POPIA and Data Protection
How employee personal information is protected.
Lawful basis
Payroll processing is necessary to comply with obligations imposed by law — the Income Tax Act, UIF Act and BCEA. Employers remain the responsible party; Payroll Africa is the operator.
Data residency and encryption
Data is encrypted in transit and at rest. Access is scoped per company so no tenant can read another tenant's records.
Access requests and deletion
Employees may request a copy of their personal information. Payroll records must be retained for five years, so deletion requests are honoured after the statutory retention period.
Reporting a concern
See the Trust Centre for our security posture and disclosure contact.