Direction 4(2) of the revised COVID-19 Direction on Occupational Health and Safety in the Workplace issued by the Minister of Employment and Labour and published on 1 October 2020 (Revised OHS Direction) introduces health data reporting obligations on certain employers.

We set out below answers to some important questions that employers may ask about this reporting obligation.

Who does it apply to?

All employers who employ more than 50 employees must submit a record of the employer’s risk assessment and written health and safety policy to the Department of Employment and Labour. Employers who employ more than 50 employees in a workplace have additional health data reporting obligations in terms of Direction 4(2).

This means that if, for example, an employer:

  • employs 100 employees in total, but these employees are spread evenly across five different offices/workplaces (with 20 employees in each office/workplace); or
  • ordinarily employs 100 employees in a workplace, but 60 of those employees are currently working exclusively from home; or
  • employs 100 employees in one workplace, but these employees are coming into work on a rotational basis, such that there are only 20 employees who come into the workplace each day;

then that employer will not be required to report in terms of Direction 4(2).

On the other hand, if for example, an employer employs:

  • 100 employees in one workplace, who are attending the office on an ad hoc basis and on any given day there could be more than 50 employees at the workplace; or
  • 30 employees in one workplace (workplace A) and 70 employees in another workplace (workplace B) who are all working at the workplace, as opposed to from home;

then in respect of the first scenario, the employer will be required to report in respect of all of its employees who are physically coming into the workplace from time to time; and in respect of the second scenario, the employer will be required to report in respect of the 70 employees in workplace B only (and not the 30 employees in workplace A).

This is because, as we understand it, the Direction is only intended to apply in condensed workplaces, where more than 50 employees are physically present in the workplace at the same time.

What information must be provided?

Where the threshold described above (of 50 or more employees physically present in the workplace) is met, the below health information must be provided only in relation to those employees who are physically coming into the office (be that on a full-time, part-time or ad hoc basis). Information is not required to be submitted in respect of employees who are working exclusively from home.

Another point to bear in mind is that it is only information regarding an employer’s own employees that needs to be submitted. An employer is not required to submit information in relation to other workers who may be working on its premises and these other workers are not taken into account for purposes of determining whether the threshold number is met.

The following categories of data are required to be submitted to the National Institute for Occupational Health (NIOH):

The vulnerability status of the employees physically present at the work premises

This information is only required to be submitted on a once-off basis, and updated as necessary (e.g. as new employees are engaged or comorbidity information changes).

Importantly, when it comes to identifying the employee, an ‘EmployeeID’ is required. We understand that it is not necessary to refer to an employee’s South African ID number here. The employer can use the employee number that it assigns to employees in the ordinary course of business.

What is important is that the same Employee ID number is used each time the employer reports in respect of that individual (so that the NIOH can link the relevant data).

While the templates referred to in the Department of Health guidelines make provision for the disclosure of each employee’s particular comorbidity, this information is not mandatary. An employer will be required to confirm whether or not an employee falls into the ‘vulnerable employees’ category.

If the answer to that question is ‘yes’, then the particular comorbidity or risk factor only needs to be provided if (i) it is known to the employer and (ii) the employee has consented to the disclosure of that information to the NIOH. This consent should preferably be obtained in writing.

Details of the symptom screening of employees who are symptomatic

The remaining data must be reported on a weekly basis, every Tuesday. However, this does not necessarily mean that an employer will need to make a submission each week.

An employer is required to screen employees who enter the workplace daily, but the employer is only required to report in respect of employees who are symptomatic.

This means that the employer would only submit data in those weeks in which it has employees who have been identified at the workplace (through the screening process) as having COVID-19 symptoms.

The exact symptoms that have been displayed by the employee are not required to be identified, however, if this is known to the employer, then this information should be provided in the report.

Details of employees who test positive for COVID-19

If there are any employees who test positive for COVID-19 during a particular week, then the employer will be required to submit information regarding those employee/s in its weekly report.

When reporting a positive case, the employee’s South African ID number must be provided (in addition to any Employee ID previously provided).

The number of employees identified as high-risk contacts within the workplace as a result of exposure to a worker who has tested positive for COVID-19

In the event that there is a positive case identified at the workplace and the worker who has tested positive has come into contact with other workers at the workplace, an employer is required to assess those workers’ exposure to ascertain whether the exposure carries a high or low risk of transmission.

In the event that any of the employer’s employees are identified as being high-risk contacts, the employer will be required to submit information regarding the number of those employees when the positive case is reported.

It is possible that the positive ‘index case’ may not be the employer’s own employee (but rather another worker at the premises). In that case, the positive case will not need to be reported (because this will be reported by the worker’s employer), but the number of high-risk contacts must be reported.

Details on the post-infection outcomes of those testing positive, including the return to work assessment outcome

Where an employer has reported on any employees who have tested positive for COVID-19, the employer will be required to provide information regarding those employees’ post-infection outcomes, including their fitness to return to work, if applicable (i.e. either ‘fit for job description’, ‘fit with accommodation’, ‘temporarily unfit for job’, etc.).

How do employers submit the data?

The first step is for employers to register on the NIOH web portal ( Once registered, the employer will receive a unique BusinessID and login credentials.

From there, employers will be able to select their preferred method for submitting their data. The following three options are currently available:

  • Manual submissions via Next Cloud: the employer can use the excel templates for reporting and manually submit the data by uploading the file onto Next Cloud; or
  • Submission via the Cmore web or mobile app: there is an application hosted by the CSIR which employers can either download or access via the web, which they can then use to submit their data onto the Cmore server; or
  • API Integration (submission using the employer’s own tools): where an employer is already using its own technology to obtain the information from its employees (such as a screening app), then the technical team at the NIOH can work with the employer to seek to integrate that technology so that the information can be shared with the NIOH.

Do employees need to consent to the submission of their health data?

No, not necessarily. Health data would be regarded as special personal information for purposes of the Protection of Personal Information Act, 2013 (POPIA). However, this information may be processed lawfully by the employer and provided to the NIOH in order to comply with its obligations under the Revised OHS Direction.

Where consent will be required, is in the event that information regarding an employee’s particular comorbidity or risk factor (which makes her/him a ‘vulnerable employee’) is shared as part of the employer’s submission (as discussed above).

Notwithstanding that an employee’s consent is not required for the submission of her/his health data, an employer is required to inform its employees that their information will be submitted to the NIOH and advise them that their data will be treated confidentially and that the NIOH will comply with its obligations under the POPIA.