Compliance map
What a South African SME must legally comply with
The five bodies of law that catch almost every South African employer, which duties start at your first employee, what changes as you hire, and where each obligation actually comes from. Position as at August 2026.
Get this as a working checklist
All 33 items an inspector can ask you to produce, in one PDF, each with the section of the Act behind it and a tick box next to it. Free, and it downloads straight away.
The short answer
If you are a South African business with at least one employee, you owe duties under five separate bodies of law simultaneously, and none of them wait for you to reach a particular size. The Occupational Health and Safety Act applies from your first employee. POPIA applies to every responsible party in the country with no size exemption at all. The Basic Conditions of Employment Act and the national minimum wage apply from day one. The Companies Act runs on your incorporation anniversary regardless of whether you traded. SARS duties are triggered by what you do, not by what you elect.
What changes with size is not whether compliance applies. It is how many specific, evidenced records you have to be able to produce. Below is the map, each item linked to a free checklist that carries the section of the Act behind every step.
The five domains, and who each one catches
| Domain | Who it catches | The rhythm | Free checklist |
|---|---|---|---|
| Occupational health and safety | Every employer, from the first employee. Extra duties at more than 5, more than 10 and more than 20 employees at a workplace. | Continuous, with quarterly committee meetings once triggered, 7 day incident reporting, and appointment and certificate renewals. | OHS Act guide |
| POPIA | Every responsible party domiciled in South Africa that processes personal information. No headcount or turnover exemption. | Continuous, with breach notification as soon as reasonably possible and a 14 business day window for a Regulator compliance monitoring request. | POPIA checklist |
| Labour | Every employer. Employment equity duties from 50 or more employees, since the turnover test was removed on 1 January 2025. | Monthly EMP201, biannual EMP501, annual employment equity reporting where designated, and a 30 day CCMA referral clock on dismissals. | Labour checklist |
| Companies Act and CIPC | Every registered company, whether or not it traded. | Annual return within 30 business days of the incorporation anniversary, beneficial ownership within 10 business days of any change, financial statements within six months of year end. | CIPC checklist |
| SARS | Every company. VAT once taxable supplies exceed R2,3 million in any 12 month period, raised from R1 million on 1 April 2026. | Monthly EMP201 and VAT201, two compulsory provisional tax payments, ITR14 within 12 months of year end. | SARS checklist |
What applies at your headcount
The occupational health and safety thresholds are the ones most often missed, because they change silently as you hire. They count employees at a workplace, not across the business.
| Employees at the workplace | What becomes required |
|---|---|
| 1 or more | OHS section 8 general duty and the risk assessment. Section 16(1) chief executive officer duty. A supervisor of machinery in writing wherever machinery is used, with no headcount test. Written particulars of employment, time and pay records for three years, payslips. National minimum wage. UIF and Compensation Fund registration. PAYE registration within 21 business days. |
| More than 5 | A first aid box at or near the workplace, accessible to employees, holding at least the Annexure minimum contents. |
| More than 10 | At least one person with a valid first aid certificate readily available during normal working hours, then one per group of up to 50, or one per group of up to 100 in a shop or office. Cover has to hold across shifts. |
| More than 20 | Health and safety representatives designated in writing for a specified period, within four months, after good faith consultation on the nomination or election process. |
| Two or more representatives designated | One or more health and safety committees, meeting at least quarterly, with records kept for at least three years. |
| 50 or more | Designated employer status under the Employment Equity Act: an EE plan aligned to the sectoral numerical targets, annual EEA2 and EEA4 reporting, and a section 53 certificate before tendering for state business. |
The threshold people get wrong. The ratio of one health and safety representative per 20 employees is repeated widely and it is not what the Act says. Section 17(5) sets one per 100 or part thereof in shops and offices and one per 50 or part thereof in all other workplaces. The number 20 is the section 17(1) threshold at which the duty to designate representatives begins at all. Running a richer ratio is perfectly legitimate, it is just an agreed ratio rather than the statutory minimum, and the difference matters when a shortfall is assessed.
What actually goes wrong
Compliance rarely fails at the point of writing a document. It fails afterwards, in four recognisable ways.
The evidence lapses quietly
An appointment letter stays on file while the certificate supporting it expires. The register still looks complete. It is not, and that is precisely what an inspection finds.
Nobody recalculates on growth
Headcount crosses a threshold and the requirement changes with it. The register stays accurate for the year it was written.
The law moves under the file
Three OHS regulation sets were amended in 2025 and 2026 and one long standing set is repealed on 6 September 2026. Any file citing the old instruments has a hard expiry date.
See the amendment tableRecording and reporting get conflated
They are separate duties with separate triggers and separate retention. An incident can be recordable without being reportable, and the recording duty is the one that carries the seven day investigation clock.
Where to start
Work the free checklists in the order your exposure actually runs. Everything triggered by your first employee and your incorporation date is already accruing, so start there. Then the headcount-triggered occupational health and safety duties for any site that has crossed a threshold. Each checklist is readable in full on this site and downloadable as a working document, with the section of the Act behind every item, so you can establish where you stand before you spend anything.
Common questions
What compliance does a small South African business actually have to do?
Almost every South African employer carries duties under at least five bodies of law at once. The Occupational Health and Safety Act 85 of 1993 applies from your first employee, with no headcount threshold on the general duty in section 8. The Protection of Personal Information Act applies to every responsible party domiciled in South Africa that processes personal information, with no exemption for size or turnover. The Basic Conditions of Employment Act and the national minimum wage apply from your first employee. The Companies Act requires an annual return within 30 business days of your incorporation anniversary and beneficial ownership within 10 business days of any change. SARS registration duties are triggered by conduct, not by choice.
Which obligations start at my first employee?
The section 8 general duty under the OHS Act, the section 16(1) chief executive officer duty, and the workplace risk assessment under section 8(2)(d). A written particulars of employment document under BCEA section 29, time and pay records kept for three years, and a compliant payslip. The national minimum wage of R30,23 per ordinary hour from 1 March 2026. UIF registration and monthly declaration. Registration with the Compensation Fund within seven days of employing your first worker. PAYE registration within 21 business days of becoming an employer.
At what headcount do the extra OHS duties kick in?
More than 5 employees at a workplace triggers a first aid box under General Safety Regulation 3(2). More than 10 triggers certificated first aiders, then one per group of up to 50, or one per group of up to 100 in a shop or office, under regulation 3(4). More than 20 triggers health and safety representatives under section 17(1), at one per 50 or part thereof in most workplaces and one per 100 or part thereof in shops and offices under section 17(5). Once two or more representatives are designated, a health and safety committee becomes mandatory under section 19(1). These count employees at a workplace, not across the business.
Do I need to worry about POPIA if I only have a handful of staff?
Yes. POPIA applies to any responsible party domiciled in South Africa that processes personal information, with no exemption based on employee numbers or turnover. If you hold employee files, customer contact details or supplier records, you are processing personal information. The Information Officer defaults to the chief executive officer, the owner or the partner, and section 55(2) requires that person to register with the Information Regulator before taking up duties. A PAIA manual is also required of every private body under section 51 of PAIA, since the small-body exemption lapsed on 31 December 2021.
What happens if I just do not file?
SARS administrative penalties run from R250 to R16 000 a month depending on your last assessed taxable income, and recur for up to 35 months per outstanding return. CIPC may deregister a company that has not filed annual returns for two or more successive years, at which point the company ceases to exist and CIPC guidance states directors and members active at the time may be held liable for its debts. The Information Regulator may impose an administrative fine of up to R10 million, and every fine issued to date followed a failure to comply with an enforcement notice rather than the underlying contravention. The OHS Act carries R50 000 or one year under section 38(1), rising to R100 000 or two years under section 38(2).
Do I have to do all of this at once?
No, and trying to is usually why nothing gets finished. The practical order is: fix what is triggered by your first employee and by your incorporation date, because those are already running and already accruing. Then work through the headcount-triggered OHS duties for the sites that cross the thresholds. Then the domain that carries your largest single exposure, which for most employers is occupational health and safety because it generates inspections.
Get the OHS checklist Ask us to run compliance for you
General information about published law, stated as at August 2026. Not legal, tax or financial advice. GRC Shop is not a law firm, an audit firm or a registered tax practitioner firm. Confirm any provision against the current Act or gazetted regulation before acting.