What people believe
“You can’t give a reference for an ex-employee — POPIA forbids it without their consent.”
A truthful, relevant reference is processing in the legitimate interest of the prospective employer — a third party to whom the information is supplied, in the subsection’s own words. The real constraints are accuracy and defamation law, not a POPIA ban.
“(f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.”
Which lawful ground covers a reference?
Legitimate interests — and the fit is exact. A prospective employer deciding whether to hire has an obvious, lawful interest in the candidate’s work history; section 11(1)(f) expressly extends to the interests of “a third party to whom the information is supplied”; and giving the reference is necessary to serve that interest — there is no less intrusive way to convey how someone actually performed. The balancing leg holds too: a candidate who nominated you as a referee can hardly claim the disclosure defeats their reasonable expectations. The general framework is on the legitimate-interests page; the reference is its cleanest worked example.
What POPIA actually disciplines: accuracy and minimality
POPIA’s real contribution to references is quality control, not prohibition:
“A responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and updated where necessary.”
Pair that with minimality (s 10): share what the hiring decision needs — role, dates, performance and conduct facts — not the entire HR file, not the medical history, not the grievance that went nowhere. Truthful, relevant, proportionate: that is the whole POPIA test for a reference.
Where the real risk sits
The legal risk in references predates POPIA and survives it unchanged: defamation. A false statement that injures the ex-employee’s reputation can found a claim — and an over-generous reference that conceals known dishonesty can mislead the next employer. The practical do/don’t list: do stick to facts you can evidence, answer what was asked, and keep a copy; don’t speculate about character, repeat unproven allegations, or volunteer special personal information. Notice that none of those cautions is “get consent” — they are accuracy disciplines.
Should you get the employee’s consent anyway?
A heads-up is good practice and good manners — candidates usually nominate their referees anyway. But making consent the legal basis is a mistake: consent is withdrawable at will, so a reference programme built on consent collapses the moment a disgruntled ex-employee withdraws it — while the legitimate-interest ground, properly applied, stands. Zero South African enforcement actions to date concern employment references; the fear is folklore.