Employee Monitoring in South Africa.

POPIA — Protection of Personal Information Act

South Africa's POPIA (Act 4 of 2013) governs how organisations collect, process, and store personal information — including employee activity data. The Act does not prohibit employee monitoring, but it sets clear boundaries.

Employers can monitor employee activity on company devices and networks, provided they meet the following requirements:

• Transparency: Employees must know they are being monitored. A clear monitoring policy should be communicated and acknowledged.
• Consent: While implied consent through employment contracts is common, explicit consent is best practice. Include monitoring clauses in employment agreements.
• Legitimate Purpose: Monitoring must serve a legitimate business purpose — productivity management, security, compliance, or asset protection.
• Proportionality: Data collected must be proportional to the purpose. Don't collect more than you need.
• Data Security: Monitoring data must be stored securely with appropriate access controls.

Best Practices for Compliance

To stay on the right side of the law and maintain employee trust, follow these guidelines:

• Draft a written monitoring policy that explains what is monitored, why, and how data is used.
• Include monitoring clauses in employment contracts or as an addendum signed by all staff.
• Only monitor company-owned devices and networks — never personal devices without explicit, informed consent.
• Give employees access to their own data through a staff portal for transparency.
• Limit access to monitoring data to authorised managers and HR only.
• Conduct regular data retention reviews — don't store monitoring data longer than necessary.

The Regulation of Interception of Communications Act (RICA) also applies if you intercept the content of communications. Monitoring metadata (who, when, how long) is less restricted than reading actual messages.