Employee monitoring law · South Africa
POPIA plus RICA, and RICA makes unlawful interception a criminal offence.
Get RICA consent in writing. Unlawful interception is a criminal offence, not a fine.
- Region
- Middle East & Africa
- Instruments
- 2 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
South Africa · what the law requires
Notice and proportionality
Two statutes stack. POPIA sets the data protection framework: lawful processing, minimality, purpose specification, and notification to the data subject. RICA separately prohibits interception of communications, with an exception for interception in the course of business where the employee has consented or where the communication relates to the business and the system is provided for business use. Getting RICA wrong is criminal, not administrative.
- Do not intercept without a RICA basisWritten consent, or the business-purpose exception on employer-provided systems. Unlawful interception is a criminal offence.
- MinimalityPOPIA requires processing to be adequate, relevant and not excessive for the purpose.
- Notify the data subjectEmployees are told what is collected, why, and by whom, before or as soon as reasonably practicable after collection.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- Protection of Personal Information Act: POPIA, Act 4 of 2013. Eight conditions for lawful processing, including minimality, purpose specification and openness. Enforced by the Information Regulator.
- Regulation of Interception of Communications Act: RICA, Act 70 of 2002. Prohibits interception; the business exception requires consent or that the communication relates to the business on a system provided for business use.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in South Africa that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Get RICA-compliant written consent, or satisfy yourself the business exception genuinely applies.
- 2Register an Information Officer with the Information Regulator.
- 3Publish the POPIA notification and the internal monitoring policy.
- If you get it wrongPOPIA: administrative fines up to ZAR 10 million and, for certain offences, imprisonment up to 10 years. RICA: criminal liability for unlawful interception.
Verify the claim
Every control above, on the page that describes it
- Per-app deny-lists keep named mail and messaging clients out of the record entirelyStay clear of communication interception
- Consent record with the version and date per personEvidence written consent where you rely on it
- Credential-derived tenant isolation enforced in the schemaMeet POPIA's security safeguards condition
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in Middle East & Africa
- United Arab EmiratesThree regimes in one country. Onshore, DIFC and ADGM each have their own rules.
- PolandThe Labour Code lists the permitted purposes, and productivity is not one of them.
- United KingdomThe ICO's 2023 monitoring guidance is the operative document, and it expects a DPIA.
- IrelandThe DPC accepts a legitimate business interest, and then tests proportionality hard.
- DenmarkSix weeks' notice under the collective agreement framework, and a strict purpose test.
- United States (federal)Federal law is permissive; the real constraints are state law and the NLRA.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.