Most Recent Publications


POPIA and the disclosure of an employee’s vaccination status

By Imraan Mahomed, Director, Jordyne Löser, Associate and Yusuf Omar, Candidate Associate, Employment, Cliffe Dekker Hofmeyr


The Protection of Personal Information Act 4 of 2013 (POPIA) provides for the protection of personal information processed by public and private bodies. Whilst POPIA defines personal information, it also creates another category termed ‘special personal information’.


POPIA defines ‘personal information’ as information relating to: Living natural persons and existing juristic persons. This includes information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person. Aspects such as criminal and employment history, physical address, telephone numbers and biometric information are also included under the definition.


Any form of ‘personal information’ may only be processed where:

  • a person has provided consent;

  • it is necessary for the conclusion of a contract;

  • it is imposed by a law;

  • it protects a legitimate interest of the person;

  • it is required for the performance of a public law duty by a public body; or

  • it is needed for pursuing the legitimate interest of the responsible party.


The word ‘process’ is widely defined in POPIA to include: Collection, collation, storage and retrieval of information.


Section 26 of POPIA prohibits the processing of ‘special personal information’. Given the sensitive nature of this information, this is a special category which attracts a higher degree of protection. This information relates to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information. Also included in this category is information relating to the alleged commission of any offence or any proceedings in respect of any offence allegedly committed and the outcome of such proceedings. In the absence of consent, processing ‘special personal information’ is prohibited.


However, in terms of section 27 of POPIA, there are a few instances where consent will not be required. This includes instances where the processing of such information is necessary by law and when such information is needed for historical, statistical or research purposes that serve the public interest. The exceptions to the prohibition of processing ‘special personal information’ are limited compared to the exceptions to the prohibition of processing ‘personal information’.


When South Africa gets to the point of vaccinations, the question of whether an employee or applicant for employment has been vaccinated will arise. There are many reasons why an employer may legitimately require such information. So, can an employer require that an employee disclose their vaccination status? Can employees object to the request?


There is likely not to be any law which will require that employees disclose their vaccination status. As an inoculation will be a voluntary act (assuming there to be no mandatory policy in a workplace), this means the issue will be regulated by the law of privacy and obviously POPIA. The same would apply in the instance of the imposition of a mandatory vaccination policy in the workplace. An employee’s vaccination status would constitute ‘special personal information’. 


This aside, as part of the pre-planning by an employer on the application of a vaccine policy, during the consultation phase, this is also an important topic to be raised in consultation with employees.  Under POPIA this information should not be retained for longer than is necessary for achieving the purpose for which the information was collected. Planning around this subject would require input and direction of the Information Officer and Human Resources.


For more information please contact Imraan Mahomed at  or Jordyne Löser at 


Article published with the kind courtesy of Cliffe Dekker Hofmeyr








Courses and Workshops




Basic Labour Relations

13 May 2021 (09:00 - 16:00)

Interactive Online Course

POPIA: Protection of Personal Information Act

14 May 2021 (09:00 - 12:00) (Fully Booked)

Interactive Online Course

28 May 2021 (09:00 - 12:00) (Fully Booked)

Interactive Online Course

04 June 2021 (09:00 - 12:00)

Interactive Online Course

Managing Poor Performance/ Incapacity

20 May 2021 (09:00 - 12:00)

Interactive Online Course

The OHS Act and the Responsibilities of Management

20 May 2021 (08:30 – 16:00)

Interactive Online Course

AARTO and the Impact on Your Business

21 May 2021 (09:00 - 12:00)

Interactive Online Course

Management and Leadership Skills

26, 27 & 28 May 2021 (08:30 - 16:00)

Interactive Online Course

Managing Day to Day Issues/ Problem Employees Full day workshop

27 May 2021 (09:00 - 16:00)

Interactive Online Course

Employment Equity Committee Training

28 May 2021 (09:00 - 16:00)

Interactive Online Course

COVID-19 Workplace Compliance Health, Safety and Claims Management Course

03 & 04 June 2021 (08:30 - 13:00)

Inter active Online Course

Health and Safety Representative and Committee Training Course

10 June 2021 (08:30 - 16:00)

Interactive Online Course


 Our Clients 


Android App On Google Play

Android App On Google Play