POPIA Website Compliance Checklist for SA Businesses

By Next Level Web Solutions · · 7 min read · Compliance and trust

POPIA website compliance means making sure your site collects, uses, stores and shares personal information in line with the Protection of Personal Information Act. In practice that comes down to a clear privacy notice, proper consent on forms, honest cookie handling, a registered information officer and written agreements with anyone who handles data for you.

This checklist is written for owners of small South African businesses who want to know what to do, in what order, without reading the Act cover to cover. It is general information, not legal advice, and we come back to that at the end.

POPIA website compliance: what POPIA means for a website

POPIA applies to any "responsible party" that processes personal information of living people (and, in some cases, existing companies). If your website has a contact form, a newsletter sign-up, a booking form, a quote request or even analytics that identify visitors, you are processing personal information. Size does not exempt you, and neither does running the business from a home office.

The Act is built around eight conditions for lawful processing (sections 8 to 25). For a website owner the useful way to read them is as five plain questions:

  1. Do you have a good reason to collect this information?
  2. Did you tell people what you are doing with it?
  3. Do you collect only what you need?
  4. Do you keep it safe and delete it when you no longer need it?
  5. Can people see it, correct it or ask you to remove it?

If you can answer yes to all five for every form and tool on your site, you are most of the way to POPIA website compliance.

Personal information your site collects

Start with an inventory. Open every page and write down each place data enters or leaves. A typical small business site includes:

  • Contact and quote forms: name, email address, phone number and the message itself, which often contains more than you expect.
  • Newsletter sign-ups: email address and sometimes first name.
  • Booking or appointment forms: names, dates, sometimes health or financial details, which are treated as special personal information and need extra care.
  • Analytics and advertising pixels: Internet Protocol (IP) addresses, device identifiers and browsing behaviour.
  • Embedded services: maps, videos, chat widgets and social buttons that load third-party scripts.
  • Server and email logs: your host and your email provider keep records too.

For each item, note where the data goes (your inbox, a spreadsheet, a customer relationship management (CRM), a mailing platform), who can see it and how long it stays there. This simple table is the foundation for everything else, including your privacy policy. If you want a deeper look at writing that document, see what a South African website privacy policy should say.

Privacy notice and purpose

POPIA (section 18) expects you to make people aware, ideally before or at the point of collection, of who you are, what you collect, why you collect it, whether providing it is voluntary, who you share it with and how they can exercise their rights. A link buried in a footer is not enough on its own for forms. Put a short sentence beside each form, for example: "We use your details only to reply to your enquiry. Read our privacy policy."

Keep purposes specific. "To respond to your quote request" is a purpose. "For business purposes" is not. If you later want to use the same information for something else, such as adding someone to a mailing list, you need a separate lawful basis for that new purpose.

Consent on forms and newsletters

Not every use of personal information needs consent. You can often rely on another justification, such as needing the information to respond to a request or to perform a contract. Marketing is different. Sending electronic direct marketing such as email or SMS generally requires opt-in consent (section 69), with a limited exception for existing customers you have contacted about similar products, and every message needs a simple way to opt out.

Practical rules for forms:

  • Use an unticked checkbox for newsletter consent, never a pre-ticked one.
  • Keep the newsletter checkbox separate from the "send my enquiry" action.
  • Record when and how consent was given, for example the date and the form it came from.
  • Make unsubscribing a single step, and honour it promptly.
  • Do not bundle consent: someone asking for a quote should not be forced to join a mailing list.

Cookies and analytics

POPIA does not mention cookies by name, and to our knowledge the Information Regulator has not issued dedicated cookie guidance. Still, cookies and similar identifiers can be personal information when they relate to an identifiable person, and tracking visitors without telling them is hard to defend. The cautious approach is simple: essential cookies run by default, everything else (analytics, advertising, embedded third-party content) waits for the visitor's choice. We cover the mechanics in our guide to a cookie consent banner for POPIA.

Also check what your analytics tool does with data. Some settings share data with the vendor or retain IP addresses longer than you need. Switch off what you do not use.

Information officer and operators

Every responsible party has an information officer. In a private business this is generally the owner, managing director or equivalent head of the business unless someone else is formally designated. The information officer is responsible for compliance and for dealing with the Information Regulator and with data requests. Section 55 requires information officers to be registered with the Information Regulator before they take up their duties, and registration is done on the Regulator's online eServices portal. Check the Regulator's website for the current process.

Then look at your operators. An operator is anyone who processes personal information on your behalf: your web host, your email provider, your mailing platform, your CRM, your bookkeeper if they see client data, and the agency that maintains your site. POPIA expects a written agreement requiring operators to keep the information secure and to treat it as confidential. Many large providers offer a data processing addendum you can accept online, and your own web agency should be willing to put terms in writing.

If you host or send email through us, that is part of hosting, domains and business email setup, and we are happy to discuss what an agreement should cover.

Breach readiness and what to do next

A security compromise means information may have been accessed or acquired by an unauthorised person. POPIA (section 22) requires you to notify the Information Regulator and, generally, the affected people as soon as reasonably possible after discovering the compromise. Notification to affected people may be delayed only if a public body investigating offences, or the Regulator, determines it would impede a criminal investigation. You cannot do that well if you are improvising, so prepare now:

  1. Write down who is responsible for responding, with phone numbers.
  2. Know where your data lives and how to revoke access quickly.
  3. Keep tested backups and use strong, unique passwords with two step sign in.
  4. Keep a simple log of incidents, even minor ones, and what you did.
  5. Know how to contact the Information Regulator and your hosting provider.

Security basics also reduce the chance of a breach in the first place, which is covered in our website security basics guide.

If you would like help with the website side of this, such as forms, banner setup, hosting and a matching privacy page, you can get in touch with us and we will go through it with you. This article is general information, not legal advice. For regulated sectors such as health, finance or legal services, or if you handle sensitive data, have an attorney review your policies and processes.

Frequently asked questions

Does POPIA apply to my small business site?

If you process personal information, such as names and email addresses from a contact form, then generally yes. The Act does not carve out small businesses. What changes with size is how much you have to document, not whether you must comply.

Is this legal advice?

No. This is a practical checklist based on our general understanding of the Act. For regulated sectors or anything unusual, such as health data or children's information, have an attorney review your approach.

Want this done for your business?

Book a free call →