POPIA Compliance for Your Website: A Practical Guide for South African Businesses

The Protection of Personal Information Act, better known as POPIA, applies to every South African business that collects customer data through a website, whether that is a contact form, a newsletter signup, or an online store. Non-compliance carries real penalties, yet many small business websites still fall short of the basics.

This is not a substitute for legal advice, but it covers the practical website-level steps most South African SMEs need to get right.

At its core, POPIA requires that you only collect personal information for a specific, clearly stated purpose, that you protect it properly, and that you tell people what you are doing with it.

• Get clear consent before collecting personal information
• Explain exactly what data you collect and why
• Only collect data you actually need for that stated purpose
• Keep the data secure and only for as long as necessary
• Allow people to request access to, correction of, or deletion of their data

Not a copied template from another country. Your privacy policy should describe what data your specific forms collect, how it is stored, who has access, and how a customer can request it be deleted.

Contact forms, newsletter signups, and booking forms should include a clear, unticked checkbox for consent, not a pre-checked box buried in fine print.

Your website should run on HTTPS, form submissions should be encrypted in transit, and any stored customer data should sit behind proper access controls, not in a spreadsheet anyone in the office can open.

POPIA requires every business to register an Information Officer with the Information Regulator. This person is the point of contact for any data-related requests or complaints.

1. Contact forms with no privacy policy link anywhere near them
2. Newsletter tools that store subscriber data outside South Africa without disclosure
3. No process for someone to actually request their data be deleted
4. Cookie banners that do nothing when a visitor declines tracking

Most of these are quick fixes once you know to look for them. The bigger risk is not knowing your website has a gap until it becomes a complaint.

Getting POPIA right protects your business from penalties, and it also builds real trust with customers who increasingly care about how their data is handled.