POPIA and your website: what small businesses should know

South Africa's Protection of Personal Information Act (POPIA) applies to almost every business that collects names, phone numbers or email addresses, and your website probably does. This is a plain-English overview, not legal advice, but it covers what most small businesses need to think about.

Have a privacy notice

Your website should explain what personal information you collect, why, who you share it with and how people can contact you about it. Keep it clear and honest. Ours is linked in the footer of every page.

Get consent for marketing

If you want to send newsletters or promotions, people need to agree, and every email should include an easy way to unsubscribe. Pre-ticked boxes don't count as consent.

Be upfront about cookies and analytics

Tools like Google Analytics use cookies. Tell visitors, and give them a choice. A simple cookie notice with Accept and Decline is a good approach.

Only collect what you need

If you don't need someone's ID number or home address, don't ask for it. Less data means less risk.

Keep it secure

Use HTTPS (the padlock), keep software updated, use strong passwords, and be careful about who has access to customer information.

Know where to go

The Information Regulator of South Africa oversees POPIA and publishes guidance on its website. If you're unsure about your situation, speak to a legal professional.