The Protection of Personal Information Act, POPIA, applies to almost every South African business with a website. If your site has a contact form, a newsletter sign-up, a booking system or a checkout, it collects personal information, and the Act sets rules for how you collect, use and protect it.
This is a practical checklist for a small business website. It is not legal advice; if you handle sensitive data such as health or financial records, speak to a POPIA specialist or attorney.
1. A privacy policy that matches what your site really does
Every website that collects personal information needs a privacy policy, linked from the footer of every page. It should say, in plain language:
- Who you are and how to contact you.
- What information you collect — names, emails, phone numbers, addresses, payment details, IP addresses.
- Why you collect it and what you use it for.
- Who you share it with: your payment gateway, email platform, hosting company, courier.
- How long you keep it.
- How someone can ask to see, correct or delete their information, and how to complain to the Information Regulator.
The most common failure is a policy copied from another site. If it mentions services you do not use, or misses the ones you do, it does not describe your processing and does not help you.
2. Collect only what you need on forms
POPIA expects you to collect the minimum information necessary for the purpose. A quote request needs a name and a way to reply. It probably does not need an ID number, a date of birth or a physical address. Every extra field is more information you are responsible for protecting, and another reason for a visitor to give up halfway.
Add a short line under each form saying what the information will be used for, with a link to the privacy policy.
3. Email marketing must be opt-in
This is the area where POPIA is strictest. Sending direct marketing by email, SMS or WhatsApp generally requires the person's consent, unless they are an existing customer who bought something similar from you and was given a chance to opt out.
In practice, on a website:
- A newsletter tick-box must be unticked by default.
- Signing up for marketing must be separate from submitting an enquiry. Asking for a quote is not consent to a newsletter.
- Every marketing message needs a clear, working way to unsubscribe.
- Keep a record of when and how each person opted in.
4. Cookies and tracking
POPIA does not have a separate cookie law the way Europe does, but cookies and tracking pixels that identify a person are still processing personal information. If your site runs analytics, Meta or Google ad pixels, or marketing tools, say so in your privacy policy. A cookie notice that lets visitors decline non-essential tracking is good practice, and essential if you also serve visitors in Europe, where the rules are stricter.
5. Security: the part people forget
POPIA requires "appropriate, reasonable" security measures. For a website that means:
- HTTPS everywhere — the padlock in the address bar. Without it, form data travels unencrypted.
- Updated software. An out-of-date WordPress installation or plugin is the most common way small business sites are breached.
- Do not store what you do not need. Contact form submissions sitting in a database for years are a liability. Card details should never touch your server at all; a proper payment gateway handles them.
- Strong, separate passwords and two-factor authentication on your hosting, domain and website admin accounts.
- Backups, so a breach or failure does not mean losing everything.
If personal information is compromised, POPIA requires you to notify the Information Regulator and the people affected as soon as reasonably possible.
6. Your Information Officer
Every business has an Information Officer. By default it is the owner or head of the business, and the Information Regulator expects Information Officers to be registered on its portal. Put their contact details, or a dedicated privacy email address, in the privacy policy so people know who to contact.
Many businesses must also make a PAIA manual available, explaining how people can request records. Some small businesses have been exempted from this requirement at times, so check the Information Regulator's current guidance for your size and sector.
7. Third parties count too
When you use a booking system, email platform, chat widget or CRM, you are sharing personal information with an operator. Use reputable providers, know where they store data (many store it outside South Africa, which POPIA permits under certain conditions), and list them in your privacy policy.
Why this is worth doing properly
The maximum penalties under POPIA are severe, up to R10 million in fines, but for most small businesses the bigger cost is trust. A clear privacy policy, a sensible form and an unsubscribe link that works all tell a customer you take their information seriously. It also happens to be what a well-built website looks like anyway.