When an organisation conducts background screening on a potential employee, it collects some of the most personal information that individual will ever share with a prospective employer. Identity documents, criminal record results, qualifications, employment histories and reference reports may all form part of the process. Candidates provide this information trusting that it will be handled responsibly and protected against unauthorised access.
But how confident are employers that the digital platforms managing this information are genuinely secure?
On 26 October 2026, South Africa’s Information Regulator announced a R1 million administrative fine against First National Bank (FNB), following an investigation into the exposure of customer information through its digital home-loan application platform.
Although this incident involved banking customers rather than employment screening candidates, the lessons extend well beyond the financial services sector. Any organisation collecting, storing, or sharing personal information through a digital platform should question whether its security measures are adequate.
What happened at FNB?
According to the Information Regulator, its assessment identified shortcomings in how FNB recognised, classified, and responded to security incidents, as well as deficiencies in the technical and organisational measures intended to prevent unauthorised access to personal information.
The investigation also raised concerns about information retention and compliance with the security safeguards required under section 19 of the Protection of Personal Information Act (POPIA).
The Regulator identified a contravention involving section 105 of POPIA and issued an infringement notice imposing a R1 million administrative fine. This was a regulatory action, not a final court judgment.
For employers and screening providers, the important lesson is not simply the size of the fine. It is the Regulator’s emphasis on whether organisations can demonstrate that their systems and procedures provide meaningful protection for personal information.
The hidden risks within employee screening platforms
Employee screening has become increasingly digital. Candidates upload identity documents, complete consent forms and submit supporting information through online portals. Screening providers conduct verification checks, compile reports and make the results available to employers.
Technology has improved efficiency and turnaround times, but it has also introduced new responsibilities.
A single candidate’s record may contain an identity number, residential address, employment history, qualifications, criminal record information, and financial details. Depending on the checks performed, it may also include professional registrations and other sensitive information.
If access permissions are misconfigured, employees could view information unrelated to their responsibilities. If employer accounts are not properly separated, one organisation might gain access to another organisation’s candidate records. Former employees whose login credentials remain active could also present a security risk.
These are potential vulnerabilities, not allegations concerning any particular screening provider. They demonstrate why platform security must be treated as an operational priority rather than simply an IT function.
Who can access candidate information?
One of the most important questions employers should ask screening providers is who can access their candidates’ information.
Role-based access controls should ensure that individuals can view only the information necessary to perform their duties. An HR administrator may need access to screening progress, while a designated decision-maker may require the completed verification report.
The same principle applies within screening companies. Processing staff, administrators, account managers and technical support personnel have different responsibilities and should not automatically have identical access privileges.
Permissions should be reviewed regularly, particularly when employees change roles or leave an organisation.
Equally important is the ability to establish who accessed a record, when it was accessed, and what actions were performed. Reliable audit logs help organisations investigate suspicious activity and demonstrate accountability.
The question is no longer simply whether a screening platform requires a password. It is whether access is appropriately restricted, monitored and managed throughout the information’s lifecycle.
POPIA compliance requires more than a policy
Section 19 of POPIA requires responsible parties to implement appropriate, reasonable technical and organisational measures to protect the integrity and confidentiality of personal information.
These measures must address reasonably foreseeable risks and be maintained as circumstances change.
For screening platforms, this means incorporating information security into system design, access permissions, data storage, reporting processes and ongoing maintenance.
A POPIA policy may explain how information should be protected, but it does not prove that those protections are working.
Employers and screening providers should regularly test whether users can access information outside their authorised roles, whether inactive accounts are disabled and whether sensitive documents are protected during transmission and storage.
Technical safeguards must also be supported by staff training, clear accountability and practical incident-response procedures.
An organisation may have an impressive compliance framework on paper, but if employees cannot recognise or escalate a potential breach, that framework may provide little protection when something goes wrong.
What happens when information is exposed?
Section 22 of POPIA addresses the notification of security compromises. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible after discovering the compromise, subject to the Act’s notification provisions.
This makes prompt incident detection and effective communication essential.
A screening provider may be the first to identify suspicious activity, while the employer may be the responsible party for the candidate information being processed on its behalf.
Section 21 of POPIA also requires operators processing information for responsible parties to maintain appropriate security measures and notify the responsible party immediately where there are reasonable grounds to believe a security compromise has occurred.
Employers cannot assume that outsourcing screening automatically transfers all their POPIA responsibilities to the provider. Both parties need clearly defined obligations, effective communication channels and tested incident-response procedures.
The overlooked risk of retaining candidate information
Another important issue highlighted by the FNB findings was information retention.
In employee screening, personal information may be collected for a specific recruitment decision but remain stored in digital systems long after that decision has been made.
How long should an unsuccessful candidate’s information remain accessible? Should employers retain every supporting document after screening is completed? What happens to historical reports when a client terminates its relationship with a provider?
POPIA generally requires personal information not to be retained longer than necessary for its original purpose, unless a lawful basis for further retention exists.
Documented retention schedules, secure deletion procedures and restrictions on historical access should therefore form part of every screening process.
Keeping information indefinitely simply because a system can store it creates unnecessary exposure.
Five questions every employer should ask
Employers do not need to be technology specialists to ask meaningful questions about information security. They should, however, understand how they protect candidate information.
- Who can access our candidates’ information, and how do you prevent unauthorised users or other clients from viewing it?
- Are access permissions regularly reviewed, and can you identify who has viewed or downloaded a candidate’s record?
- What safeguards protect identity documents, verification reports and confidential information?
- How are security incidents identified, investigated, and communicated to our organisation?
- How long is candidate information retained, and what happens when the screening process or client relationship ends?
The answers should be supported by demonstrable controls and documented procedures rather than general assurances.
Screening protects employers, but who protects the candidate?
Background screening is an essential component of responsible recruitment. It helps employers verify information, identify relevant risks, and make better-informed hiring decisions. However, employers must conduct the screening process responsibly.
Candidates should not have to choose between allowing an employer to verify their credentials and protecting their personal information.
The FNB enforcement action reminds us that digital convenience does not remove an organisation’s responsibility to safeguard information.
For employers, this means evaluating screening providers on more than price, turnaround times and available checks. Information security, access management, retention practices and incident-response capabilities should form part of every supplier assessment.
For screening providers, protecting candidate information is just as important as delivering accurate verification results.
At iFacts, we believe effective employee screening should protect both the organisation making the hiring decision and the individual whose information is being verified.
The R1 million warning presents an opportunity for every organisation to review its practices before a security incident forces that review.
The question employers should be asking is not simply whether they have screened their candidates, but whether their candidates’ information is protected throughout the process.
Contact iFacts to discuss responsible employee screening, information-handling risks, and strengthening your background verification processes.
