The 2026 POPIA Compliance Checklist for Small Businesses

Is Your Small Business POPIA Compliant?

The Protection of Personal Information Act (POPIA) is fully enforced, and the Information Regulator is actively monitoring compliance. As a small business owner in South Africa, compliance can seem daunting. This simple checklist will help you get your website compliant quickly.

Phase 1: Legal Documents and Website Updates

• Update Your Privacy Policy: Ensure it explicitly mentions POPIA, details what data you collect, and lists user rights.
• Add a Cookie Banner: If you use tracking cookies (like Google Analytics or Facebook Pixel), you must ask for consent before setting them.
• Publish an Acceptable Use Policy: If users can interact with your site (comments, forums), you need this to limit your liability.
• Update Terms and Conditions: Ensure your T&Cs reference your new privacy practices.
• Secure Contact Forms: Add a checkbox to your forms securing explicit consent before users submit their details.

Phase 2: Internal Processes

• Appoint an Information Officer: By default, this is the head of the business (CEO/Owner). You must officially register them with the Information Regulator.
• Conduct a Data Audit: Figure out exactly what personal information you hold, where it's stored, and who has access to it.
• Delete Old Data: POPIA says you cannot keep data longer than is necessary. If you have marketing lists from 5 years ago that you never use, delete them.

Phase 3: Security Basics

• SSL Certificate: Ensure your website URL starts with "https" not "http".
• Password Management: Use strong passwords and two-factor authentication (2FA) for all your business accounts (email, hosting, CRM).
• Limit Access: Only give employees access to the data they absolutely need to do their jobs.

Get Your Legal Documents Sorted Today

The easiest way to check off the first phase of this checklist is to use POPIA Ready. We generate all the essential legal documents your website needs, customised for your business, in under a minute.