Does POPIA allow reference checks? What recruiters need to know

Since the Protection of Personal Information Act (POPIA) came into force, recruiters and HR teams may have been wondering whether reference checks are really allowed in the way they were before, or what the rules are. Some former employers might refuse to give references "because of POPIA" without knowing the full picture.

The short answer: yes, POPIA allows reference checks. It doesn't ban them, but it sets rules for how you collect, use and store the personal information involved. Following those rules and reference checks remain one of the most useful, and lawful, parts of the hiring process.

Here's what South African recruiters and HR teams need to know. As always, this is general guidance rather than legal advice, so check your own process with your information officer or a legal adviser.

Do you need the candidate's consent?

This is the question that causes the most confusion, partly because there's more than one lawful basis for processing personal information under POPIA.

Consent is one. Another is legitimate interest. Section 11(1)(f) allows processing that's necessary for the legitimate interests of the organisation, or of a third party to whom the information is supplied. Attorney Martin Kotze of MJ Kotze Inc explains that a prospective employer deciding whether to hire someone has exactly that kind of interest. That's why a former employer can lawfully give a truthful, relevant reference without needing the ex-employee's consent.

On the hiring side, though, getting the candidate's written consent is still the standard, sensible approach. Most screening providers and HR advisers recommend it before any pre-employment check, and some checks, such as criminal record checks, need the candidate's involvement anyway. More importantly, consent goes hand in hand with being open, which POPIA does require.

You must tell candidates what you're doing

Section 18 requires you to take reasonably practicable steps to make people aware when you collect their personal information. That includes what you're collecting, where it's coming from when it isn't collected directly, why you're collecting it, who will receive it and what rights the person has.

Getting candidate consent is a vital part of the process.

For reference checks, that means telling candidates, before you start:

• that you'll be checking references, and which ones

• what you'll ask referees about and why

• who will see the results, for example your client if you're an agency

• how long you'll keep the information

• how they can access or correct it

In practice, a short consent form or notice at the reference stage covers both bases. The candidate knows exactly what's happening, and you have a clear record that they agreed.

What POPIA expects from the reference check itself

Consent and notice get you started. The rest of POPIA shapes what you ask, what you keep and how you look after it.

RefWorthy requests authorizations from candidates automatically and stores their declarations.

Ask only what the job needs

Section 10 says personal information must be "adequate, relevant and not excessive" for its purpose. For a reference check, the purpose is deciding whether this candidate suits this role. Questions about job title, dates, responsibilities, performance, conduct and how the candidate works with others all fit. Questions about their health, family plans, religion or anything else unrelated to the work don't.

Be especially careful with special personal information, such as health, religious beliefs, race, trade union membership and criminal behaviour, which POPIA protects more strictly. Things like sick-leave history don’t belong in a reference. If a referee volunteers information like this, don't record it.

Make sure it's accurate

Section 16 requires reasonable steps to make sure personal information is complete, accurate and not misleading. Record what referees actually said, ideally in writing, and give candidates a chance to respond to anything negative before it decides the outcome. Bear in mind that under section 23, candidates can ask to see the personal information you hold about them, so write notes on the assumption that the candidate may one day read them.

Don't keep it forever

Section 14 says records shouldn't be kept longer than needed for their purpose, unless the law, a contract or another lawful reason requires it. Decide how long you'll keep reference records for successful and unsuccessful candidates, write it down, and delete or de-identify them when the time is up. Keeping everything "just in case" increases your risk if there's ever a data breach.

Keep it secure, including with your suppliers

POPIA requires appropriate security safeguards for personal information. Reference notes in personal inboxes, shared spreadsheets and WhatsApp threads are hard to protect and harder to delete. If you use a reference-checking platform like RefWorthy, the information is protected on your behalf.

The cost of getting it wrong

The Information Regulator can investigate complaints, issue enforcement notices and impose administrative fines of up to R10 million. Most organisations will never get near that. But a candidate who discovers you collected information without telling them, or kept their reference notes for years, has every right to complain.

A POPIA-friendly reference check checklist

Use this as a quick reference for your own process:

☐ Tell the candidate which references you'll check

☐ Get their consent before contacting anyone

☐ Contact only the referees the candidate has nominated or agreed to

☐ Never contact a current employer without explicit permission

☐ Ask only job-related questions, and avoid special personal information

☐ Record referees' answers accurately, ideally in writing

☐ Let the candidate respond to negative feedback before deciding

☐ Share results only with the people who need them, such as the hiring manager or client

☐ Store reference records securely, not in personal inboxes or chat apps

☐ Delete or de-identify records when your retention period ends

☐ Have a written agreement with any software or screening provider you use

POPIA isn't the enemy of good referencing

POPIA hasn't made reference checks illegal. If anything, it's made good reference checks the norm: open with the candidate, focused on the job, accurate and securely stored. Recruiters and HR teams who work that way have little to worry about, and they tend to get better references as a result.

RefWorthy helps South African recruitment agencies and HR teams run structured reference checks with POPIA in mind, from candidate-nominated referees to secure, consistent records. Start free with your first three candidates.