This is a practical guide, not legal advice. For decisions specific to your business, speak to an attorney or the Information Regulator.
The Protection of Personal Information Act, known as POPIA, sets rules for how South African businesses collect, use and keep personal information. It applies to businesses of every size. For a small business website, the practical question is simple: does your site collect or track anything about a person? If it has a contact form, a quote request, a newsletter signup, a checkout, an analytics tool or a cookie, the answer is yes.
The website checklist
- Publish a privacy notice. Say what you collect, why you collect it, who you share it with, how long you keep it, how people can see or delete it, and how to complain. Put a link to it in the footer of every page.
- Get consent before non-essential cookies and tracking. Analytics and advertising scripts, such as Google Analytics or a Facebook Pixel, should not run until a visitor agrees. Essential cookies that make the site work are different. A consent banner with clear choices handles this.
- Keep forms short and honest. Ask only for what you need, such as a name, email and message for an enquiry, and explain in a line how the details will be used.
- Use a separate opt-in for marketing. A visitor who sends an enquiry has not agreed to a newsletter. Offer marketing as its own, unticked choice, and make unsubscribing easy.
- Appoint an Information Officer. In a small business that is usually the owner. Registering the Information Officer with the Information Regulator is part of the requirement.
- Know your service providers. Your website platform, email tool and analytics provider handle personal information for you. Check they are reputable and that your agreements with them are in order, including where data is stored.
- Be able to act on requests. People can ask to see, correct or delete their information. Know where it lives, such as your inbox, a form log and your email list, so you can respond.
- Keep it secure and have a plan. Use strong passwords and two-step login, keep software updated and know what you would do if there were a breach.
Mistakes we see most
- A cookie banner that only says "OK", with no way to decline, while analytics still runs.
- A privacy policy copied from a foreign site that does not mention POPIA or the Information Regulator.
- Pre-ticked marketing boxes on contact and checkout forms.
- Forms that ask for far more than the business needs.
How this shows up on a GDS website
Our own site follows this pattern: a consent banner that separates essential from analytics cookies, with analytics switched off until a visitor opts in, plus clear privacy and cookie policies. If you are building a store, read our guide to selling online in South Africa, and if your site collects enquiries, it is worth having this sorted before launch rather than after.
Does POPIA apply to my small business website?
Yes, if the site collects or tracks personal information, which includes contact forms, newsletter signups, checkouts, analytics and cookies. POPIA applies to businesses of every size.
Do I need a cookie banner under POPIA?
If you use non-essential cookies or tracking, such as analytics or advertising pixels, you should get consent first and let visitors decline. A clear banner with accept and essential-only options is the usual way to do it.
What must a POPIA privacy policy include?
What information you collect and why, who you share it with, how long you keep it, how people can access, correct or delete it, how you protect it, and how to complain to the Information Regulator.
Do I need an Information Officer?
Every business that processes personal information has one, and in a small business that is typically the owner. Registering them with the Information Regulator is part of meeting the requirement.