Background checks: risk levels and compliance

SMART Access & Identity 2025 Access Control & Identity Management, Security Services & Risk Management


In South Africa, conducting background checks is a vital step in the hiring process for employers, or when engaging service providers. These checks help to confirm that candidates are trustworthy, skilled, and suitable for the organisation. However, it is crucial to understand the legal framework and regulations governing these checks to safeguard the employer and the candidate.

When evaluating candidates, it is important to categorise them based on risk levels associated with the position:

1. Low risk: Positions with minimal access to sensitive or financial information (e.g., entry-level roles).

2. Medium risk: Roles with some responsibility (e.g., administration, support staff).

3. High risk: Positions involving significant responsibilities (e.g., finance roles, childcare workers).

Conducting background checks by risk level

Risk and legal experts should concur when developing a background screening policy, which should be approved at the executive level.

Low-risk background checks

For low-risk positions, basic checks are often sufficient:

• Identity verification: Confirm the candidate’s identity using a South African ID document or passport.

• Employment verification: Contact previous employers to verify employment history.

• Criminal record check: You can request a criminal record check with the individual’s consent.

• Education verification: Verify any qualifications claimed.

Medium-risk background checks

Medium-risk roles may require a more thorough examination:

• All low-risk checks: Start with the checks mentioned above.

• Credit checks: For roles that involve financial responsibilities, get written consent from the candidate to conduct a credit check. This must comply with the National Credit Act and the Protection of Personal Information Act (POPIA).

• Reference checks: Obtain references from previous employers to gain insight into the candidate’s work ethic and behaviour.

• Skill assessments: Ensure the individual is capable of skills they claim to have.

High-risk background checks

High-risk positions require exhaustive background checks:

• All medium-risk checks: Include all checks from medium-risk assessments.

• Psychometric assessments: Consider conducting personality assessments to determine suitability for the role, integrity of the candidate, and a behavioural profile.

• Social media screening: While not mandatory, reviewing public social media profiles can provide additional insights into a candidate’s character.

Legal considerations in South Africa

1. Compliance with PoPIA: The Protection of Personal Information Act (PoPIA) governs how personal information is handled. Employers must ensure that:

o The candidate has consented to the background check.

o Personal information is processed lawfully, minimally, and only for necessary purposes.

o Job applicants are made aware of their rights concerning their personal information.

2. Fair treatment: Ensure all candidates are treated consistently and fairly during the background check process. Discrimination based on race, gender, or any other protected characteristic is illegal and can lead to legal consequences.

3. Inform candidates: If adverse information is found during a background check, employers must inform the candidate and provide them an opportunity to respond or clarify the information.

Conducting background checks in South Africa is essential for ensuring workplace safety and integrity. By tailoring the depth of these checks to the risk levels associated with different positions, employers can make informed decisions, while remaining compliant with South African laws. Understanding the regulations, obtaining consent, and treating candidates equitably are critical steps.

Implementing thorough yet fair background checks will create a safe and productive work environment that benefits employers and employees.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

“This Is Theft!” SASA slams Mafoko Security
News & Events Security Services & Risk Management Associations
The Security Association of South Africa (SASA) has issued a stark warning that the long-running Mafoko Security Patrols scandal is no longer an isolated case of employer misconduct, but evidence of a systemic failure in South Africa’s regulatory and governance structures.

Read more...
Making a mesh for security
Information Security Security Services & Risk Management
Credential-based attacks have reached epidemic levels. For African CISOs in particular, the message is clear: identity is now the perimeter, and defences must reflect that reality with coherence and context.

Read more...
What’s in store for PAM and IAM?
Access Control & Identity Management Information Security
Leostream predicts changes in Identity and Access Management (IAM) and Privileged Access Management (PAM) in the coming year, driven by evolving cybersecurity realities, hybridisation, AI, and more.

Read more...
Protecting citizens’ identities: a shared responsibility
Access Control & Identity Management
A blind spot in identity authentication today is still physical identity documents. Identity cards, passports, and driver’s licences, biometric or not, are broken, forged, or misused, fueling global trafficking networks and undermining public trust in institutions.

Read more...
The challenges of cybersecurity in access control
Technews Publishing SMART Security Solutions Access Control & Identity Management Information Security
SMART Security Solutions summarises the key points dealing with modern cyber risks facing access control systems, from Mercury Security’s white paper “Meeting the Challenges of Cybersecurity in Access Control: A Future-Ready Approach.”

Read more...
Access as a Service is inevitable
Technews Publishing SMART Security Solutions ATG Digital Access Control & Identity Management Infrastructure
When it comes to Access Control as a Service (ACaaS), most organisations (roughly 90% internationally) plan to move, or are in the process of moving to the cloud, but the majority of existing infrastructure (about 70%) remains on-premises for now.

Read more...
From surveillance to insight across Africa
neaMetrics TRASSIR - neaMetrics Distribution Access Control & Identity Management Surveillance Products & Solutions
TRASSIR is a global developer of intelligent video management and analytics solutions, delivering AI-driven platforms that enable organisations to monitor, analyse, and respond to events across complex physical environments.

Read more...
Securing your access hardware and software
SMART Security Solutions Technews Publishing RBH Access Technologies Access Control & Identity Management Information Security
Securing access control technology is critical for physical and digital security. Every interaction between readers, controllers, and host systems creates a potential attack point for those with nefarious intent.

Read more...
From friction to trust
Information Security Security Services & Risk Management Financial (Industry)
Historically, fraud prevention has been viewed as a trade-off between robust security and a seamless customer journey, with security often prevailing. However, this can impair business functionality or complicate the customer journey with multiple logins and authentication steps.

Read more...
Security ready to move out of the basement
AI & Data Analytics Security Services & Risk Management
Panaseer believes that in 2026, a board member at a major corporation will lose their job amid rising breaches and legal scrutiny, as organisations recognise that cyber risk is a business risk that CISOs cannot shoulder alone.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.