-
The Salary Spreadsheet Just Went to the Whole Company: Data Breach Steps
⚡ Quick answer A salary spreadsheet sent to the wrong list is a data breach under POPIA — salaries are personal information, and unauthorised disclosure triggers the Act’s response duties. Contain it, assess it, notify the Information Regulator and affected staff where required, and fix the process that allowed it. It happens in one click: the payroll spreadsheet goes to ‘All Staff’ instead of the bookkeeper, or a laptop with unencrypted salary data disappears from a car. Under POPIA that is a data breach — a security compromise of personal information — and it comes with defined duties: contain, assess, notify, document, prevent. The employers who survive these incidents are…
-
CV Retention Rules: How Long May You Keep Job Applications?
⚡ Quick answer CV retention under POPIA comes down to purpose: keep an unsuccessful applicant’s CV only as long as the recruitment purpose justifies — typically three to twelve months with consent for a talent pool — keep hired employees’ records for the statutory employment periods, and securely destroy everything past its purpose. Every hiring round leaves a trail of CVs — in the inbox, in a shared drive, in a physical folder from the interviews. Under POPIA, CV retention is not an administrative afterthought: a CV is personal information, and keeping it ‘just in case’ is exactly what the Act’s purpose-limitation principle prohibits. The rules are simple once separated…
-
You Are the Information Officer by Default — Now What?
⚡ Quick answer Under POPIA, every organisation’s head is its information officer automatically — in a small company, that is you, the owner. You did not appoint yourself; the Act did. Your job is to register with the Information Regulator, take charge of compliance, and answer for it when things go wrong. Here is a job you already hold, whether or not anyone told you: if you run a South African company, you are its information officer under POPIA. The Act assigns the role to the head of the organisation automatically — no board resolution, no opt-out. For most small-business owners the discovery comes late, usually when a tender or…
-
POPIA Compliance for Small Business: The Eight-Point Checklist
⚡ Quick answer POPIA compliance for a small business comes down to eight moves: register your information officer, publish privacy notices, sign operator agreements, lock down security, set retention periods, prepare for access requests, plan for breaches, and train your staff. None of it requires lawyers on retainer — it requires doing the basics on paper. POPIA has no small-business exemption: if you hold an employee’s ID number, a customer’s email address or a CV in your inbox, the Act applies to you in full. The good news is that POPIA compliance for a small business is a finite, mostly free checklist rather than an enterprise programme. These are the…
-
Your First Employment Equity Plan: A Starting Guide for New Designated Employers
⚡ Quick answer An employment equity plan is a designated employer’s five-year roadmap for achieving equitable representation, built on workforce analysis and employee consultation. Plans adopted from 2025 run in the cycle 1 September 2025 to 31 August 2030. The Department inspects the process as much as the numbers — consultation records matter. Crossing 50 employees turns employment equity from background law into a document with your name on it. The employment equity plan is that document: a five-year commitment, refreshed annually, showing how your workforce will move toward equitable representation. First-time designated employers often stall here because the plan feels like a policy exercise; it is not — it…
-
The B-BBEE Affidavit: How Small Businesses Get a Free Level 1, 2 or 4
⚡ Quick answer A B-BBEE affidavit is a sworn statement that gives qualifying small businesses an automatic B-BBEE level without paying for verification. White-owned EMEs under R10 million turnover get Level 4; 51%+ black-owned get Level 2; 100% black-owned get Level 1. It is free, renewable annually, and accepted for most tenders. Somewhere along the line, ‘B-BBEE certificate’ became a thing small businesses believed they had to buy. For most, that is simply wrong. If your annual turnover is R10 million or less, the B-BBEE affidavit route gives you a recognised level — Level 4 at minimum, Level 1 or 2 with black ownership — for the cost of a…
-
Sector Targets and Small Business: What Actually Applies to You
⚡ Quick answer Employment equity sector targets are five-year numerical goals for race and gender representation at the top four occupational levels, set for 18 economic sectors. Published in April 2025, they bind designated employers only — businesses with 50 or more employees. Below that line, they do not apply to you. Few recent labour-law changes generated more panic than the sector targets published under the amended Employment Equity Act. Much of the panic missed the key fact: the targets apply to designated employers only — since January 2025, that means 50 or more employees. For the average small business the targets are background noise; for those above the line…
-
EE Reporting Deadline: Why 15 January Matters More Than You Think
⚡ Quick answer EE reporting happens once a year for designated employers: manual submissions close on 1 October, and online submissions through the Department’s portal close on 15 January. The EEA2 reports your workforce profile; the EEA4 reports pay differentials. Late or missing reports block compliance certificates and attract fines. Every January, designated employers queue for the same deadline: EE reporting season closes on the 15th for online submissions. It is one of those compliance dates that small and mid-sized employers discover late — usually when a tender asks for a compliance certificate that cannot be issued because a report was missed. Here is exactly who must report, what the…
-
The Designated Employer Test After 2025: Only the 50-Employee Line Counts
⚡ Quick answer A designated employer is now simply an employer with 50 or more employees. The turnover thresholds that used to pull smaller high-revenue businesses into the net were repealed on 1 January 2025. Count your headcount correctly, and you know exactly which Employment Equity duties are yours. Before 2025, answering ‘are you a designated employer?’ meant checking a schedule of turnover figures that changed by sector and crept up over time. The Employment Equity Amendment Act threw that out. Since 1 January 2025 there is one test — do you employ 50 or more people? — and everything else flows from it. Here is how to count properly,…
-
EE Amendments 2025: What Actually Changed for Small Employers
⚡ Quick answer The EE amendments to the Employment Equity Act took effect on 1 January 2025. The turnover test is gone — you are a designated employer at 50 or more employees, full stop — and five-year sector targets now apply to those who qualify. Under 50 staff, your duties stayed largely the same. If you employ people in South Africa, the EE amendments that commenced on 1 January 2025 quietly rewrote who carries the heavy Employment Equity duties. The headline change is a relief for most small businesses: the confusing turnover thresholds are gone, replaced by a single headcount line at 50 employees. But for those above the…
