POPIA Checklist: 10 Things Every SA Website Needs

Ten checks, one afternoon

POPIA compliance is presented as a project. For a small South African business it is closer to a list. None of what follows needs a consultant, and working through it will tell you honestly where you stand.

Worth setting expectations first: the Information Regulator is not auditing small businesses at random. Enforcement is largely complaint driven, and the realistic trigger is a customer complaint, a breach you have to report, or a corporate client asking for your documents before signing. That is a better reason to do this than a fine you will probably never see. And when a client does ask for proof, it is worth knowing that there is no statutory POPIA certificate to send them.

1. A privacy policy that describes your actual business

Section 18 requires you to tell people what you collect, why, whether it is voluntary, who else sees it, whether it leaves the country, and what their rights are. A downloaded template describing practices you do not follow fails that, because the notification is not accurate. See how to write a POPIA privacy policy.

2. A PAIA manual

The requirement most small businesses have never heard of. Section 51 of PAIA obliges every private body, including a one-person consultancy, to have a manual explaining what records it holds and how to request them. The exemption that once covered smaller organisations expired at the end of 2021. See PAIA manual requirements.

3. A registered Information Officer

You already have one: by default it is the head of the business. Section 55(2) requires registration with the Regulator before taking up the duties, through its eServices portal. See Information Officer duties under POPIA.

4. A cookie banner that actually blocks

If you run analytics or advertising, non-essential scripts must not fire before the visitor chooses. A banner that loads Google Analytics on page load and asks afterwards is recording a decision it already ignored. Refusing must be as easy as accepting. See is your cookie banner POPIA compliant.

5. Forms that collect less, and do not fake consent

Section 10 is the minimality condition: collect only what you need for the purpose. A newsletter signup asking for a physical address fails it.

One correction to advice that used to appear here: do not add a mandatory "I agree to the Privacy Policy" tick box. POPIA requires notification, not consent, and an enquiry rests on the contract or legitimate interest ground. Link to the policy at the point of collection instead. Keep a separate, unticked box for marketing, which genuinely does need consent under section 69.

6. Terms that carry the ECT Act disclosures, if you sell online

Section 43(1) of the ECT Act lists eighteen disclosures an online seller must make available, including your registration number, a physical address for service of legal documents, the full price including delivery, and the customer's cooling-off rights. Section 43(3) lets a consumer cancel within 14 days of delivery if they are missing. Your checkout also needs a review, correct and withdraw step under section 43(2). See website terms and conditions in South Africa.

7. Written contracts with your suppliers

Section 21 requires a written contract with every operator: your host, email provider, accounting software, payroll bureau, CRM, backup service and marketing tool. Most businesses have none of these, and the contract must oblige the operator to maintain the section 19 safeguards and to notify you immediately of unauthorised access. See operator agreements under section 21.

8. A data audit you can actually produce

List what personal information you hold, where it lives, why you have it, who can see it, and how long you keep it. Everything else on this list depends on that list, and it is also what you will need if someone asks for their data or you have to report a breach.

Include the unglamorous places: shared inboxes, WhatsApp, spreadsheets on a laptop, old backups, the CV folder.

9. Retention periods you have written down

Section 14 says no longer than necessary. Other statutes pull the other way: SARS wants five years for tax records, the Companies Act seven for certain company records, the BCEA three years from the date of the last entry for employment records. Decide a period per category, write it down, and make deletion actually happen. See how long can you keep customer data.

10. Security that meets section 19, and a plan for when it fails

Section 19 requires appropriate technical and organisational measures, identifying reasonably foreseeable risks and verifying that safeguards work. Practically: HTTPS, two-factor authentication on email and hosting, access limited to who needs it, and access revoked when someone leaves.

Then decide in advance what you would do in the first 24 hours of a breach, because section 22 requires notification as soon as reasonably possible. See your POPIA breach response plan.

Two more worth knowing about

• Direct marketing. Section 69 restricts electronic marketing. Existing customers are treated differently from strangers, and a non-customer may be approached only once, in a prescribed form. See is cold emailing legal in South Africa.
• Access requests. Someone can ask what you hold about them, and there is a 30 day clock. Decide who handles it before one arrives. See how to respond to a POPIA access request.

POPIA Ready generates a privacy policy, terms of service, a PAIA manual and four other documents from answers about your business, in about two minutes, free to preview. The free interactive checklist scores where you stand on the rest.

General guidance on South African law as at August 2026, not legal advice. What applies to you depends on what you collect and what you sell, and a specific situation deserves a professional opinion.