POPIA stands for the Protection of Personal Information Act, a South African law (Act 4 of 2013) that controls how any business collects, stores, uses and shares information about people. If you have a customer list, a contact form or a staff file, it applies to you. The Act came into full force on 1 July 2020, with a one-year grace period that ended on 30 June 2021, so there's no "getting ready for it" any more. It's the law now.
This is the plain-language version, with a focus on what the POPIA Act means for a small business that runs a website.
What does POPIA actually mean?
The Act protects "personal information". That's anything that identifies a living person, or a company, which makes it wider than most people expect. Names, phone numbers, email addresses, ID numbers, delivery addresses, photos and even IP addresses can all count.
The person the information is about is called the data subject. You, the business, are the responsible party. If you use someone else to handle the data for you, say a payroll company or a hosting provider, that company is an operator.
POPIA doesn't ban you from holding personal information. It says you may do so, as long as you do it properly and can show that you did.
Does POPIA apply to a small business?
Yes. There's no exemption for size. A Durban plumber with a spreadsheet of customers is covered. So is a Cape Town online shop with 20,000 subscribers.
There are narrow exceptions, such as purely personal or household use, and certain state security matters. A business collecting customer details is not in any of them.
The eight conditions in everyday language
POPIA is built around eight conditions for lawful processing. "Processing" just means doing anything with the data: collecting, saving, emailing, sharing, deleting.
| Condition | What it means for you |
|---|---|
| Accountability | Someone in the business is responsible, and it isn't "nobody". |
| Processing limitation | Collect only what you need, and have a lawful reason, usually consent or a contract. |
| Purpose specification | Know why you're collecting it, and don't keep it forever. |
| Further processing limitation | Don't use it for something unrelated to what you told people. |
| Information quality | Keep it accurate and up to date. |
| Openness | Tell people what you collect and why, usually in a privacy policy. |
| Security safeguards | Protect it from loss, theft and unauthorised access. |
| Data subject participation | Let people see their information and ask for corrections or deletion. |
Honestly, most small businesses already do half of this without realising. The gaps are usually in the paperwork: no privacy policy, no consent wording on forms, and nobody who has formally taken responsibility.
What POPIA means for your website
Your website is often where the most personal information arrives. Go through these places.
Contact and quote forms
A form asking for a name, number and message is collecting personal information. Add a short line under the button saying what you'll use the details for and linking to your privacy policy. Don't ask for an ID number or a physical address if all you need is an email.
Online shops and payments
If you take payments through PayFast, Yoco or another gateway, the gateway handles the card details. That helps, but you still hold names, addresses and order histories. Those need to be kept safely and deleted when you no longer have a reason to keep them.
Newsletters and marketing
Sending unsolicited marketing by email or SMS needs the person's consent, unless they're an existing customer you're marketing similar products to and they've had a chance to opt out. Every message needs a working unsubscribe link. Buying a list and mailing it is a quick way to land in trouble.
Cookies, analytics and tracking
POPIA doesn't have a cookie law like Europe's, but if your analytics or advertising tools collect information that identifies people, the same conditions apply. A short cookie notice and a clear privacy policy cover most small sites.
Where your data sits
Your website, its database and its backups hold personal information, so the security condition applies to them. Keep WordPress, plugins and themes updated. Use strong, unique passwords and turn on two-step login for admin accounts. Make sure the site runs over HTTPS. Ask your hosting provider where the servers are and how backups are handled. If personal information goes to a server outside South Africa, POPIA has rules about that too, and your privacy policy should say so.
Do you need an information officer?
Every responsible party has one. In a company, it's the CEO or equivalent by default. In a sole proprietorship, it's the owner. You can formally appoint a deputy, and many small businesses simply stay with the default.
What matters is that the information officer is registered with the Information Regulator. That's done through the Regulator's online portal and it's free. Registration is a legal duty, and a surprising number of small businesses still haven't done it.
The information officer is responsible for making sure the business complies, dealing with requests from people who want to see their data, and working with the Regulator.
What happens if there's a data breach?
If you have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, you must tell the Information Regulator and the affected people as soon as reasonably possible. Think of a hacked website, a stolen laptop or a staff member emailing a spreadsheet to the wrong address.
Write down what happened, who was affected and what you did about it. Even a short log shows you took it seriously.
What are the penalties?
The Information Regulator can investigate complaints and issue enforcement notices. For serious offences, the Act allows administrative fines of up to R10 million and, in some cases, imprisonment. In practice, a small business that makes an honest effort, responds to complaints and fixes problems is in a very different position from one that ignores the Act altogether.
A simple POPIA checklist for a small business
- Decide who your information officer is and register them with the Information Regulator.
- List what personal information you hold, where it lives and who can see it.
- Delete what you no longer need.
- Write or update your privacy policy and put it in the footer of your website.
- Add consent wording to every form and to your newsletter sign-up.
- Get written agreements with anyone who handles data for you, such as payroll, accounting or marketing providers.
- Tighten security: updates, strong passwords, two-step login, backups.
- Write down what you'll do if there's a breach.
- Train your staff. Most breaches are a person making a mistake.
None of this needs a lawyer for every step, though for contracts and complicated cases it's worth getting one.
Frequently asked questions
What does POPIA stand for?
It stands for the Protection of Personal Information Act, 2013. You'll also see it written as POPI Act or just POPI, and they all mean the same thing.
When did POPIA come into effect?
Most of the Act commenced on 1 July 2020. Businesses then had until 30 June 2021 to become compliant, so it's been fully enforceable since then.
Do I need a privacy policy on my website?
In practice, yes. The openness condition says you must tell people what you collect, why, and what rights they have. A privacy policy linked from your footer and your forms is the normal way to do it.
Who do I complain to if a business misuses my information?
You can lodge a complaint with the Information Regulator. Its website is inforegulator.org.za, where you'll also find forms and guidance.
Getting your website in order
A compliant website starts with a host that keeps things secure and a site built with proper forms and policy pages. If you're setting that up, have a look at our website hosting options or talk to us about web design that includes the privacy and consent wording your forms need. For legal advice on your specific situation, speak to an attorney who knows POPIA.
