The Protection of Personal Information Act (POPIA) governs how South African organisations collect, use, store and share personal information. If your website has a contact form, a newsletter sign-up, an online store or even analytics, it handles personal information, so POPIA applies.
The good news: for most small business websites, getting the basics right is straightforward. Here’s a practical checklist.
What counts as personal information?
Under POPIA, personal information includes anything that can identify a person, such as names, email addresses, phone numbers, ID numbers, physical addresses and online identifiers. On a typical website this comes from:
- Contact and quote forms.
- Newsletter sign-ups.
- Online store checkouts and customer accounts.
- Booking systems.
- Analytics and tracking tools.
The website POPIA checklist
1. Publish a clear privacy policy
Your website should have a privacy policy that explains, in plain language:
- What personal information you collect.
- Why you collect it and how you use it.
- Who you share it with (for example, your email provider or payment gateway).
- How long you keep it.
- How people can access, correct or ask you to delete their information.
- How to contact you about privacy.
Link to it from your website footer and next to your forms.
2. Only collect what you need
If you only need a name, email and message to reply to an enquiry, don’t ask for an ID number or physical address. Collecting less means less risk.
3. Be clear on your forms
Add a short line near each form explaining what you’ll do with the information, for example: “We’ll only use your details to respond to your enquiry.” Link to your privacy policy.
4. Get consent for marketing
This is where many businesses go wrong. Under section 69 of POPIA, sending direct marketing by electronic communication (email, SMS and similar) generally requires the person’s consent, unless they’re an existing customer who bought a similar product or service from you, and you gave them a chance to opt out.
In practice:
- Use an unticked checkbox for newsletter sign-ups, never a pre-ticked one.
- Include an easy unsubscribe option in every marketing message.
- Keep a record of when and how people opted in.
5. Secure your website
POPIA requires reasonable measures to keep personal information safe. For a website, that includes:
- An SSL certificate (the padlock and “https”), so data is encrypted in transit.
- Keeping your website software and plugins updated.
- Strong passwords and limited admin access.
- Regular backups.
- Spam protection on forms.
6. Be transparent about cookies and tracking
If you use analytics or advertising tools that track visitors, explain this in your privacy policy. Many businesses also show a cookie notice so visitors can make an informed choice, which is good practice for transparency.
7. Choose trustworthy service providers
Your email platform, hosting company, payment gateway and form tools all process personal information on your behalf. Use reputable providers and know where your data is stored.
8. Register your Information Officer
Every organisation has an Information Officer (by default, the head of the business, such as the owner or CEO). POPIA requires Information Officers to be registered with the Information Regulator. Check the Information Regulator’s website for the current registration process.
9. Know what to do if something goes wrong
If personal information is accessed by someone who shouldn’t have it, for example after a hack, POPIA requires you to notify the Information Regulator and the affected people as soon as reasonably possible. Having backups, monitoring and a plan makes this far less stressful.
A quick self-check
- Do you have a privacy policy linked in your footer?
- Do your forms explain how information will be used?
- Is your newsletter opt-in unticked by default?
- Does your site use https?
- Is your website software up to date and backed up?
- Is your Information Officer registered?
If you answered “no” or “not sure” to any of these, it’s worth fixing.
How we can help
All SAPixel Development websites are built with security and privacy in mind: SSL, secure forms and spam protection as standard. We can also add a POPIA-friendly privacy policy page, form notices and cookie notices to an existing website as part of our website upgrades, and our care plans keep your site updated and backed up every month.
Frequently asked questions
Does POPIA apply to small businesses?
Yes. POPIA applies to anyone who processes personal information in South Africa, regardless of size.
Is a privacy policy template good enough?
A template is a good starting point, but it must accurately describe what your business actually does with personal information. Review it carefully or ask a professional.
Can I WhatsApp or email potential clients I found online?
Be careful. Unsolicited electronic direct marketing generally needs consent. A one-off, personal approach asking whether someone would like to hear from you, with a clear way to say no, is far safer than bulk messaging. If someone asks you to stop, stop.