persons disadvantaged by unfair discrimination |
| Biometric clocking / access control | Section 33 — obtained and used in accordance with the law, proportionately |
| References for departing staff | Legitimate interests of the prospective employer (s 11(1)(f)) |
Notice the column that never appears: consent. The architecture is deliberate — employment processing is necessary processing, carried by the contract and the statutes that regulate work.
Why employee “consent” is structurally suspect
POPIA’s consent must be voluntary — and the employment relationship strains voluntariness to breaking point. The definition demands a “voluntary, specific and informed expression of will”:
“’consent’ means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information;”
A clause the candidate must sign to get the job is not an expression of will; it is a condition of employment. Worse, consent is withdrawable at any time — an HR system built on it dissolves the day a dismissed employee withdraws. Build on contract and legal obligation; reserve consent for the genuinely optional (the staff newsletter, the birthday list).
Workplace monitoring
Email and internet monitoring, vehicle tracking, and workplace cameras can rest on legitimate interests — security, productivity, asset protection — subject to the balancing test and openness: a monitoring policy employees have actually seen. Intercepting the content of communications is a separate statutory world (RICA), with its own consent and business-purpose rules that POPIA does not displace. The reliable pattern: monitor transparently, proportionately, and per a written policy; covert monitoring is exceptional-circumstances territory needing advice.
The employee-data lifecycle
Recruitment: collect what the role decision needs; vetting within section 33 and labour law; tell unsuccessful candidates how long you keep their CVs. Employment: the mapping above, plus a staff privacy notice. Exit: references on legitimate interests, file retention per your schedule, then deletion or de-identification — an ex-employee file kept forever is the commonest retention failure in South African business.