Hiring the wrong person can be costly. A bad hire can expose a business to fraud, theft, safety risks, reputational damage, and significant financial loss. For roles that involve handling money, driving company vehicles, working with vulnerable people, or accessing sensitive information, the stakes are higher still. This is why employee screening has become a standard part of responsible hiring in South Africa.
Two of the most important checks an employer can run are the criminal record check and the driver's licence verification. This guide explains what each check involves, how to conduct them lawfully, and how to ensure your screening process complies with South Africa's Protection of Personal Information Act (POPIA).
This article approaches criminal screening from the employer's perspective, as part of a hiring process. For a fuller treatment of criminal screening as a discipline, including the difference between database-level and fingerprint-based checks and how criminal screening intersects with FICA obligations, refer to our guide: What is Criminal Background Screening?
Is Employee Screening Legal in South Africa?
Employee screening is entirely legal in South Africa, provided it is conducted in compliance with POPIA and the country's labour legislation. There are, however, three principles that every employer must observe.
The first principle is consent. Conducting a background check without the explicit, written consent of the candidate is prohibited under POPIA. Employers must obtain that consent before initiating any screening, and the purpose of the check must be clearly communicated to the candidate in advance. Consent carries particular weight for criminal record checks, because information about a person's criminal behaviour is classified as special personal information under section 26 of POPIA and may only be processed where a statutory gateway, such as consent, applies.
The second principle is job relevance. Any screening conducted must be relevant to the inherent requirements of the specific role. POPIA requires that personal information collected be adequate, relevant and not excessive, which means a criminal record check is defensible for a candidate who will handle cash, while a credit check on a candidate applying for a non-financial role is much harder to justify. The same principle constrains more invasive forms of assessment. Polygraph testing is not regulated by statute in South Africa, but an employer cannot compel a candidate or employee to submit to one, and South African arbitrators and courts have consistently held that a polygraph result cannot on its own justify a dismissal. Employers are therefore advised to avoid treating polygraph testing as a screening tool.
The third principle is data minimisation and security. Employers may collect only the personal information that is necessary for the stated purpose, must store it securely, and must retain it only for as long as it is needed. Candidates retain their POPIA rights throughout, including the right to access their information, to correct inaccuracies, and to object to processing.
Do Accountable Institutions Have Extra Screening Obligations?
For most employers, screening is a matter of good practice. For businesses designated as Accountable Institutions under the Financial Intelligence Centre Amendment Act (FICA), it is also a legal obligation.
Directive 8, issued by the Financial Intelligence Centre on 31 March 2023 and supported by Public Compliance Communication 55, requires Accountable Institutions to screen prospective and current employees for competence and integrity, and to scrutinise employee information against the targeted financial sanctions lists. Screening must be risk-based, must continue throughout employment rather than stopping at the point of hiring, and must be documented in the institution's Risk Management and Compliance Programme. The Financial Intelligence Centre recommends screening employees in higher-risk roles at least annually.
If your business falls into this category, the screening process described in this guide needs to be written into your compliance documentation rather than simply followed in practice. Refer to our guides: What is an Accountable Institution? FICA Obligations Unpacked and What is a Risk Management and Compliance Programme (RMCP)?
What is a Criminal Record Check?
A criminal record check confirms whether a candidate has a criminal record in South Africa. It is the most common background check conducted by South African employers.
Criminal records are held by the South African Police Service (SAPS) Criminal Record Centre. The authoritative way to query them is by matching a candidate's fingerprints against the SAPS database of all known convicted persons and persons with cases awaiting trial, submitted through the Automated Fingerprint Identification System (AFIS) via a SAPS-sanctioned platform such as AFISwitch. The check determines whether the individual has a previous conviction or a pending case.
It is important to understand what a criminal record check does and does not reveal. The check returns information only where a candidate has been convicted of a crime or has a pending case in South Africa. A candidate with no record receives a result indicating that no illicit activity was identified. Where a match is found, SAPS generates a report known as the SAPS69, which can include the full name, identity number (or passport number for a non-South African), the charge, the case number, the date and location of the offence, the sentence handed down, and the sentencing date. The SAPS69 takes considerably longer to produce than the initial electronic result, so employers should plan for that delay rather than assume a same-week outcome.
Criminal Record Check vs Police Clearance Certificate: What is the Difference?
A common point of confusion is the distinction between a criminal record check and a Police Clearance Certificate (PCC). The two serve different purposes and should not be used interchangeably.
A criminal record check, conducted electronically through AFIS, is the standard check used for employment screening, for obtaining a Professional Driving Permit, and for registration with regulatory bodies such as the Private Security Industry Regulatory Authority (PSIRA). It is fast and well suited to hiring decisions.
A Police Clearance Certificate is a more formal document issued directly by SAPS. It is primarily required for overseas travel, emigration, visa applications, and immigration purposes. A PCC typically takes several weeks to process and is generally not necessary for routine employment screening. Employers screening candidates for South African roles should, in almost all cases, use a criminal record check rather than a PCC, and should not hold up a hiring decision waiting for one.
How to Conduct a Criminal Record Check in South Africa
Conducting a criminal record check correctly involves four clear steps.
Step 1: Obtain Written Consent
Before any check is initiated, the candidate must provide explicit written consent. This consent should clearly state the type of check being conducted and the purpose for which it is being performed. Without it, the check is unlawful under POPIA, regardless of the employer's intentions. Where fingerprints will be captured, the consent should cover that too, because biometric information is also special personal information under POPIA.
Step 2: Choose the Right Level of Check
There are two levels of criminal screening available in South Africa, and they are not interchangeable.
A database-level check uses only a candidate's South African identity number and full name to screen South African criminal databases, returning a binary indicator: either no illicit activity was found, or a possible illicit result was returned. It is fast, requires no physical attendance, and can be run in bulk across an entire workforce, which makes it well suited to a first-pass screen. Because it matches on identifiers that can be shared, stolen or fabricated, and because it does not disclose what offence was involved, the result is an indicator of risk rather than a confirmation of it. It should never be the sole basis for a hiring decision.
A biometric fingerprint check requires the candidate's fingerprints to be captured electronically by a trained operator using an accredited device, along with their original identity document. Because fingerprints cannot be borrowed or misrepresented, this is the authoritative check, and it is the level required wherever a confirmed result matters.
The practical approach is to use them in sequence rather than choosing between them. Screen broadly at database level, then confirm any possible illicit result, and any high-trust role, with a fingerprint check. For a fuller explanation of both levels and how to interpret their results, refer to our guide: What is Criminal Background Screening?
Step 3: Submit the Check
A database-level check is submitted electronically and returns a result without the candidate needing to attend anywhere.
A fingerprint check is submitted through AFIS to the SAPS Criminal Record Centre once the prints have been captured. Turnaround times vary by service level and by the quality of the prints captured. Priority services can return a result within a few hours, standard services typically within 24 to 48 hours, and a national network of capture providers means candidates can usually complete fingerprinting locally rather than travelling.
Step 4: Interpret the Results
A clear result indicates that no criminal record was found. Where a match is identified, the employer must interpret the result in the context of the role and the principle of job relevance. A conviction does not automatically disqualify a candidate, and the nature of the offence, its relevance to the role, and the time elapsed should all be considered. The candidate should be given the outcome and an opportunity to respond before any adverse decision is finalised, and the decision and its reasoning should be recorded.
Employers should also understand how long records persist. A criminal record does not expire on its own. Certain minor convictions "fall away" after ten years for sentencing purposes under section 271A of the Criminal Procedure Act, but the conviction remains visible on the SAPS database and will still appear on a check. Permanent removal requires a formal expungement under section 271B, applied for through the Department of Justice and Constitutional Development. This means old, minor convictions will surface, and the correct response is proportionate assessment rather than automatic exclusion.
How to Verify a Driver's Licence in South Africa
For any role that involves driving, whether operating a company vehicle, making deliveries, or transporting passengers, verifying a candidate's driver's licence is an essential screening step. A driver's licence verification confirms that a candidate genuinely holds a valid licence of the class they claim, and that the licence has not expired.
Driver's licence verification in South Africa draws on the electronic National Administration Traffic Information System (e-NATIS), the national database of registered drivers and vehicles. A verification is run using the candidate's South African identity number and full name, and returns the licence number, the date the licence was issued, the expiry date, and the licence code.
The licence code is the detail that matters most for hiring, because it defines what the holder is actually permitted to drive. A code B licence covers light motor vehicles, while codes such as C1 and EC1 cover heavier vehicles and articulated combinations. A candidate who holds a valid licence of the wrong class is not authorised to operate the vehicle the role requires, and confirming the code closes a gap that a simple "does this person have a licence" question leaves open.
For roles that involve professional driving, such as operating a truck or bus, carrying paying passengers, or transporting dangerous goods, a Professional Driving Permit (PDP) is a separate legal requirement, and a standard driver's licence is not sufficient. A PDP is endorsed on the licence card and should be confirmed alongside the licence verification. Because a PDP application itself requires a criminal record check, the two screening steps in this guide are directly connected for professional driving roles.
Verifying the licence, its class, and the PDP protects the employer from the legal and safety consequences of allowing an unlicensed or improperly licensed person to drive on the business's behalf, and from the insurance exposure that follows an accident involving a driver who was never properly authorised.
Other Employment Screening Checks to Consider
While criminal record and driver's licence checks are among the most common, a comprehensive screening process often includes several additional verifications, each tailored to the requirements of the role.
Identity verification confirms that a candidate is who they claim to be, by verifying their identity against the Department of Home Affairs (DHA) records. This is the foundation of any screening process, because every other check depends on the candidate's identity being genuine in the first place. For a detailed explanation of how identity verification works, refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?
Qualification verification confirms that a candidate genuinely holds the degrees, diplomas, and certifications listed on their CV. Employment history and reference checks confirm a candidate's previous roles, tenure, and responsibilities. Credit checks may be appropriate for roles that involve financial responsibility, although their use must be carefully justified against the job relevance principle.
Certain sectors require specific statutory checks. Roles in the private security industry require PSIRA registration verification. Roles in education require South African Council for Educators (SACE) verification, as well as a check against the National Register for Sex Offenders for any position involving contact with children. Roles in finance, compliance, and other regulated industries may require sanctions and Politically Exposed Person (PEP) screening. For a detailed explanation of these screening components, refer to our guide: What is AML Screening? PEP, Sanctions & Adverse Media Explained.
Employee Screening and POPIA Compliance: Best Practices
Conducting employee screening lawfully requires more than simply running checks. It requires a documented, defensible process that respects candidate rights at every stage.
Employers should obtain clear written consent before any check, specifying exactly which checks will be conducted and why. They should screen only for what is relevant to the role, avoiding the temptation to gather more information than the position requires. They should store all personal information securely, restrict access to it, and retain it only for as long as is necessary. They should also give candidates the opportunity to respond to any adverse findings before a hiring decision is made, particularly where a criminal record check returns a result that may affect the outcome.
One further point applies to any business that screens on behalf of others rather than for its own hiring. Under section 57 of POPIA, processing information about criminal behaviour on behalf of third parties requires prior authorisation from the Information Regulator. This does not affect an employer screening its own candidates, but recruitment agencies, outsourced HR providers, and group service companies screening for other entities should confirm their position before they begin.
A well-documented screening process protects the business in two directions at once. It reduces the risk of a bad hire, and it demonstrates POPIA compliance in the event of a complaint or a regulatory query.
Employee Screening Solutions for South African Businesses
As South Africa's leading provider of world-class identity verification, screening, and due diligence solutions, ThisIsMe gives employers the tools they need to screen candidates quickly, accurately, and in full compliance with POPIA. From database-level criminal risk screening and nationwide biometric fingerprint checks against SAPS criminal databases, to e-NATIS driver's licence verification, identity verification, and sanctions screening, our suite of solutions helps businesses make confident, well-informed hiring decisions while protecting candidate privacy. To experience our full range of screening and verification solutions and find out how we can serve your business, contact our team here.
