POPIA and health data: what South African employers must know in 2026

Any workplace wellbeing programme that collects health data in South Africa has to work within the Protection of Personal Information Act (POPIA). In 2026 the rules became more specific. This is a plain-language overview, not legal advice.

Health data is special personal information

POPIA treats health information as special personal information. Processing it is prohibited unless a specific exception applies, such as the data subject's explicit consent.

For employers, that means health data cannot be handled like ordinary HR records. It needs a lawful basis, a clear purpose, and stronger protection.

The 2026 regulations

On 6 March 2026 the Information Regulator published the Regulations Relating to the Processing of Data Subjects' Health Information by Certain Responsible Parties, 2026, issued under POPIA. They came into effect on publication.

In broad terms, the regulations:

• give more detailed rules on how certain responsible parties, including employers, may process health information,
• aim to give data subjects more transparency about how their health information is used,
• reiterate that health information may only be transferred outside South Africa where POPIA's requirements for cross-border transfers are met,
• give the Information Regulator a clearer framework to monitor and enforce compliance.

What this means in practice

For any employer running or buying a wellbeing programme, the questions to ask are straightforward:

1. Is participation genuinely voluntary? Consent must be informed, specific and freely given. Employees should be able to decline or withdraw without consequence.

2. Who sees individual data? Health information should be visible only to the employee and the professionals supporting them, under a duty of confidentiality.

3. What does the employer see? Ideally only aggregated, de-identified information, with a minimum group size so no individual can be identified.

4. Where is data stored? If it leaves South Africa, the transfer must meet POPIA's requirements.

5. What is it used for? Health data collected for wellbeing must not be repurposed for performance management, discipline or hiring.

6. How long is it kept? Retention should be limited to what the purpose requires, with deletion on request or at contract end.

How Everis is built for this

Everis was designed with these principles from the start:

• Participation is opt-in and can be withdrawn at any time.
• Identity is stored separately from health data, and the Everis Engine works on pseudonymised IDs.
• Employers see aggregated, de-identified team data only, and nothing for groups smaller than 8 people.
• Individual data is visible only to the employee and, with consent, their Everis physiologist.
• Data is contractually prohibited from use in performance management, discipline, promotion or hiring.
• Encryption, role-based access and audit logs protect data throughout.

The bigger point

Compliance is the floor, not the goal. A programme that employees don't trust won't get honest participation, and without honest participation there's no useful data. Privacy-first design is what makes workforce health intelligence work at all.

This article is a general overview. Employers should take legal advice on their specific obligations. Full references on our Science page.