POPIA and Your Business Website: What You Need to Know

If your website collects any personal information, you are processing personal information under South Africa's Protection of Personal Information Act (POPIA). That includes a contact form, a newsletter sign-up, an online checkout or even analytics that track visitors.

This article is a practical introduction, not legal advice. For decisions that carry legal risk, speak to a qualified attorney or the Information Regulator's published guidance.

What counts as personal information on a website

Personal information is anything that identifies a person. On a typical business site that includes:

• Names, email addresses and phone numbers entered into forms.
• Delivery addresses and order history in an online store.
• Information in job applications and CVs.
• IP addresses and identifiers collected by analytics and advertising tools.
• Enquiry messages, which may contain sensitive details.

The core principles, applied to your site

POPIA sets out conditions for lawful processing. These are the ones that most often touch a website:

Purpose specification and minimisation. Collect only what you need for a stated purpose. If a contact form only needs a name, email and message, do not require a phone number, ID number and company size as well.

Openness. People should be told what you collect, why, who you share it with and how to access or correct it. This is the job of your privacy policy and the notices next to your forms.

Security safeguards. You must take reasonable steps to protect the information. For a website that means HTTPS, up-to-date software, strong access controls and backups.

Data subject participation. People can ask what you hold about them and ask you to correct or delete it. You need a process and a named contact for these requests.

What your website should have

A real privacy policy

Copying a template from another company is risky because it may describe things you do not do and miss things you do. Your policy should say:

• Who you are (the responsible party) and how to contact you.
• What personal information you collect through the site.
• Why you collect it and the lawful basis.
• Who receives it, such as your email platform, payment provider or analytics service.
• Whether information goes outside South Africa.
• How long you keep it.
• How people can access, correct or delete it, and how to complain.

A notice at the point of collection

Next to your contact form or checkout, add a short line such as: "We use your details to respond to your enquiry. Read our privacy policy." Link to the full policy.

Consent that is real for marketing

POPIA restricts electronic direct marketing. As a general rule, you need the person's consent before sending marketing emails or messages to people who are not existing customers, and every message must offer an easy way to opt out.

• Do not pre-tick marketing boxes.
• Keep a record of when and how consent was given.
• Make unsubscribing simple and honour it quickly.
• Do not buy lists and email them cold.

Sensible cookie and tracking practice

POPIA does not use the word "cookie" the way European law does, but tracking that identifies individuals still involves personal information. A good approach is to:

• Tell visitors what tracking you use.
• Avoid unnecessary advertising trackers.
• Choose analytics tools that minimise personal data.
• Offer a clear way to decline non-essential tracking.

An information officer

Every business is responsible for having an information officer. In a company, this is usually the CEO or head of the organisation, who may delegate to someone else. Check the Information Regulator's guidance on registering your information officer.

Security basics your website needs

• HTTPS across the whole site.
• Regular updates to the platform, themes and plugins.
• Two-factor authentication for admin accounts.
• Limited admin access: only people who need it.
• Backups that you have tested.
• A plan for what to do if there is a breach. POPIA requires notifying the Information Regulator and affected people when personal information has been accessed without authorisation.

These are good practice for any business, and they overlap with what your website needs and the work of a managed IT provider.

Extra points for online stores

If you sell online, other laws matter too, including the Consumer Protection Act and the Electronic Communications and Transactions Act. In general, you should show full business details, clear prices, delivery terms, a returns policy and your terms and conditions. Payment details should be handled by a reputable gateway so card data never touches your own server. See payment gateways for South African online stores.

Third-party tools are part of your responsibility

Every form plugin, chat widget, email platform and analytics tool you add may receive personal information. Keep a list of them, understand what each collects and make sure each is covered in your privacy policy. Remove tools you no longer use.

A quick compliance check

• Privacy policy that matches reality
• Notices beside every form
• Consent and opt-out for marketing
• Only necessary fields collected
• HTTPS, updates, backups, two-factor authentication
• List of third-party tools and what they collect
• Information officer identified
• A way for people to access, correct or delete their data
• A breach response plan

Treat this as a starting point. Regulations and guidance evolve, so review your setup at least once a year.