POPIA and Your Website: What Small Businesses Actually Need (Not a Law Firm’s Version)

This is a development perspective, not a legal one. For anything specific to your business, talk to an actual lawyer. But most small businesses just want to know, in plain terms, what a website genuinely needs to have. Here’s that version.

What POPIA actually is

The Protection of Personal Information Act is South Africa’s data protection law, in effect since mid-2021, enforced by the Information Regulator. In spirit, it’s close to what GDPR does in Europe: if you collect personal information from someone, name, email, phone number, you have obligations around how you collect, use, store, and protect it.

Why this applies to a small business website, not just big companies

A contact form collecting a name and email address is already processing personal information. So is an email newsletter signup, a booking form, or an account system for an online store. POPIA doesn’t have a small-business exemption for this; the obligations scale with what you actually collect and do with it, not with company size.

What a website genuinely needs

• A plain-language privacy policy explaining what information you collect and why, not a copy-pasted legal document nobody reads, but a real, findable page.
• A cookie or consent notice if the site uses analytics, marketing pixels, or anything else that tracks visitors. This is specifically one of the checks the free SEO Checker runs.
• A contact or checkout form that only asks for what it actually needs. Collecting a date of birth on a newsletter signup, with no real use for it, is exactly the kind of over-collection POPIA is aimed at.
• Reasonable security around anything submitted: HTTPS as a baseline, and no storing sensitive form data in plain text where it doesn’t need to be.

What it doesn’t require

Not a lawyer on permanent retainer. Not an EU-style cookie wall with forty individual toggles before a visitor can see the page. Not blocking every visitor behind a consent gate that tanks your conversion rate for the sake of looking compliant. The actual standard is reasonable, proportionate care, not maximum friction.

Where this actually gets built in

For a site built properly from the start, most of this is structural: a real privacy policy, a genuine consent notice where tracking is used, and forms that don’t over-collect. It’s part of what gets planned into a build rather than bolted on afterward once someone asks about it.

None of this replaces proper legal advice for your specific business. It’s the practical, development-side version of the same conversation.

Related