CCTV, biometrics and employee monitoring: staying POPIA-compliant

Cameras in the warehouse, fingerprint scanners at the entrance, software that logs keystrokes and screenshots, GPS trackers in company vehicles. Monitoring technology is cheaper and more powerful than ever, and many South African employers now use several of these tools at once, often without having thought through the legal basis for each.

Employers have legitimate reasons to monitor: protecting stock and premises, keeping people safe, recording working hours and investigating misconduct. But every camera image, fingerprint template and activity log is personal information about an employee. Collecting it brings the Protection of Personal Information Act 4 of 2013 (POPIA) into play, and in the case of biometrics, its strictest rules.

The regulatory risk is growing. The Information Regulator reported more than 2,300 security compromise notifications in the 2024/25 year, has issued administrative fines and infringement notices to both public and private bodies, and amended the POPIA Regulations in April 2025. Abroad, regulators have ordered employers to stop using facial recognition and fingerprint scanning for attendance where less intrusive options such as access cards would do. South African employers should expect similar questions to be asked here.

The legal framework

Employee monitoring sits at the intersection of several laws:

• The Constitution protects the right to privacy in section 14. Like other rights, it can be limited, but only reasonably and justifiably.
• POPIA governs how personal information is collected, used, stored and destroyed. It applies to camera footage, access logs, location data and biometric templates.
• The Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (RICA) prohibits intercepting communications, subject to exceptions. Section 6 permits a business to intercept communications on its own systems in the course of its business, provided the system controller consents and reasonable efforts are made to inform users in advance that their communications may be intercepted.
• Labour law, including the Labour Relations Act 66 of 1995, governs how monitoring evidence may be used in disciplinary processes, and whether introducing monitoring changes terms and conditions of employment.

Applying POPIA to monitoring

POPIA does not ban monitoring. It requires employers to process personal information lawfully and in a reasonable manner that does not infringe privacy unnecessarily. In practice, each monitoring tool should be tested against these conditions:

• Justification. Processing needs a lawful ground under section 11, such as compliance with a legal obligation, performance of the employment contract, or the employer’s legitimate interests. Consent is possible, but in employment it is fragile, because employees may not feel free to refuse.
• Purpose. The purpose must be specific and explicitly defined. Footage collected to prevent theft should not quietly be used to measure productivity.
• Minimality. Collect only what is adequate, relevant and not excessive. Cameras should cover work areas, not bathrooms, change rooms or rest areas.
• Openness. Employees must be told what is collected, why, and who receives it. Signage and a clear monitoring policy are the minimum.
• Retention. Keep footage and logs only for as long as the purpose requires, then delete them, unless they are needed for an investigation or legal proceedings.
• Security. Recordings and biometric databases must be protected against unauthorised access. If they are compromised, the breach must be reported to the Regulator and affected employees.

Biometrics: a higher bar

Fingerprints, facial geometry and similar data are special personal information under section 26 of POPIA. Processing it is prohibited unless an exception in section 27 applies. The two most relevant are:

• the data subject’s consent; or
• processing that is necessary for the establishment, exercise or defence of a right or obligation in law.

Relying on consent for a biometric clock-in system is risky, because consent must be voluntary and specific. If refusing means an employee cannot work, the consent may not be genuine. Relying on legal necessity requires the employer to show that biometrics are actually needed, not merely convenient. A cash-handling vault or a high-security laboratory may justify biometric access. A general office entrance often will not, if a card or PIN would serve the same purpose.

Employers using biometrics should therefore document why less intrusive options are inadequate, offer an alternative where possible, store templates rather than raw images, and work with vendors who can show strong security controls.

CCTV, email and device monitoring

CCTV. Cameras are generally acceptable in work areas for security and safety, provided employees know about them and footage is handled properly. Covert cameras are much harder to justify and should be limited to specific investigations into serious misconduct, approved at a senior level and time-limited.

Email and internet use. Monitoring company email and systems is usually possible under RICA section 6 and POPIA if employees have been clearly told in advance, typically through an IT and acceptable use policy. Monitoring personal accounts or devices is far riskier.

Productivity and AI tools. Software that scores employees or flags them automatically raises additional concerns. Section 71 of POPIA restricts decisions with legal or similarly significant effects that are based solely on automated processing, so a human should review any decision on performance, discipline or pay.

Vehicle tracking. Tracking company vehicles during working hours is generally justifiable. Tracking outside working hours, or tracking personal phones, needs a much stronger justification.

Using monitoring evidence in disciplinary hearings

Footage and logs are often central to misconduct cases. Evidence obtained in breach of POPIA or RICA is not automatically excluded, but it can be challenged, and the way it was obtained may affect its weight and the fairness of the process. Employers are in a much stronger position if the monitoring was disclosed in a policy, the footage was preserved securely, and the chain of custody can be explained.

A practical compliance checklist

1. List every monitoring tool in use, including those run by security companies and software vendors.
2. For each tool, record the purpose, the lawful ground under POPIA and why a less intrusive option would not work.
3. Carry out a personal information impact assessment for biometrics, covert monitoring and AI-based tools.
4. Adopt a written monitoring policy and an IT policy, and have employees acknowledge them.
5. Put up clear camera signage and update your employee privacy notice.
6. Set retention periods for footage, logs and biometric templates, and enforce deletion.
7. Sign operator agreements with security and software providers that meet POPIA’s requirements.
8. Consult employees or unions before introducing significant new monitoring, and check whether it affects terms of employment.
9. Train managers on who may access recordings and how to preserve evidence for investigations.

How O’Reilly Law can help

We advise employers on the lawful use of CCTV, biometrics and digital monitoring, draft monitoring, IT and privacy policies, prepare impact assessments and operator agreements, and assist with disciplinary processes that rely on monitoring evidence. We also help businesses respond to complaints and breach investigations by the Information Regulator.

Contact us to review your workplace monitoring practices.

Related reading: Data breaches under POPIA: what business owners must do · Information officers under POPIA and PAIA

This article is general information and not legal advice. Correct as at November 2026.