What does POPIA say about checking a candidate's public social media?
POPIA applies to a candidate's public social media posts as soon as an organisation collects them for a hiring decision. Personal information normally comes from the person themselves, but the Act allows another source in set cases, one being information the candidate deliberately made public (s12(2)(a)). Its other conditions for lawful processing still apply, summarised in the figure below.
Werksmans Attorneys wrote in January 2026 that most personal information stays protected even when it is visible online. The processing must be lawful and reasonable and must not infringe the person's privacy (s9). You also need a legal basis (s11): the candidate's consent, for example, or your legitimate interests as an employer, meaning a genuine hiring need the check serves. Where you rely on legitimate interests, the candidate may object on reasonable grounds.
Do you need a candidate's consent, or is telling them enough?
Consent is one of six legal bases in POPIA (s11), and an employer can screen a candidate's social media without it, for example on legitimate interests. Telling the candidate is a separate duty. You must take reasonably practicable steps to tell them what you collect, where from, why and who you are (s18). Where the circumstances call for it, also tell them they may object and may complain to the Information Regulator.
Research published by the University of the Western Cape in September 2025 found no clear provision in South African law that requires consent before an employer looks at an applicant's social media. Consent is still the safer route: the candidate knows about the check and can refuse. POPIA defines consent as voluntary, specific and informed (s1), and it also lets you handle sensitive details such as religion or health (s27).
One short paragraph on the application form can give the notice and ask for consent together. Say what you will check (their public social media), where (the platforms you will look at), for which role, who is checking, and that they may say no.
What may an employer look at, and what is off limits?
An employer may look at what a candidate has made public and what is relevant to the job. POPIA asks for a specific purpose defined first (s13) and only the information that purpose needs (s10). A check for a bookkeeping role gives you no reason to keep holiday photos.
Asking for a password puts the candidate in breach of Facebook's terms, effective January 2025, which forbid users to share their password or give anyone else access to their account. A private profile sits outside the exception for information deliberately made public. Using a fake profile is risky too: Pagel Schulenburg Inc. argues that a candidate who accepts a request without knowing who sent it has not given informed consent.
Sensitive details need the most care. POPIA calls them special personal information: religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information and criminal behaviour (s26). The ban on processing them lifts where the person deliberately made the information public (s27), but the Employment Equity Act still forbids unfairly rejecting a candidate on many of these grounds.
Source: Meta, Facebook Terms of Service, section 3.1, effective 1 January 2025
Source: Pagel Schulenburg Inc., “Pre-Employment Screening in the Social Media Age”, June 2019
Can you turn down a candidate because of a social media post?
A South African employer can turn down a candidate over a social media post only for a reason tied to the job. The Employment Equity Act forbids unfair discrimination on grounds that include race, sex, pregnancy, sexual orientation, age, disability, religion, HIV status, belief, political opinion, culture and language (s6). Job applicants have the same protection as staff (s9).
Treating people differently is not unfair where the job itself requires it, which the Act calls an inherent requirement of the job (s6(2)). In Sun International v Sayiti (October 2024), a split Labour Appeal Court found weekend work was an inherent requirement of a hospitality marketing manager's job. The company had first taken reasonable steps to accommodate his Sabbath.
If a rejected candidate alleges discrimination on a listed ground, the employer must prove that it did not take place as alleged, or that it is rational and not unfair, or is otherwise justifiable (s11). Record the job-related reason when you decide, and keep it with the post that prompted it.
Unpaid volunteers fall outside the Employment Equity Act, which defines an employee as someone who receives, or is entitled to receive, pay (s1). POPIA still applies to volunteers in full. The Promotion of Equality and Prevention of Unfair Discrimination Act covers unfair discrimination by private organisations outside employment, and a church or NPO is safest using the same job-related test.
Source: Employment Equity Act 55 of 1998, sections 1, 6, 9 and 11, acts.co.za (read November 2026)
Source: Pretoria News, “Religious beliefs and weekend work under legal lens”, October 2024
How long can you keep what a social media check found?
POPIA sets no fixed number of days for keeping social media findings. You may keep a record only as long as you need it for the purpose you collected it for (s14). You may keep it longer if a law or contract requires it, you reasonably need it for another lawful purpose, or the candidate agrees.
Once no reason remains, you must destroy or delete the record, or de-identify it so it can no longer be linked to the person, as soon as reasonably practicable (s14(4)). Before you start, set a deletion date that covers any reasonable need to answer a discrimination claim, then delete on that date.
Source: Protection of Personal Information Act 4 of 2013, section 14, popia.co.za (read November 2026)
What has the Information Regulator said about social media screening?
None of the Information Regulator's guidance notes deals with social media screening in hiring. Its website listed six notes in November 2026, covering direct marketing, elections, special personal information, children, COVID-19 and political parties' use of voters' information. POPIA's general conditions are what apply.
The University of the Western Cape research from September 2025 found the same gap: POPIA does not specifically address recruitment or social media, and the researcher recommends amending the Act to add rules for it.
This guide explains the law as written and is not legal advice. For a specific candidate or a screening policy, speak to an employment lawyer.
Source: Information Regulator (South Africa), Guidance notes (read November 2026)
