POPIA and payroll data protection

Responsible party and operator

The employer is the responsible party: it determines why and how employee information is processed. An outsourced payroll provider is an operator, processing on the employer's instruction under a written agreement that requires confidentiality and appropriate security safeguards.

Lawful processing in payroll

• Processing must be necessary for the employment contract or required by law — payroll qualifies on both grounds
• Only the information actually needed may be collected
• Information must be accurate, complete and updated as circumstances change
• Employees must know what is collected and why
• Special personal information, such as health data linked to medical aid, requires extra care

Security safeguards that matter in payroll

• Role-based access so only named users see payroll data
• Secure transmission of payroll input and payslips rather than open email attachments
• Verification controls on banking detail changes
• Audit trails on master data changes
• Defined breach response, including notification obligations

Retention and deletion

Tax and labour legislation prescribe minimum retention periods for payroll records. POPIA requires that information not be kept longer than necessary once those periods have passed, so retention should be a policy with an end date rather than indefinite storage.

Employee requests

Employees may request access to their personal information and may ask for correction of inaccurate data. A payroll function should be able to respond within the required timeframes without reconstructing records manually.