Covert measures — an undercover operative, a discreet observation, a controlled purchase — can uncover misconduct that overt methods never reach. They also carry real legal and ethical risk. Done carelessly, a covert operation can taint otherwise good evidence and expose an employer to liability.
This article sets out principles for running covert work responsibly in a South African workplace context, with attention to POPIA and labour law. It is general guidance, not legal advice; covert operations are exactly the kind of high-risk activity where you should confirm your plan with counsel before you start.
Start with justification, not tactics
The first question is never “how do we go covert?” It is “why is covert necessary at all?” Covert methods should be a considered step, not a default. Before authorising one, be able to answer: what specific wrongdoing do you reasonably suspect, why can overt methods not establish it, and is the intrusion proportionate to the seriousness of what is alleged? Documenting that reasoning at the outset is one of the strongest protections you can build, because it demonstrates the decision was deliberate and grounded.
Proportionality and necessity
Two ideas should govern the whole operation. Necessity asks whether the covert step is genuinely required or whether a less intrusive route exists. Proportionality asks whether the intrusion matches the gravity of the matter — deploying surveillance across a whole team to catch minor pilferage is unlikely to be proportionate. Keep the operation as narrow as possible: limited in scope, limited in duration, and targeted at the suspected conduct rather than sweeping up everyone nearby.
Where POPIA fits
Covert operations collect personal information, often intimate and always without the subject’s knowledge at the time. POPIA still applies. That does not make covert work impossible, but it does impose discipline:
- Lawful purpose. Collection must serve a legitimate, defined purpose — typically investigating specific suspected misconduct.
- Minimality. Collect only what the purpose requires; avoid gathering unrelated personal information about the subject or bystanders.
- Security and access. Restrict who can see the product of the operation and store it securely.
- Retention. Keep the material only as long as the purpose requires, then dispose of it responsibly.
Our POPIA approach covers these operational-data principles in more depth.
Labour law and fairness
Even where evidence is lawfully obtained, it still has to survive the fairness lens the LRA and the CCMA apply. Covert evidence is admissible in disciplinary proceedings in appropriate cases, but a decision-maker will scrutinise how it was gathered. Entrapment — inducing an employee to commit misconduct they would not otherwise have committed — is a serious weakness; observing conduct that would have happened anyway is a very different thing. Be careful, too, about surveillance that reaches into genuinely private spaces or private life beyond the scope of the suspicion.
Lawfully obtained, proportionate, well-documented covert evidence strengthens a case. Evidence gathered by overreach can sink one, however compelling it looks.
Authorisation and oversight
Covert operations should be authorised at an appropriate level, not launched by an individual on their own initiative. Record who approved the operation, on what grounds, what its scope and duration are, and who is accountable for it. Build in review points so an operation that is not producing results, or that has drifted beyond its original scope, can be stopped. This governance is not bureaucracy — it is the evidence that the employer acted reasonably and deliberately. Structured covert operations management helps keep authorisation, scope and the resulting evidence tied to a controlled case record.
Briefing operatives and managing risk
Operatives need a clear brief on what they may and may not do. They should observe and record, not provoke. They should stay within the defined scope and avoid conduct that could itself be unlawful. Their safety matters too: a covert brief that pushes an operative into danger is neither responsible nor defensible. Keep a contemporaneous record of instructions given and reports received, so the operation’s conduct can be reconstructed accurately afterwards.
A short pre-launch checklist
- Is the suspected misconduct specific and reasonably grounded?
- Have less intrusive methods been considered and ruled out?
- Is the scope narrow, targeted and time-limited?
- Has an appropriate authoriser approved it in writing?
- Are POPIA obligations — purpose, minimality, security, retention — addressed?
- Are operatives briefed to observe rather than induce?
Key takeaway
Covert operations are legitimate when they are necessary, proportionate, properly authorised and POPIA-conscious. The discipline you apply before launch — justification, scope, oversight — is what makes the resulting evidence both usable and defensible.
If covert work is part of your toolkit, a good next step is to review your authorisation process: who signs off, what they record, and how scope is kept in check. That governance layer is usually where the real risk is managed or missed.