Who can see employee sick notes? What POPIA expects of HR files

Employee sick notes and medical certificates look like routine HR paperwork, but under POPIA they are health information, which the Act treats as special personal information. For an employer in South Africa the useful question is rarely what the policy says. It is who can actually open the folder, inbox or cabinet where those notes end up.

The question tends to reach HR managers and business owners in plain words: "Can my line manager see the doctor's note?" or "Who has access to the leave folder?" Regulations on the processing of health information were published in March 2026 and, as reported, name employers among the responsible parties they cover. Coverage so far has mostly summarised the rules. Less has been said about checking what happens to a sick note once it arrives.

What POPIA says about sick notes and medical certificates

Section 26 of POPIA lists health as special personal information and prohibits processing it unless an exception applies. Section 32 sets out the exceptions for health information, and employers appear among them for purposes such as supporting workers with sickness or work incapacity and applying laws or collective agreements. Section 32(2) adds a condition: the information may be processed only by people who are subject to an obligation of confidentiality, which can arise from employment, office, profession, a legal provision or a written agreement.

Section 19 sits underneath this and expects appropriate, reasonable technical and organisational measures against unlawful access to personal information. Read together, the sections point to one practical question. A policy line that says "HR only" is a statement. Whether confidentiality and safeguards exist where the notes are really kept is a fact that can be checked.

Where "HR only" and real access drift apart

The gap is rarely deliberate. As a hypothetical illustration, a policy may say that medical certificates are seen only by HR, while in practice an employee photographs the note and sends it to a line manager on WhatsApp, the scan is saved in a shared "Leave" folder that the whole department can open, and a payroll inbox is read by four people. A former employee's login may still work, and a printed copy may sit in a cabinet whose key is known to half the office. Nobody set out to make the policy untrue. It was written once and never compared with the folder, the inbox or the cabinet.

How a sick-note policy is tested against practice

The working method at Kevin Bishop Consulting treats a sentence such as "only HR can see medical certificates" as a claim to be tested, not a document to be tidied. Each claim is set against evidence: the list of people who can open the folder, where notes arrive, where copies are kept, and what the person who handles them does on a normal day. Where it is practical, the check is made on site, down to the cabinet and its key, because paper and phones sit outside any systems report. Each finding is scored before it is discussed, so the conversation starts from a ranked list of remediable starting points, not a verdict. It is the evidence-against-requirement discipline of an ISO 9001-style audit applied to personal information, and it suits a Johannesburg employer or a Gauteng school office as readily as a larger organisation.

A first check of who can open employee medical files

1. List every place a sick note or medical certificate can land: email, WhatsApp, a payroll or leave system, a shared drive, a paper file.
2. Ask whoever looks after your systems for the list of people who can open each of those places, including leavers, contractors and shared logins. The same access-list test is applied to cameras in CCTV policy and POPIA: does what happens at the camera match what the policy says?
3. Decide, with HR and counsel where needed, who needs to see what, then mark every name on the access list that is not on that short list.
4. Ask the people who receive sick notes what they do with them, and whether copies are forwarded, printed or kept on personal phones. Repeat the check whenever a system, a provider or a team changes.

For organisations that want a starting point on where they stand across both Acts, the POPIA/PAIA Readiness Snapshot is a desktop, self-reported readiness rating.

Related reading:

• CCTV policy and POPIA: does what happens at the camera match what the policy says?
• Is your POPIA privacy notice true? Checking a copied template against what really happens