POPIA Explained for HR Managers: What You Need to Know About Biometric Attendance

POPIA Explained for HR Managers: What You Need to Know About Biometric Attendance

POPIA can feel like legal language until an HR manager has to apply it on a Monday morning. An employee asks, “Who can see my clocking photo?” A new hire wants to know what happens to their facial data when they leave. Suddenly, the Act is no longer theoretical. It is a practical question sitting in your inbox. For HR teams using biometric attendance systems like faceATT, understanding POPIA is not just about compliance. It is about knowing what data you collect, why you collect it, who can access it, how it is protected, and what happens to it over time. Here is what POPIA means for HR managers, in plain language. Why biometric data receives special protection Under the Protection of Personal Information Act (POPIA), biometric information is classified as special personal information.

That places it in a higher category of protection than ordinary personal information such as a name or email address. For HR teams, this matters because facial recognition data used for attendance needs to be handled with appropriate safeguards and a clearly defined purpose. The system you use should therefore not only record attendance. It should also support responsible handling of the biometric and personal information involved. Who is responsible; the employer or faceATT? One of the most important things for HR managers to understand is the distinction between the organisation using the system and the technology provider operating it.

As the employer, your organisation is generally the responsible party for determining why and how employee information is processed. That means your organisation is responsible for matters such as:

•  Establishing the purpose for collecting attendance information
•  Communicating the processing of personal information to employees
•  Managing the appropriate lawful basis for processing
• Controlling internal access to employee information
• Managing employee data throughout the employment lifecycle faceATT, built by R8CODE, acts as the operator processing attendance information on your organisation’s instructions.

In simple terms, your organisation determines the purpose and rules for processing the data, while faceATT provides the technology to carry out that processing.

Using a software provider does not remove the employer’s own responsibilities under POPIA. What does consent mean in practice? Biometric information requires a lawful basis for processing under POPIA. For HR teams, this means you should not treat employee consent as a box to tick without understanding what you are actually communicating to employees. Your organisation needs to establish the appropriate lawful basis for processing biometric information and ensure employees receive the necessary information about how their data is being used. Where consent is the lawful basis relied upon, the employer manages that consent relationship with its employees. faceATT processes the information based on the organisation’s instructions and does not replace the employer’s responsibility for establishing and documenting its lawful processing practices.

What do security safeguards look like in practice? POPIA compliance is not only about having a privacy policy on paper. It also involves how personal information is protected in the systems and infrastructure used to process it. For faceATT, security measures include:

• Encryption in transit using HTTPS/TLS
• Encryption at rest for clocking images stored in object storage
• Web application firewall protection, with intrusion prevention and detection at the network edge
• Hosting on R8CODE’s infrastructure in South Africa
• Controlled and restricted access to the system and stored information These safeguards form an important part of protecting employee information.

They do not replace your organisation’s own security responsibilities, including appropriate internal access controls, policies, procedures, and employee awareness. What can employees see? POPIA gives individuals rights regarding their personal information, including rights relating to access and transparency. With faceATT, employees can view their own clocking images where images are captured, as well as their attendance history within the application.

Employers can also access clocking images through the attendance registry, subject to the organisation’s access controls and legitimate operational requirements. This visibility serves two purposes. It supports transparency around how attendance information is being recorded, while also helping employees understand what information is associated with their attendance records. What happens to the data when an employee leaves? Retention is an important part of responsible personal information management. Employee data should not simply remain in a system indefinitely without a purpose. With faceATT, data remains available while the account is active.

Data can be deleted when required, and specific records can also be requested for deletion by contacting R8CODE. When an employee leaves the organisation, HR should consider its retention requirements, applicable legal obligations, and internal data-retention policies when determining what information should be retained or deleted. Similarly, when the organisation’s relationship with faceATT ends, relevant data can be deleted in accordance with the applicable process. A closer look at facial recognition data There is an important distinction between a clocking image and the biometric information used for facial recognition. The facial recognition process uses biometric data to help identify an employee for attendance purposes.

The resulting biometric template is designed for recognition rather than functioning as a conventional photograph that can simply be reconstructed into the employee’s face. At the same time, clocking images may be retained as an auditable record of the attendance event, depending on how the system and organisation are configured. That distinction matters because HR teams need to understand exactly what information is being processed, what purpose each type of data serves, and how long it is retained. What should HR managers do? Using a biometric attendance system does not automatically make an organisation POPIA-compliant.

Your technology is only one part of the picture. HR managers should also make sure that their organisation:

1. Knows what personal and biometric information is being collected.
2.  Has a clearly defined and legitimate purpose for processing it.
3. Establishes the appropriate lawful basis for processing.
4. Communicates the relevant information to employees.
5. Restricts access to authorised personnel.
6. Has appropriate retention and deletion practices.
7. Maintains appropriate internal POPIA policies and procedures.
8. Understands the responsibilities of both the employer and technology provider. The goal is not simply to collect attendance data securely. It is to build an attendance process that is secure, transparent, and responsible from the moment an employee clocks in to the moment their data is no longer needed.

The takeaway For HR managers, POPIA and biometric attendance do not have to be complicated. The key is understanding who is responsible for what. Your organisation manages the employee relationship and determines the purpose and lawful basis for processing. faceATT provides the technology to process attendance information on your instructions. With appropriate security controls, employee visibility, controlled access, and sensible data-retention practices, biometric attendance can be integrated into an organisation’s HR processes with privacy and data protection in mind. Good attendance management should not come at the expense of employee privacy. This article is intended for general informational purposes and does not constitute legal advice. POPIA compliance depends on your organisation’s specific circumstances, processing activities, policies, and lawful basis. Your organisation remains responsible for meeting its obligations as the responsible party, including applicable employee notices, consent or other lawful basis requirements, and Information Officer responsibilities. Consider consulting a POPIA-experienced legal or privacy professional to review your specific implementation.