What Is POPIA and What Does It Mean for Your Small Business Website?

POPIA is the Protection of Personal Information Act. It is South Africa's law on how businesses collect, use, store and share information about people. It has applied in full since 1 July 2021, and it covers almost every business, including a sole trader with a simple website. This post is general information, not legal advice.

What counts as personal information

Any information that can identify a person. On a small business website that usually means names, email addresses and phone numbers typed into a contact form, and anything customers send you by email or WhatsApp.

What POPIA asks of you

• Collect only what you need, and tell people why you are collecting it.
• Use the information only for that purpose.
• Keep it safe, and do not keep it longer than you need to.
• Let people see and correct their information if they ask.
• Have an information officer. In a small business this is normally the owner, and the role should be registered with the Information Regulator.

What it means for your website

• A privacy policy that says what you collect, why, who sees it and how to contact you.
• A contact form that only asks for what you need, with a short note on how the details are used.
• HTTPS on every page, so information is encrypted in transit.
• Care with third parties. If your form, email or analytics tool stores data on servers outside South Africa, the privacy policy should say so.
• Cookie or tracking notices if you use analytics or advertising tools.

What happens if you ignore it

The Information Regulator can investigate complaints and issue enforcement notices. Serious offences can carry fines of up to R10 million or jail time. For most small businesses the more likely problem is a customer complaint or a lost client who does not trust how their details were handled.

A short checklist

• Do you have a privacy policy linked in your footer?
• Do you know where your contact form submissions end up?
• Is your site on HTTPS?
• Is an information officer named and registered?
• Do you delete old enquiries you no longer need?

If you are not sure where your site stands, send us a message. We will tell you what to fix. For legal questions about your specific business, speak to an attorney who works with POPIA.