Privacy Policy for Website South Africa: What to Say

By Next Level Web Solutions · · 6 min read · Compliance and trust

A privacy policy for a website in South Africa should say, in plain language, what personal information you collect, where it comes from, why you use it, who you share it with, how long you keep it, what rights people have and how to reach the person responsible. If it covers those points accurately, it does most of what the Protection of Personal Information Act (POPIA) expects from a public-facing notice.

This guide walks through each part with examples you can adapt. It is general information, not legal advice.

Privacy policy for a website in South Africa: privacy policy vs privacy notice

People use "privacy policy" and "privacy notice" interchangeably, and for a small business website that is usually fine. The distinction is useful, though. A privacy policy is the full document on its own page, describing how your whole business handles personal information. A privacy notice is the short, specific statement shown at the point of collection, such as the line under a contact form.

You need both working together. The notice tells the visitor what is happening right now ("We use your details to reply to your enquiry"), and links to the policy for the detail. If you have a broader overview of the law behind this, read our POPIA website compliance checklist first.

Your policy should also be written for visitors, not lawyers. Short sentences, headings that match the questions people have, and no pages of boilerplate that does not apply to you.

What you collect and where from

List the categories honestly. For most small business sites that means some of the following:

  • Information people give you: name, email address, phone number, company, message content, booking details.
  • Information collected automatically: Internet Protocol (IP) address, browser and device type, pages visited, referring site, and cookie identifiers.
  • Information from other sources: for example, a lead supplied by a referral partner, or details from a social media enquiry.

Say where each comes from. A useful format is a small table or bullet list: "Contact form: name, email, message", "Analytics: anonymised usage data, only if you accept analytics cookies". The test is whether every form, plugin and tracker on your site appears in the policy. If you installed a chat widget last month and it is not mentioned, the policy is already out of date.

If you collect special personal information, such as health details for a medical practice, say so explicitly and explain the extra care you take. Those cases deserve attorney review.

Why you collect it

For each category, give a specific purpose. Good examples:

  1. To reply to enquiries and quote requests.
  2. To deliver a service the person has asked for, such as a booking.
  3. To send a newsletter, only to people who opted in.
  4. To understand which pages are useful so we can improve the site.
  5. To meet legal obligations, such as keeping invoices.

Avoid vague phrases like "to improve our business" on their own. Also avoid listing purposes you do not actually have, as that makes the policy longer without making you safer. POPIA expects information to be collected for a specific, lawful purpose, so a policy that names real purposes is both more honest and more useful.

If you rely on consent for something (marketing emails, non-essential cookies), say that, and explain how the person can withdraw it. Our guide to a cookie consent banner for POPIA covers the cookie side.

Who you share it with

Visitors want to know who else sees their information. List the categories of recipients, and name the main ones where practical:

  • Service providers acting on your behalf: web host, email provider, mailing platform, customer relationship management (CRM), analytics provider, payment processor.
  • Professional advisers: accountants, attorneys, auditors, where relevant.
  • Authorities: where the law requires disclosure.

State whether you sell personal information (most small businesses do not, and should say so plainly). Also mention cross-border transfers: many popular tools store data outside South Africa. Section 72 of POPIA places conditions on transferring personal information to a foreign country, generally requiring that the recipient is subject to comparable protection or that the person consents, among other grounds. If your tools are based abroad, acknowledge this in the policy and make sure the provider's terms are adequate.

How long you keep it

POPIA (section 14) says you should not keep personal information longer than needed for the purpose, unless a law requires or allows longer retention. Give a retention period for each category rather than a vague promise. For example:

  • Enquiry emails: kept for a stated period after the matter closes, then deleted.
  • Newsletter subscribers: kept until they unsubscribe.
  • Invoices and accounting records: kept for the period the law requires.
  • Analytics data: kept for the period you set in the tool.

Check the actual settings in your tools so the policy reflects them. Pick periods you can honestly follow, and put a recurring reminder in your calendar to clear out old enquiries.

User rights and how to exercise them

Under POPIA, people can ask whether you hold information about them, ask to see it, ask you to correct or delete it, object to certain processing, withdraw consent and withdraw from direct marketing. They can also complain to the Information Regulator.

Your policy should tell people how to do this in a single clear step: a dedicated email address, the name or role of your information officer, and what to expect. State a realistic response time you can meet. Include the Information Regulator's contact details or a link to its website so people know where to escalate.

Make sure the process works. Send a test request to your own address and see what happens. If it lands in an inbox nobody checks, fix that before publishing.

Keeping the policy matched to reality

The most common failure is not a badly written policy but a stale one. A policy that promises "we do not use cookies" while your site loads advertising pixels is worse than none. Build habits to keep it accurate:

  • Review it whenever you add a form, plugin, embed or marketing tool.
  • Put a "last updated" date at the top and update it when it changes.
  • Re-check your cookie list and your list of providers every few months.
  • Keep the policy linked in the footer of every page and beside every form.

Treat it as part of maintaining the site rather than a one-off job. If you would like us to build the pages and make sure the forms, banner and policy match, see our web design and development services or talk to us about your site.

This article is general information, not legal advice. If you operate in a regulated sector, handle children's information or health data, or transfer data abroad at scale, have an attorney review your policy before publishing.

Frequently asked questions

Can I copy a template privacy policy?

Templates are a good starting structure, but they only protect you if they match what your site actually does. Copying one wholesale often leaves in clauses about tools you do not use and leaves out ones you do. Edit it against your own data inventory, and get legal review if your sector is regulated.

Where should the policy link go?

Put a link in the footer of every page so it is always reachable, and add a short link or sentence next to every form that collects personal information. If you use a cookie banner, link the policy from there too.

Want this done for your business?

Book a free call →