POPIA website compliance: a practical checklist for South African small businesses.

Your website collects personal information every day. The contact form takes names and phone numbers, the newsletter box takes email addresses, and the analytics script records who visits. Under POPIA, all of that is your responsibility, and most small business sites miss a few of the basics.

This guide turns the Act into a checklist you can work through in an afternoon. Each item points to the section of the Act or the Information Regulator's own guidance behind it, so you can check the source yourself.

What POPIA website compliance means for a small business

The Protection of Personal Information Act applies to any business that processes personal information in South Africa, whatever its size. Its definition of personal information includes an email address, a phone number, location information and an "online identifier". So it covers your forms and most tracking tools.

The Information Regulator can issue administrative fines of up to R10 million under section 109. Most gaps on small sites are cheap to fix.

This guide explains the law in plain words. It is not legal advice.

1. Contact forms: ask only for what you need

Section 10 says personal information may only be processed if it is "adequate, relevant and not excessive" for the purpose. For a contact form, that is usually a name, one way to reach the person and their message.

• Remove fields you never use, such as ID number or date of birth.
• Mark optional fields clearly. Section 18 says people must know whether giving information is voluntary or required.
• Send entries somewhere protected, such as your business mailbox or a CRM with personal logins.

You do not always need consent. Section 11 lists other grounds, such as processing needed to conclude a contract with the person. Replying to a quote request will usually fit. Adding that person to your newsletter does not.

2. Consent wording that holds up

POPIA defines consent as a "voluntary, specific and informed expression of will". On a website, that means:

• Voluntary. A marketing tick box starts empty, and the form still sends if the person leaves it empty.
• Specific. One box per purpose. "Send me the quote" and "send me your newsletter" are different purposes.
• Informed. The words next to the box say what you will send and how to stop it. For example: "Yes, email me your monthly newsletter with offers. I can unsubscribe at any time."

Section 11(2)(a) puts the burden of proving consent on you, so keep a record of when and how each person agreed.

3. What a POPIA privacy policy on your website must contain

Section 18(1) lists what people must be made aware of when you collect their information. Your privacy notice should cover:

• what you collect, and its source if not the person
• your business name and address
• why you collect it
• whether giving it is voluntary or required, and what happens if they do not
• any law that requires the collection
• whether it goes to another country, and how it is protected there
• who receives it, such as your host, email tool and analytics provider
• their right to see and correct their information, and to object
• their right to complain to the Information Regulator, with its contact details

Section 18(2) says people must know this before you collect information from them. Link the notice in every page footer and under each form.

Many website tools store data overseas. Section 72 allows that only under set conditions, such as the recipient being bound by law or an agreement that gives adequate protection. Check each tool's data protection terms.

4. Register your Information Officer

Under POPIA, the Information Officer of a business is its head, as defined in PAIA. The Regulator's guidance note on Information Officers says that is the owner of a sole proprietorship, a partner in a partnership, or the CEO, managing director or equivalent of a company. That person may authorise someone else at management level.

Section 55(2) says they may only take up their duties once registered with the Regulator.

• Register the Information Officer, and any deputies, on the Regulator's eServices portal.
• Update the registration when the person changes.

5. Cookies and analytics

POPIA has no separate cookie section. But a cookie or analytics ID that can be tied to a person is an online identifier, which the Act lists as personal information. The Regulator's guidance note on direct marketing also lists the use of cookies as one method of direct marketing by electronic communication.

• List every tracking tool in your privacy notice: Google Analytics, the Meta Pixel, chat widgets.
• Say what each one does and how to switch it off.
• If your tags feed ad targeting, the safest course is a cookie banner that asks before those tags load.

6. Marketing emails and section 69

Section 69 bans direct marketing by email, SMS, automatic calling machines and other electronic communication unless the person has consented or is an existing customer. The Regulator's guidance note treats phone calls as electronic communication too.

Under section 69(3), the customer exception applies only when:

• you got their details in the context of a sale of a product or service
• you market your own similar products or services
• they could object, free of charge, when you collected the details and in every message since

For everyone else, section 69(2) lets you ask for consent only once, and only if they have not refused before. The guidance note says that first message must be the request itself, that an electronic version of the prescribed Form 4 is acceptable, and that you must keep a list of people who refused or objected.

An unsubscribe link does not turn a bought list into consent. In an April 2026 statement, the Regulator's chairperson said that opting out cannot be treated as giving consent.

Under section 69(4), every marketing message must name the sender and give contact details for asking to stop. To keep those emails out of spam, see our guide to SPF, DKIM and DMARC.

7. Security safeguards for your website

Section 19 asks for "appropriate, reasonable technical and organisational measures" against loss, damage and unlawful access, checked regularly and updated as risks change. For a website, that means:

• HTTPS on every page and form.
• The CMS, theme and plugins kept up to date, and unused plugins removed.
• Personal admin logins with two-step sign-in, and old staff accounts removed.
• Backups kept somewhere separate, and tested.
• Old form entries deleted. Section 14 says records must not be kept longer than the purpose needs.

Section 21 adds that any operator who processes information for you, such as your host or web developer, must be bound by a written contract to keep these measures. Keeping sites patched is part of our website and app work.

8. What to do after a breach

Section 22 says that when there are reasonable grounds to believe someone unauthorised has accessed or acquired personal information, you must tell the Regulator and the people affected as soon as reasonably possible.

Since 1 April 2025, reports to the Regulator must go through the eServices portal, as its April 2025 statement explains. The Regulator's fact sheet on security compromises says every breach must be reported, it need not be confirmed first, and you can update the report later.

1. Contain it: change passwords, close the gap, take the affected form offline.
2. Work out what was exposed and whose it was.
3. Report it on the eServices portal. Your Information Officer or deputy should do this.
4. Tell the people affected in writing, such as by email or a website notice. Say what happened, what you are doing, what they should do, and who did it if you know.
5. Write down what happened and what you changed.

Your POPIA checklist for a small business website

• Forms ask only for what you need.
• Marketing tick boxes start empty, one per purpose.
• A section 18 privacy notice is linked in the footer and under each form.
• Your Information Officer is registered.
• Tracking tools are listed, and ad tags wait for consent.
• Marketing goes only to people who agreed, or to customers who could object.
• Software is updated, logins are personal, backups work.
• You know how to report a breach.

Our free website privacy and trust checklist walks through these items for South Africa and shows what to fix first.

What to do next

Start with the quick fixes: untick your marketing boxes, add a privacy notice link under each form, and register your Information Officer.

If you would like us to check your site against this list and fix what is missing, get in touch through our contact page.