Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (RICA)
Sections 4 and 5 — Interception of communications
“No person may intentionally intercept or attempt to intercept, or authorize, direct or procure another person to intercept or attempt to intercept a communication in the course of its occurrence or transmission, unless the interception is authorised by a court, or all parties to the communication consent.”
An employer may not intercept, read, or access live communications — WhatsApp messages, emails, phone calls — without consent from all parties or a court order. Accessing a message after it has been received on the device is different from interception, but POPIA still applies to how that information is processed.
Protection of Personal Information Act 4 of 2013 (POPIA)
Section 11 and Section 14 — Lawful processing of personal information
“Personal information may only be processed if the data subject consents to the processing; processing is necessary to carry out actions for conclusion or performance of a contract; or processing complies with an obligation imposed by law on the responsible party.”
Even on a work device, personal messages are personal information under POPIA. An employer who reads, stores, or acts on personal communications without a lawful basis (policy disclosed in advance, consent, or legal obligation) is processing personal information unlawfully. Employees must be informed of any monitoring policy before employment or as soon as practically possible.