Sava Logo

South Africa Background Check Planner

You have picked a candidate in South Africa and you are about to make an offer. This planner works out which pre-employment checks the role actually justifies, what each one is allowed to rest on under South African law, how long each one really takes, and what to send the candidate. Free, no signup, and nothing you enter leaves your browser.

Written for the employer hiring from outside South Africa, where the checks are unfamiliar, the bodies that run them are unfamiliar, and the timelines are longer than anyone expects.

Describe the role

Ten questions. Nothing you enter leaves your browser, and there is no signup.

How are you engaging them?

Not sure which one you have? Run the classification checker first, because the answer changes more than this page.

Your verification plan

5 checks to run, in parallel rather than one after another. The schedule is set by the employment reference checks, so start that one the day the candidate accepts.

5

checks in this plan

2 wks

planning estimate to a safe start date

0

checks touching special personal information

  1. 1. Identity verification

    Essential
    Run by
    You, or an accredited South African verification bureau
    Planning estimate
    1 to 3 working days

    Legal footing. Ordinary processing under POPIA. You need it to know who you are contracting with, so it is necessary for the contract itself.

    Match the thirteen digit South African ID number to the name, date of birth and photograph on the document, and confirm the document itself is genuine. Every other check in this plan is keyed to that ID number, so run it first. A mismatch here is not an administrative problem, it is the whole file.

    Department of Home Affairs

  2. 2. Employment reference checks

    Essential
    Run by
    You, directly with the named former managers
    Planning estimate
    3 to 10 working days

    Legal footing. Ordinary processing under POPIA, with the candidate's consent to approach the referees they have named.

    Speak to the person who actually managed the work, not the company switchboard and not a friend listed as a manager. Confirm dates, job title, what the person was responsible for, and whether the referee would hire them again. Ask for the referee's work email address on the former employer's domain, and be suspicious when every reference routes through a personal address.

  3. 3. Company and tax verification

    Essential
    Run by
    You, against CIPC and SARS records
    Planning estimate
    1 to 5 working days

    Legal footing. Ordinary processing. This is business due diligence on a supplier rather than personal information about a job applicant.

    If the contractor invoices through a registered company or close corporation, confirm the entity exists on the CIPC register, that it is in business rather than deregistered, and that the person you are dealing with is a director or member. Ask for the income tax reference number, and for a VAT number if they are charging you VAT. A contractor who cannot produce a tax number is a contractor whose classification you should look at again before you sign anything.

    CIPC company search

  4. 4. Bank account verification

    Essential
    Run by
    You, before the first payment run
    Planning estimate
    1 to 3 working days

    Legal footing. Ordinary processing, necessary to perform the contract.

    Confirm the account holder name on the bank account matches the person or the company you contracted with, using a bank confirmation letter rather than a typed line in an email. Payment redirection fraud does not target your systems, it targets the moment a new supplier sends banking details, and it is far more common than a candidate faking a degree.

  5. 5. Cross border transfer safeguard

    Essential
    Run by
    You, with whoever holds your contracts
    Planning estimate
    3 to 10 working days

    Legal footing. Section 72 of POPIA restricts sending personal information about a South African data subject outside the country. You need the recipient to be bound by a law, binding corporate rules or a binding agreement that provides an adequate level of protection, or you need another section 72 ground such as the candidate's consent or necessity for the contract.

    This is the one every international employer misses, because the moment a candidate emails you an ID copy the transfer has already happened. The practical fix is small: put a data processing clause into the contract with your recruiter and your verification bureau, name in the consent form where the documents will be stored and for how long, and delete the identity documents of candidates you did not hire. Collecting less is the cheapest compliance available to you, and POPIA's minimality condition asks for exactly that.

    POPIA, Act 4 of 2013

Consent wording for this plan

Built from the checks above. Have a South African employment lawyer read it once before you use it on a real candidate, then reuse it.

Consent to pre-employment verification

I confirm that I have read this form and that I consent to the checks listed below. I understand the purpose of each one, and I understand that I may withdraw this consent in writing at any time, in which case the process may not be able to continue. I consent to the following: confirm your identity against South African government records; contact the referees and former employers you have named; and store and process your documents on systems outside South Africa.

I understand that the information collected will be used only to assess my suitability for this role, that it will be kept for no longer than is necessary for that purpose, and that I may ask what information is held about me and ask for it to be corrected.

Full name:
South African ID or passport number:
Signature:
Date:

The email to send the candidate

Asks for exactly the documents your plan needs, and nothing else. Collecting less is the cheapest compliance available to you.

Subject: Next step on your application, and what we need from you

Hi [name],

Thank you for the time you have given us so far. Before we can make an offer we run the same set of verification checks on every candidate for this role. Nothing here is a signal that anything is wrong, it is simply the process.

Attached is a consent form. Please read it, sign it, and send it back. Alongside it, please send:

1. A clear copy of your South African ID document or card, or your passport
2. Your company registration number, income tax reference number, and VAT number if you are registered
3. A bank confirmation letter from your bank, showing the account holder name
4. Two former managers we may contact as references, with their work email addresses

Some of these checks are handled by outside bodies and are slower than we would like, so please send everything through as soon as you can. Allowing for the slowest of them, we are planning on about 2 weeks from the day we receive your documents.

Our company is based outside South Africa, so your documents will be stored on our systems abroad. The consent form sets out where, and how long we keep them. If you would rather ask about that first, please do.

If anything in here raises a question, reply and ask. We would far rather answer it now.

Best,
[your name]

Skip most of this list

Every check above exists because you are hiring a stranger. Hiring through HireSava means you are talking to South African professionals who are already on the platform, with a profile and a work history you can see before you ever ask for a document.

Create an employer accountBook a hiring consultation

Why this is harder from abroad than it looks

Hiring a South African is not hard. Verifying one from ten thousand kilometres away is a different exercise, and it goes wrong in a predictable way. An employer in Austin or London runs the process they know: ask for a CV, take up two references, order a background check from the vendor they already use, and set a start date three weeks out. Two of those four steps do not work as expected in South Africa, and the third quietly puts the company on the wrong side of a data protection statute it has never read.

The first thing to understand is that verification in South Africa is not one product bought from one vendor. It is a set of separate submissions to separate bodies, each with its own process and its own queue. Identity sits with the Department of Home Affairs. Criminal records sit with the South African Police Service. Degrees and diplomas sit with the South African Qualifications Authority. School leaving certificates sit with Umalusi. Professional standing sits with whichever council governs the profession. Credit information sits with registered bureaus under a statute that limits when they are allowed to hand you anything at all. A verification bureau will bundle these for you, and a good one is worth the fee, but the bundle does not collapse the queues.

The second thing is that the timelines are set by the slowest item, and the slowest item is almost always the police clearance certificate. This is the single most common reason a South African hire starts later than planned. It is not a paperwork problem you can escalate your way out of. Plan around it: ask for it the day the offer is accepted, pay for it, and run everything else in parallel while it works through the queue.

The third thing is the one that catches companies with otherwise careful legal functions. The Protection of Personal Information Act applies to the processing of personal information about a person in South Africa, and it does not stop at the border of the country or the border of your incorporation. The moment a candidate emails you a copy of an identity document, you are processing their personal information and you have transferred it out of South Africa. Section 72 governs that transfer and asks you to have a basis for it. This is not an expensive problem to solve, but it is an embarrassing one to discover during a due diligence exercise two years later.

Special personal information, and why the phrase matters

POPIA sorts personal information into two tiers. Ordinary personal information can be processed where you have a lawful ground and you stay inside the eight conditions the Act sets, including collecting only what is adequate and relevant and not excessive for the purpose. Special personal information is a smaller category, and section 26 starts from a prohibition rather than a permission. Information about a person religious or philosophical beliefs, race, health, sex life, biometrics, trade union membership and criminal behaviour all sit in that category.

For hiring, the entry that matters is criminal behaviour. Section 27 sets out the grounds on which the prohibition lifts, and consent from the person is the first of them. There is a genuine technical argument in South African practice about the difference between criminal behaviour, which the Act names, and a record of a past conviction, which sits in the ordinary tier. Practitioners have written about the distinction and it is not frivolous. It is also not a foundation to build a hiring process on when the alternative is a paragraph in a form the candidate signs anyway. Get written consent, be specific about what you are checking and why, and the argument never has to be made.

Two habits follow from the same section of the Act and cost nothing. Ask for less: if a qualification is not a genuine requirement of the role, do not collect a certificate for it. And hold it for less time: delete the identity documents of candidates you did not hire, once the process is closed. Both are ordinary applications of the minimality and retention conditions, and both reduce the size of any problem you have later.

Five mistakes that cost real time

1. Starting the police clearance the week before the start date

The criminal record check is not slow in the way a form is slow. It is slow in the way a government backlog is slow, and no amount of chasing changes that. Every other check in a hiring plan can be finished in under a fortnight, which means the police clearance sets the start date on its own. Ask for it the hour the candidate accepts, pay for it yourself, and let the rest of onboarding run alongside it.

2. Sending a matric certificate to SAQA

SAQA and Umalusi verify different things and an application to the wrong one comes back rejected rather than redirected. Degrees, diplomas and higher certificates go to SAQA, which checks them against the National Learners Records Database. School leaving certificates go to Umalusi. Two minutes of care here saves two or three weeks of calendar time.

3. Treating a scanned certificate as verification

A scan is a picture of a claim. Certificate fraud is a real trade in every country that issues certificates, and a well made forgery survives a look on a screen without difficulty. If a qualification is a genuine requirement of the role, verify it with the issuing body. If it is not a genuine requirement, do not ask for it at all, because collecting information you have no use for is exactly what POPIA asks you not to do.

4. Running a credit check on a role that has nothing to do with money

The permitted purpose in the National Credit Act is narrow and specific. It contemplates a position that requires trust and honesty and entails the handling of cash or finances. A support agent, a designer or a writer does not meet it. Beyond the legal exposure, a credit report tells you about a persons past three years of financial circumstances, which in a country with the unemployment history South Africa has is a proxy for luck far more than it is a proxy for integrity.

5. Letting identity documents pile up in an inbox

The transfer of personal information out of South Africa happens the moment a candidate attaches an identity document to an email. Section 72 of POPIA is about that moment, and the fix is unglamorous: a data clause in the contract with whoever handles the documents, a line in the consent form naming where they will be stored and for how long, and a standing habit of deleting the documents of candidates you did not hire. Holding less is the cheapest compliance available.

What a verified file is actually for

It is worth being honest about what verification does and does not buy you. A verified file tells you that the person is who they say they are, that the qualification they claim exists, that they are registered where the job requires registration, and that the bank account you are about to pay belongs to them. That is a meaningful floor and it removes a category of risk that is otherwise invisible at a distance.

What it does not tell you is whether the person can do the work. No certificate predicts that, and no criminal record check predicts it either. The best available predictor is still a work sample: a paid, scoped, real piece of the job, done to a brief, reviewed against criteria you wrote down before you looked at the output. Run one. It is faster than the verification queue, it costs less than a bad hire, and it survives a fairness challenge better than a personality inventory ever will.

There is also a case for asking how much of this you need to run at all. Every check on this page exists because you are hiring a stranger who arrived through a channel that told you nothing about them. Hiring through a marketplace where South African professionals already hold a profile and a work history changes the starting point, without changing anything about the verification you still choose to do before a person touches your money or your customers.

Create an employer accountBook a hiring consultation

Questions employers ask

Can a foreign company run a background check on a South African candidate?
Yes. Nothing in South African law reserves pre-employment verification to local companies. What does apply to you is the Protection of Personal Information Act, because it follows the data rather than the company. If you collect an identity document, a qualification record or a criminal record about a person in South Africa, you are processing their personal information and the Act reaches you. In practice that means consent in writing, collecting only what the role genuinely needs, telling the candidate where the information goes, and putting a binding agreement in place before the documents land on a server outside the country.
How long does a South African background check take?
The plan as a whole is set by its slowest single check, because the checks run in parallel. Identity, bank account, professional registration and credit checks come back within days. Qualification verification through SAQA is published at around twenty five working days for national qualifications. The criminal record check is the one that breaks hiring timelines: the South African Police Service publishes a target on its own services page and has carried a notice about a backlog at the criminal record centre, so a police clearance certificate can take several weeks longer than the published target. Start that one on the day the candidate accepts, not the week before they are meant to begin.
Do I need consent to check a South African candidate criminal record?
Assume yes and get it in writing. POPIA classifies information about criminal behaviour as special personal information under section 26, which is prohibited from being processed unless one of the grounds in section 27 applies. Consent is the ground most employers rely on, and it is also the one candidates understand. There is a technical argument in South African practice that a record of a past conviction sits outside the section 26 category, but building a hiring process on that distinction is a poor trade when a signed consent form costs you nothing.
Who verifies a South African matric certificate?
Umalusi, the Council for Quality Assurance in General and Further Education and Training. This is the single most common wrong turn for employers hiring into South Africa for the first time. SAQA verifies qualifications recorded on the National Learners Records Database, which is where degrees and diplomas live. School leaving certificates are a separate system. Umalusi verifies the National Senior Certificate, the older Senior Certificate, the National Certificate (Vocational) and adult qualifications, covering certificates issued from November 1992. Send the wrong document to the wrong body and you lose weeks.
Can I run a credit check on a job applicant in South Africa?
Only for some roles. Section 70(2)(g) of the National Credit Act and its regulations allow a credit bureau to issue a report for the assessment of a candidate for employment, but the prescribed purpose is tied to a position that requires trust and honesty and entails the handling of cash or finances. A bookkeeper or an accounts payable clerk falls inside that. A copywriter, a designer or a customer support agent with no access to funds does not. If the role does not handle money, drop the check rather than looking for a way to justify it.
Are psychometric tests allowed when hiring in South Africa?
Yes, with conditions that bind you as much as they bind a local employer. Section 8 of the Employment Equity Act prohibits psychological testing and similar assessments unless the test has been scientifically shown to be valid and reliable, can be applied fairly to all employees, and is not biased against any employee or group. The Employment Equity Amendment Act 4 of 2022, in force from 1 January 2025, removed the separate requirement for certification by the Health Professions Council, but left the validity and fairness requirements untouched. Ask your vendor for the validity evidence and the South African norm group in writing before you administer anything, and prefer a work sample tied to the actual job.
Does a clean police clearance certificate mean the candidate has no history?
Not necessarily, and this is worth knowing before you treat a certificate as the last word. Section 271B of the Criminal Procedure Act allows a conviction to be expunged after ten years have passed, where the offence was minor, the sentence fell within the listed range, and there has been no further conviction in that period. An expunged record does not appear. This is deliberate policy rather than a loophole, and it is a reasonable argument for weighing an old minor conviction lightly in any case.
Should I use a verification bureau or run the checks myself?
Split it. Identity, references, professional registration, company registration and bank confirmation you can run yourself in an afternoon, and doing them yourself gives you a better feel for the candidate than a report ever will. Criminal record checks, SAQA verification and Umalusi verification involve submissions to outside bodies, and an accredited South African bureau will handle them faster and with fewer rejected applications than a first attempt from abroad. Whichever route you take, the responsibility under POPIA stays with you as the party that decided to collect the information.
Is this background check planner free?
Yes. It is free, needs no signup, and nothing you enter leaves your browser. It builds a verification plan from the role you describe, tells you the legal footing for each check, flags any check that does not have a permitted purpose for your role, and generates consent wording and a candidate email you can copy straight out.

Sources

Every rule this planner applies traces to one of the following. Turnaround figures shown in the tool are planning estimates for scheduling a start date, not service guarantees, and the bodies below publish their own current positions. This page is general information about a hiring process and is not legal advice for your situation.

Related tools and guides