The short answer
If your website has a contact form, a booking system, a newsletter or analytics, it collects personal information, and POPIA applies. At minimum you need a privacy policy that says what you collect and why, forms that ask only for what you need, a secure site, and permission before you send marketing. You also need a registered Information Officer, which for most small businesses is the owner.
This is a plain-language overview, not legal advice. For your specific situation, speak to a lawyer or the Information Regulator.
What counts as personal information on a website
POPIA (the Protection of Personal Information Act) covers any information about an identifiable person. Its own list includes email addresses, phone numbers, location information and online identifiers. On a small business website, that usually means:
- Contact forms
- A name, email address, phone number and whatever people type in the message.
- Email and WhatsApp
- Every enquiry that lands in your inbox or on your phone is personal information you now hold.
- Analytics
- Tools like Google Analytics record IP addresses and device details. The Act lists “online identifiers” as personal information.
- Newsletter sign-ups
- An email address on a mailing list, plus a record of what people opened and clicked.
- Bookings and orders
- Names, addresses, dates and what someone bought or booked.
What a small business website needs
The Act says people must know what you collect and why before they hand it over, that you collect no more than you need, and that you keep it safe. On a website, that comes down to four things.
- A privacy policy
- What you collect, why, who you share it with (your email provider, your web host, Google Analytics), how long you keep it, and how people can ask to see, correct or delete it.
- Only the fields you need
- A name, a way to reply and a message covers most enquiries. Don’t ask for ID numbers or birthdays “just in case”.
- Security
- HTTPS (the padlock), spam protection on forms, and strong passwords with two-step login on every account that can see the data.
- Consent for marketing
- To send marketing emails, SMSes or WhatsApps to people who aren’t customers yet, you need their yes first. An unticked box, never a pre-ticked one, and an easy way to stop.
Want to see a real one? Our own privacy policy names every service that handles your details, from our web host to our email provider. Yours should name yours.
Cookies and analytics: what the law says, and what's sensible
Here people get confused. Europe has specific cookie rules. POPIA doesn't mention cookies at all. What it does say is that personal information needs a lawful reason, and that people must be told about it. Analytics tools record IP addresses and device details, so they fall under the Act.
The sensible approach, and the one we use, is a cookie banner that loads analytics only after the visitor says yes, with Accept and Reject equally easy and a way to change your mind later. It's not written in the Act word for word. It is the simplest way to show you asked. Our cookie policy shows how that reads in practice.
The parts that live behind the website
Three things aren't on your website, but your website depends on them.
- An Information Officer
- The person responsible for POPIA in your business. You don’t appoint one specially: by default it’s the head of the business, so for most small businesses it’s you. The Act says they may only start once registered with the Information Regulator, which you do on its eServices portal.
- A PAIA manual
- A document under a different law (the Promotion of Access to Information Act) explaining what records you keep and how people can ask for them. Small private bodies used to be exempt. The Regulator says that ended on 31 December 2021, so every private body needs one, on its website and at its premises.
- A plan for a data breach
- If someone gets into your site, mailbox or laptop, POPIA says you must tell the Information Regulator and the people affected as soon as reasonably possible. Since 1 April 2025 those reports go through the Regulator’s eServices portal.
Check your website in five minutes
Open your website on your phone and go through these eight items. Tick what you already have. Nothing you tick is saved or sent anywhere.
Is your website POPIA-ready?
Tick what you have. Open an item for the details.
- What it is:
- A page that says what personal information you collect, why, who you share it with, how long you keep it, and how people can ask to see, correct or delete it.
- Why it matters:
- POPIA says people must know these things when you collect their details (section 18).
- Done looks like:
- Linked in your footer. It names your business, your email and hosting providers, any analytics, and gives the Information Regulator’s contact details.
- What it is:
- One line under each form: what you will use the details for, with a link to the privacy policy.
- Why it matters:
- The law expects people to be told before they hand over their details, not after.
- Done looks like:
- Every form, booking widget and sign-up box has the line and the link.
- What it is:
- Ask for what you need to answer the enquiry. Usually a name, a way to reply and a message.
- Why it matters:
- POPIA says information must be “adequate, relevant and not excessive” for the purpose (section 10). Less data also means less to lose.
- Done looks like:
- No ID numbers, dates of birth or home addresses unless the job really needs them.
- What it is:
- The padlock in the browser, spam protection on forms, and logins that are hard to break into.
- Why it matters:
- You must take reasonable steps to keep personal information safe (section 19).
- Done looks like:
- The site loads on https://, forms have spam protection, and admin accounts use strong passwords and two-step login.
- What it is:
- A cookie banner that loads Google Analytics, pixels and similar tools only after the visitor accepts.
- Why it matters:
- POPIA doesn’t mention cookies, but analytics tools record things like IP addresses. Asking first is the safe, honest approach.
- Done looks like:
- Accept and Reject are equally easy, nothing tracks before a choice, and visitors can change their mind later.
- What it is:
- Permission before you send marketing by email, SMS or WhatsApp to people who aren’t your customers yet.
- Why it matters:
- Section 69 requires consent, and the 2025 regulations say an opt-out is not consent.
- Done looks like:
- An unticked box, separate from the enquiry, and every message says who it’s from and how to stop it.
- What it is:
- The person responsible for POPIA in your business. By default it’s the owner or head of the business.
- Why it matters:
- The Act says they may only take up their duties once registered with the Information Regulator (section 55).
- Done looks like:
- Registered on the Regulator’s eServices portal, and named with contact details in your privacy policy.
- What it is:
- A short plan for a hacked site, a lost laptop or a leaked mailbox.
- Why it matters:
- You must tell the Information Regulator and the people affected as soon as reasonably possible (section 22).
- Done looks like:
- You know who to call, and that reports go through the Regulator’s eServices portal.
0 of 8 done
Tick each item your website already has. Open an item to see what “done” looks like.
Every site we build gets the website items on this list checked before launch: privacy policy, cookie consent before analytics, only the form fields you need, and the services that handle your data named. See how we work for the full list of checks.
My take
Most small business websites don't get POPIA wrong in complicated ways. They get it wrong with a copied privacy policy that names someone else's business, and a contact form asking for an ID number nobody needs. Fix those two and register yourself as Information Officer, and you've dealt with the problems I see most often.
Kris, founder of TechOnEdge
Quick questions
Does POPIA apply to a small business or a sole trader?
Yes. POPIA has no exemption based on size. If your business collects personal information, through a website, an inbox or a till slip, the Act applies. Administrative fines can reach R10 million.
Do I need a cookie banner in South Africa?
POPIA doesn’t mention cookies, so there is no South African cookie law like the European one. But analytics and advertising tools collect personal information, so asking before they load is the safest approach. If your site uses no analytics or tracking at all, you may not need a banner.
Is this guide legal advice?
No. It is a plain-language overview from a web designer, based on the Act and the Information Regulator’s own material. For anything specific to your business, especially health, children’s or financial information, speak to a lawyer or contact the Information Regulator.
Sources
- Protection of Personal Information Act 4 of 2013 (Department of Justice)
- Amended Regulations relating to the Protection of Personal Information, 2025 (Information Regulator)
- Information Regulator: registering Information Officers on the eServices portal
- Information Regulator: security compromises must be reported on the eServices portal (April 2025)
- Information Regulator: PAIA Guide (PAIA manuals for private bodies)