POPIA Compliance for E-Commerce and Online Stores in South Africa

Two statutes, not one

Most compliance advice for South African online stores talks only about POPIA. That is half the picture. An online store is governed by POPIA for the personal information it handles, and by the Electronic Communications and Transactions Act for how it sells. The ECT Act is the one that gets ignored, and it is the one with the sharpest consequence.

The Consumer Protection Act sits on top of both, governing quality, returns and unfair terms.

The disclosure list almost no SA store publishes

Section 43(1) of the ECT Act sets out eighteen items a supplier must make available to consumers before they transact. It is a list, so it can be worked through and finished.

The ones stores most often miss:

• Your registration number and place of registration, if you are a company or close corporation
• A physical address at which you will accept service of legal documents, which is uncomfortable for home-based sellers but not optional
• The full price, including delivery, taxes and any other charges. A delivery fee revealed only at the final step is a compliance problem, not a conversion tactic
• The period within which goods will be dispatched or delivered
• Your return, exchange and refund policy, available before the sale rather than produced after a dispute
• The consumer's rights under section 44, the cooling-off right described below

Why it matters: under section 43(3), if you fail to comply the consumer may cancel the transaction within 14 days of receiving the goods or services. An incomplete disclosure turns every sale into a two week option the buyer can walk away from. The full list is in website terms and conditions in South Africa.

Your checkout has legal requirements, not just UX ones

Section 43(2) requires that the customer be given an opportunity to review the entire transaction, correct any mistakes, and withdraw from it, before finally placing the order.

A one-click checkout that charges immediately does not satisfy this. Neither does a flow where the only way back is the browser back button. You need an order review step that shows the whole order, allows changes, and lets the customer abandon. Breaching 43(2) carries the same 14 day cancellation right as omitting the disclosures.

Section 43(5) separately requires a payment system that is sufficiently secure by accepted technological standards, and section 43(6) makes you liable for damage caused by failing that. In practice this is the argument for using an established gateway rather than handling card details yourself.

The cooling-off right is the ECT Act, not the CPA

This is the most common error in South African e-commerce advice, and it is worth being precise because the two rights have different lengths and different triggers.

• Seven days, no reason needed, comes from section 44 of the ECT Act and applies because the transaction was electronic. The clock runs from receipt for goods, and from conclusion for services. You may charge only the direct cost of returning the goods, and must refund within 30 days.
• Five business days comes from section 16 of the CPA and applies only where the sale resulted from direct marketing, not because it happened online.
• Six months on defective goods comes from CPA sections 55 and 56, and within that window the customer chooses repair, replacement or refund.

Section 42 of the ECT Act excludes a long list from the seven day right, including foodstuffs, personalised goods, unsealed software and media, event bookings for a specific date, and services that began with the customer's agreement. If you sell digital goods or bookings, an exclusion probably applies to you and your policy should say which, rather than leaving the customer to guess. See refunds and returns in South Africa.

POPIA at the checkout

Section 10 requires processing to be adequate, relevant and not excessive. Ask for each field whether you could fulfil the order without it. A date of birth on a book order is hard to justify.

Section 18 requires you to tell people what you are collecting and why, at the point of collection. A link to your privacy policy at checkout does this.

One correction to common advice: you do not need a mandatory tick box consenting to your privacy policy. POPIA requires notification, not consent, and processing an order rests on section 11(1)(b), the contract ground, rather than on consent. Forcing a tick confuses notice with consent and makes your position weaker, not stronger. A newsletter box is different, and that one must be unticked by default.

Abandoned carts and marketing

Capturing an email address at the first step of checkout and then emailing people who did not complete is direct marketing, and section 69 applies. If they are not yet a customer, you do not have the existing customer exception, so an abandoned cart email to a first-time visitor who never bought is on shaky ground. Once someone has bought, the section 69(3) exception covers marketing your own similar products, provided you gave them a chance to object at collection and in every message. See is cold emailing legal in South Africa.

Everyone who touches an order

A single order typically involves several other businesses, and most are your operators under POPIA, requiring a written contract under section 21.

• Your payment gateway. PayFast, Yoco and similar process card data on their own systems, so card numbers never reach you, which is the point of using them. You still disclose the sharing in your privacy notice.
• Couriers. Handing a name, address and phone number to a delivery company is a disclosure. Disclose it, and have an agreement.
• Your store platform, email tool and analytics, most of which store data outside South Africa, which brings section 72 into play.

See operator agreements under section 21 for what those contracts must contain.

How long to keep order data

Section 14 says no longer than necessary for the purpose, but other statutes require you to keep some of it:

• SARS, five years for tax and financial records
• Companies Act, seven years for certain company records
• CPA Regulations, three years for various supplier records

The practical approach is to separate the transaction record you must keep from the marketing profile you need not. Keeping an invoice for SARS does not entitle you to keep a browsing history and a wishlist for the same period.

POPIA Ready generates terms of service carrying the section 43 disclosures, a refund policy covering the ECT Act and CPA rights, a privacy policy and four other documents, free to preview. The free checklist will show you what else is missing.

General guidance on South African law as at August 2026, not legal advice. Online selling sits across POPIA, the ECT Act and the Consumer Protection Act, and a specific store deserves a professional opinion.