Insights
POPIA and payroll data in practice
Payroll holds the most sensitive information an employer keeps. POPIA does not ban processing it — it requires that processing be necessary, minimal, accurate and secure.
Practical steps that matter most
- Limit payroll system access to named users with defined roles
- Stop sending unprotected payslips and payroll files by open email
- Verify banking detail changes through a second channel
- Keep an audit trail of master data changes
- Have a written operator agreement with any payroll provider
- Define retention periods and act on them
Special personal information
Medical scheme and health-related data attracts stricter conditions than ordinary personal information. Restrict who can see it and avoid copying it into spreadsheets outside the payroll system.
If something goes wrong
POPIA requires notification of a security compromise in defined circumstances. Decide in advance who leads that response — see POPIA.
Frequently asked questions
Does POPIA stop us from outsourcing payroll?
No. It requires a written agreement making the provider an operator that processes only on your instruction and applies appropriate security safeguards.
Can we keep payroll records forever?
No. Keep them for the minimum periods required by tax and labour legislation, then delete or de-identify what is no longer needed.
Are payroll spreadsheets a POPIA risk?
They are one of the largest. Extracted copies sit outside access control and audit trails, and are the most common source of accidental disclosure.
Patuza processes payroll under an operator agreement with access control and defined retention.
Book a consultationRelated services
- Employee administration →
Employee records, onboarding, changes, banking details and statutory data kept accurate and secure.
- Payroll processing →
Monthly and weekly payroll processing, calculations, payslips and statutory deductions.
- Payroll audits →
Independent payroll audits covering data integrity, statutory accuracy, controls and risk.
Related topics
- POPIA →
Protecting employee payroll data under the Protection of Personal Information Act.
Related insights
- What payroll processing involves →
A cycle-by-cycle walkthrough of how a South African payroll actually runs.
- Preparing for a payroll audit →
The documents, reconciliations and controls auditors and SARS ask for first.