Learning platforms collect a surprising amount of personal information: names and contact details, employee and ID numbers, job roles, assessment scores, attendance, certificates and sometimes health-related information for safety training. The Protection of Personal Information Act, 2013 (POPIA) applies to all of it. This article sets out practical steps for handling training records responsibly.
Know what you collect, and why
POPIA requires personal information to be collected for a specific, explicitly defined and lawful purpose. Start by listing every field your LMS and training processes capture, and the purpose each one serves — for example, assigning compliance learning, issuing certificates or reporting on skills development.
- Remove fields that no longer serve a clear purpose.
- Avoid collecting ID numbers when an employee number will do.
- Be cautious with special personal information, such as health information captured for safety or medical fitness training; it carries stricter rules.
- Tell learners what you collect and why — usually through your privacy notice and the platform itself.
Limit access to those who need it
Not everyone who can log in to the LMS needs to see every learner’s results. Use roles and permissions so that managers see their own teams, administrators see what their job requires, and external audiences such as customers or contractors only see their own records.
Decide how long to keep records
POPIA says records should not be kept longer than necessary for the purpose they were collected for, unless the law, a contract or another lawful reason requires them to be kept. Training records often have legitimate reasons to be kept for a period — for example, as evidence of compliance or safety training, or for employment-related record-keeping obligations.
- 1List each type of training record you hold.
- 2Identify any legal or contractual requirement to keep it, and for how long.
- 3Set a retention period for each record type and document the reason.
- 4Configure the LMS, or a regular process, to delete or de-identify records when the period ends.
Your LMS vendor is an operator
When a vendor hosts or processes training records on your behalf, POPIA treats them as an operator. You remain responsible for the information, so you need a written agreement that requires the vendor to keep it confidential and secure and to tell you about any security compromise.
- Ask where data is hosted and whether it is transferred outside South Africa.
- If it is, confirm that the safeguards POPIA requires for cross-border transfers are in place.
- Check how backups, access logs and deleted records are handled.
- Confirm what happens to your data if the contract ends.
Plan for security incidents and requests
POPIA requires you to notify the Information Regulator and affected people when personal information has been accessed or acquired by an unauthorised person. Learners also have the right to ask what information you hold about them and to request corrections. Agree in advance who handles these situations and how the LMS supports them — for example, by exporting a learner’s records on request.