The POPIA and Employee Privacy Policy provides a comprehensive framework for the lawful collection, processing, storage, use, sharing, retention, and protection of employees' personal information in accordance with the Protection of Personal Information Act (POPIA). It outlines the Company's responsibilities as a Responsible Party, defines employee privacy rights, explains how personal information is collected and processed throughout the employment lifecycle, and establishes robust governance measures for information security, consent, data retention, third-party disclosures, breach management, and regulatory compliance. The policy also details the roles of the Information Officer, employee rights under POPIA, complaint procedures, and the Company's commitment to safeguarding confidential information while ensuring compliance with South African data protection legislation.

What's Included

1. Introduction

• Overview of POPIA
• Employee privacy principles
• Company responsibilities as the Responsible Party
• Protection of personal information
• Human Capital and payroll information management

2. Purpose

• Objectives of the policy
• Employee informed consent
• Processing of personal information
• Collection, storage, use, distribution, and destruction of data

3. Scope

• Prospective employees
• Current and former employees
• Managers and supervisors
• Directors
• Contractors and consultants

4. Definitions

• Consent
• Information Officer
• Information Regulator
• Personal Information
• Responsible Party
• Processing
• Data Subject

5. Employee Personal Information

5.1 Personal Information Collected

• Identity and contact information
• Employment history
• Qualifications and education
• Payroll and banking information
• Emergency contacts and dependants
• Medical and disability information
• Criminal record information
• Biometric information
• Performance management records
• Training and development records
• Talent management information
• Employment documentation
• Benefits information

5.2 Collection of Personal Information

• Direct collection
• Automatic collection
• Third-party information sources
• Recruitment agencies
• Government authorities
• Publicly available information
• Employee consent

5.3 Storage of Personal Information

• Electronic records
• Physical records
• Access controls
• Authorised personnel

5.4 Retention of Personal Information

• Record retention periods
• Lawful disposal
• Operational requirements

6. Purpose of Collecting & Processing Personal Information

• Recruitment and onboarding
• Employment administration
• Payroll management
• Employee benefits administration
• Performance management
• Training and development
• Employment Equity and B-BBEE reporting
• Security and access control
• CCTV monitoring
• Business travel
• Risk management
• Fraud prevention
• Regulatory reporting
• Legal compliance
• Business continuity

7. Security Safeguards

• Information security controls
• Confidentiality measures
• Protection against unauthorised access
• Data breach procedures
• Security audits
• Information Regulator notification requirements

8. Operational Considerations

8.1 Monitoring

• Information Officer responsibilities
• Employee awareness and training
• Compliance monitoring
• Internal audits

8.2 Operating Controls

• Information security procedures
• Incident management
• User access management
• Data backups
• Security governance

9. Employee Rights

• Right of access
• Right to correction
• Right to deletion
• Right to object to processing
• Third-party disclosure rights
• Employee consent requirements

10. Enquiries & Complaints

• Information Officer contact process
• Internal complaint procedures
• Confidential complaint handling
• Escalation to the Information Regulator