If your website has a contact form, a newsletter sign-up or analytics, it collects personal information, and South Africa’s Protection of Personal Information Act (POPIA) applies. You don’t need a legal department to get it right. These are the practical steps we take on every website we build.
In short
Collect only what you need, say clearly what you do with it in a privacy policy, ask before you send marketing emails, keep the site secure and updated, and know where your form submissions end up. This article is a practical guide, not legal advice. If you handle sensitive information such as health or financial records, speak to a POPIA specialist.
Why POPIA applies to your website
POPIA covers any personal information you collect: names, email addresses, phone numbers and even some online identifiers. A simple enquiry form is enough for it to apply, and there is no exemption for small businesses.
The Information Regulator enforces the act. Fines can go up to R10 million, and the Regulator has already used its powers: it fined the Department of Justice R5 million in 2023 for failing to renew its security software, and has issued enforcement notices against businesses for unsolicited marketing emails.
The checklist
1. Publish a clear privacy policy
Link it in your website footer and next to every form. In plain language, say what information you collect, why, who you share it with, how long you keep it, how people can see, correct or delete it, and how to contact you. A copied template that mentions things you don’t do helps nobody.
2. Ask only for what you need
A contact form needs a name, a way to reply and a message. If you don’t need someone’s ID number, physical address or date of birth to answer their enquiry, don’t ask for it. Less information collected means less to protect.
3. Get consent before you send marketing
Since the amended POPIA regulations took effect in April 2025, the rule is clear: for electronic marketing to people who aren’t your customers, an opt-out is not consent. Add a separate, unticked box to your forms, such as “Send me occasional updates and offers”, and keep a record of who ticked it and when.
Existing customers are treated differently: you may market similar products or services to them, as long as you gave them the chance to opt out when you collected their details and in every message after that.
4. Make unsubscribing easy
Every marketing email needs a working unsubscribe link, and an unsubscribe has to be honoured. Newsletter tools such as Mailchimp or MailerLite do this for you; personal emails sent from your inbox do not.
5. Be open about cookies and analytics
POPIA doesn’t mention cookies by name, but analytics and advertising tools can collect information that identifies people. Explain the cookies you use in your privacy policy and show a short cookie notice. If you only want visitor numbers, a cookie-free analytics tool avoids most of the question.
6. Keep the website secure
POPIA requires reasonable security measures. For a website, that means an SSL certificate, regular WordPress and plugin updates, strong passwords with two-factor login, and backups. Our guide to WordPress hosting in South Africa explains what to look for.
If personal information is ever compromised, you must notify the Regulator and the people affected. Since April 2025, these reports go through the Regulator’s online eServices portal.
7. Know where your form submissions go
Form entries may land in your inbox, in the website’s database and in tools like a mailing list or CRM, some of them stored overseas. Know where each one goes, who can see it, and clear out old entries you no longer need.
8. Delete what you no longer need
Don’t keep enquiries and contact details forever. Decide how long you need them, for example two years after your last contact, and delete them after that unless the law requires you to keep them.
9. Register your Information Officer
Every business has an Information Officer. For a small business it is usually the owner. Register them with the Regulator through the eServices portal, and put their contact details in your privacy policy.
Want a website that gets this right?
Every website we build comes with a privacy policy page, consent checkboxes on forms, a cookie notice and secure hosting.
Common questions
Does POPIA apply to a one-person business?
Yes. POPIA applies to anyone who processes personal information for business purposes, whatever the size of the business.
Do I need a cookie banner?
POPIA doesn’t require a specific banner, but you do need to be open about the information your website collects. A short notice that links to your privacy policy is the simplest way, and if you use advertising or tracking tools, asking first is the safer choice.
Can I use a privacy policy template?
As a starting point, yes, but edit it so it describes what your business actually does. A policy that doesn’t match your real practices doesn’t protect you or your customers.