POPIA Compliance for South African Websites: A Simple Guide

If your website in South Africa collects any personal information, even just a name and email address from a contact form, the Protection of Personal Information Act (POPIA) applies to you. We hear the same misconception constantly: “we’re too small for this to matter.” POPIA doesn’t have a size threshold - it applies the moment you process someone else’s personal information, regardless of how many employees you have.

The good news is that getting compliant is far less daunting than most business owners assume. Here’s what actually matters.

What POPIA covers, in plain terms

POPIA is South Africa’s data protection law - broadly the local equivalent of Europe’s GDPR. It’s been fully enforceable since 1 July 2021, and the Information Regulator does have the power to issue fines for serious or repeated non-compliance.

“Personal information” is defined broadly. It covers names, email addresses, phone numbers, ID numbers, and even a visitor’s IP address once it’s captured and stored, for example through analytics.

Does POPIA apply to your website?

If your site includes any of the following, it does:

• A contact, enquiry or booking form
• A newsletter or email signup
• Analytics or tracking, such as Google Analytics
• An online store capturing customer details
• Cookies that identify or profile visitors

That covers the vast majority of business websites currently online in South Africa.

The four things your site actually needs

1. A clear Privacy Policy

Non-negotiable. It needs to explain what information you collect, why, how it’s used, who it might be shared with, how long you keep it, and how someone can exercise their rights under POPIA. Every page on the site should link to it - ours sits in the footer.

2. A lawful basis for processing

Most websites rely on consent as that basis. In practice, that means a visible note near your contact form confirming that submitting it means agreeing to your Privacy Policy.

3. A working cookie consent mechanism

If you run analytics or tracking cookies, visitors need a genuine choice to accept or decline them, not just a banner that dismisses on scroll without actually changing anything. Google’s Consent Mode is worth knowing about here if you run Google Analytics.

4. Reasonable security measures

POPIA requires “reasonable” technical and organisational steps to protect the data you hold. In practice: HTTPS across the whole site, a reputable hosting provider, and not leaving customer data sitting in an unsecured spreadsheet somewhere.

The part most sites still miss

Beyond the website itself, businesses that process personal information on any real scale are expected to register their Information Officer with the Information Regulator. It’s a step that’s easy to overlook because it happens outside the website entirely, but it’s part of actual compliance, not just a nice-to-have.

Getting compliant without a legal bill

You don’t need a corporate legal budget to get the fundamentals right. POPIA Ready generates POPIA-compliant Privacy Policies, Terms & Conditions and related documents tailored to South African businesses in minutes - it’s the same tool we use to generate the legal pages on our own client sites.

A working compliance checklist

• Publish a Privacy Policy and link to it from every page
• Add a consent note to every form that collects personal information
• Show a genuine cookie consent banner if you run analytics or tracking
• Serve the entire site over HTTPS
• Collect only the information you actually need
• Have a plan for responding to access or deletion requests
• Register your Information Officer if your processing warrants it

---

Getting this right protects your business and builds trust with the people giving you their information. If you want a website that’s compliant, fast and properly designed from day one, get in touch, and generate the legal documents to go with it at POPIA Ready.

This article is general information, not legal advice.