Protect Your Data: New POPIA Rules Employers Must Follow

What happened

The Protection of Personal Information Act (POPIA) has clear rules on how employers must handle employees' personal data, especially sensitive health information. Despite this, many South African employers are not fully complying with these new regulations. This is especially concerning as health data breaches loom, putting employees’ privacy at risk.

Under POPIA, which came fully into effect in July 2021, organisations must protect personal information and can only collect and use it for legitimate purposes. When it comes to health data, the law is stricter because this information is highly sensitive. Employers need to have strong safeguards and transparent processes for collecting, storing, and sharing this kind of information.

However, reports and investigations indicate that a significant number of companies are ignoring these rules, either due to lack of awareness or negligence. This has led to data breaches where employees' health details have been exposed without consent.

Why it matters

Personal health information is fundamentally private. When this data is mishandled or leaked, it can cause serious harm, including discrimination, stigma, and loss of trust between employees and employers.

In South Africa, where many workers already face vulnerability due to unemployment and economic inequality, safeguarding personal information is crucial. Health data breaches can affect job security, especially for those with conditions like HIV/AIDS or chronic illnesses that may be unfairly judged by employers.

Moreover, POPIA non-compliance can lead to hefty fines and legal penalties for businesses. This escalates risks for small and medium enterprises (SMEs) that may lack resources to handle complicated compliance requirements.

What this means for South Africans

For employees, understanding their rights under POPIA is more important than ever. Workers should know what personal health data their employers collect and how it will be used. They also have the right to decline unnecessary data sharing and to ask for corrections if there are inaccuracies.

For employers, especially small business owners and HR departments in South Africa, this is a wake-up call to review their data protection policies. Compliance isn’t just about avoiding fines—it’s about building trust and creating a safe workplace.

Businesses will need to invest in training staff about POPIA, upgrade data security systems, and maintain clear documentation of consent when collecting personal data. Failure to do so could also affect recruitment and retention if employees feel insecure about their privacy.

Impact on consumers, jobs and small businesses

The ripple effects of ignoring POPIA regulations on health data go beyond employee privacy. Consumers who interact with these businesses may also lose confidence if companies mishandle personal information. For example, retail or service businesses with health screenings or wellness programmes collect sensitive data that must be safeguarded.

From a jobs perspective, data breaches can lead to disputes, reduced morale, and in worst cases, unfair dismissals or discrimination cases. This fuels workplace tension and legal costs, straining both employees and employers.

SMEs may find it challenging to comply due to limited resources, but ignoring POPIA rules is not an option. Support and advice are available from the Information Regulator’s office, and various business associations are offering guidance to help small businesses comply without breaking the bank.

Risks and limitations

While POPIA is a strong step forward, enforcement is still developing. Many companies remain unaware or unsure of their responsibilities, which prolongs non-compliance risk.

Additionally, cybercrime and hacking present ongoing threats to data security, meaning even compliant businesses must continuously improve their systems.

Employees should also be cautious and proactive in protecting their information by understanding their rights and raising concerns when privacy is at risk.

In the long run, a culture of respect for privacy and data protection can benefit South African workplaces, helping both employers and employees navigate a digital world with greater confidence and fairness.

(Source: Health data breaches loom as employers ignore new Popia rules)

Frequently asked questions

Related articles