Why this one is yours to do
The moment you write down somebody else's details — a customer's cellphone number, an employee's ID number and bank account — you are looking after information that belongs to them. POPIA, the Protection of Personal Information Act, calls you the responsible party for it. Worklog keeps those records safe for you, but the job of telling people what you hold and why sits with the business owner, not with the software.
It is a smaller job than it sounds. You have to tell each person, once and in plain words: what you keep, why you keep it, who else gets to see it, and how they can ask to see or fix it. No attorney, no ten-page policy. The two notices below cover almost every small business.
The notice for an employee
Copy the lines below into a WhatsApp message or an email, or print them and staple them to the employment contract. Change the bits in square brackets to your own. Give it to new people on their first day, and send it once to everyone already working for you.
- [Your business name] keeps some of your personal information because you work for us. Here is what we keep and why.
- What we keep: your name, ID number, address and phone number, your tax number, the bank account we pay your wages into, your pay, leave and advance records, and the hours or jobs you log.
- Why we keep it: to pay you and give you a payslip, to work out and pay over your PAYE and UIF (and SDL, if we are registered for it), and to keep the payroll records SARS and the labour laws require us to keep.
- Who else sees it: SARS and the Department of Employment and Labour, because we must submit it; the bank we pay you through; our bookkeeper or accountant; and Worklog, the app our records are kept in, which stores them securely on computers in Ireland and the United States.
- We do not sell your information, and we do not hand it to anybody else unless the law obliges us to.
- How long we keep it: while you work here, and your payroll records for five years after that, because SARS requires it. Details we stop needing when you leave, like your bank account, we clear out sooner.
- Your rights: you can ask to see everything we hold about you, ask us to correct anything that is wrong, and ask us to get rid of anything we no longer need. Ask [your name] on [your phone number or email]. If you are not happy with how we handle it, you can complain to the Information Regulator.
One line for your customers
Customers do not need all of that. You hold far less about them — a name, a number, an address, what they bought and what they paid — so one line on the paperwork does the job.
- For the foot of an invoice, quote or statement: "We keep your name and contact details to do the work, invoice you, and keep the records SARS requires. We never sell them. Ask us any time to see or correct what we have."
- For a booking form or a new-customer form, where you are asking for the details in the first place: "We use these details to contact you about your booking and to invoice you, and we keep them for our SARS records. We never sell them, and nobody sees them but us and the people who help us run the business — our accountant, and the app our records are kept in."
You do not have to retype it on every document. Open the Business Hub, tap Business details, and paste the line into "Default invoice terms". From then on it fills itself into the Terms & conditions of every new invoice and prints at the foot of the page. "Default quote terms", the box just above it, does the same for your quotes.
Keep less and there is less to explain
The easiest way to stay on the right side of POPIA is to hold less in the first place. Ask for what you actually use, and nothing more.
- Do not keep a photo of somebody's ID book or driver's licence "just in case". Capture the number you need for payroll and leave it at that.
- Do not photograph bank cards. A bank name and account number are all you need to pay a wage or a supplier.
- Remember the copies outside the app: old WhatsApp groups, a spreadsheet on your phone, photos of paperwork. That is personal information too, and it is the copy most likely to go missing.
When someone asks to see, change or delete their details
Anybody whose information you hold may ask what you have on them. Answer in writing and within a reasonable time; a month is the usual yardstick. The law does let you charge a small set fee for a copy, but for the few records a small business holds it is not worth the paperwork — just send it.
- Find them: a customer under Customers, a supplier under Suppliers, a worker under Payroll, then Staff Register.
- Open their record and read back what is actually there — the fields you filled in, nothing held back.
- Fix anything wrong or out of date while you are in there. Correcting it is their right too, and it saves you a second conversation.
- Note the date you answered and what you sent. A line in your diary, or the reply still sitting in the chat, is enough.
If they ask you to delete their details, delete what you no longer need — an enquiry that never became a job, a number on an old marketing list, a supplier you stopped using, or the ID number, address and bank account of somebody who left your employ years ago. Keeping a payslip does not mean keeping every detail around it. Where you still need the record, or the law says keep it, you are allowed to say no.
- Payroll records. The payslips, the pay you worked out, and the PAYE and UIF you declared: SARS requires five years, so a former employee cannot make you wipe them.
- Invoices, quotes and payment records. Same five years — these are your tax records, not only the customer's details.
- Anything still running. An unpaid invoice, an open job, or a dispute you are still busy with.
Say no plainly, and say why: "I have to keep your payslips for five years for SARS. Nothing else of yours is on file, and I will delete the payslips after that." A straight answer is what the law is after. Ignoring the request is what gets people complaining.