If your website has a contact form, an email signup, a checkout page, or even a cookie, you’re collecting personal information – and POPIA applies to you in full. Most South African business owners know the Act exists. Far fewer have actually checked whether their website meets it.
That gap is getting riskier. The Information Regulator’s 2025/26 Annual Performance Plan, presented to Parliament’s Portfolio Committee on Justice and Constitutional Development on 5 May 2026, signals a firmer enforcement posture: more proactive audits, tighter direct marketing rules following the April 2025 POPIA Regulations amendments, and mandatory use of the Regulator’s e-portal for breach notifications – which saw a 40% jump in monthly submissions in early 2025/26. Fines are already being issued, and SMEs are not exempt.
POPIA applies to every website, no exceptions
POPIA applies to any person or organisation, public or private, that processes personal information in South Africa. It has been enforceable since 1 July 2021.
There’s no SME carve-out and no revenue threshold. A one-person business with a two-page site is held to the same standard as a listed company with a national customer database. If your website collects information about a person, the Act applies to you.
Why this is worth getting right, not just avoiding a fine
It’s easy to file POPIA under “compliance admin.” That undersells it. People are more aware of online privacy than ever, and a website that visibly respects their data builds trust before a single email is exchanged. Compliance is a credibility signal, one your less careful competitors aren’t sending.
Four things your website needs
You don’t need a full rebuild. For most small and medium businesses, these four items cover the core requirements.
1. A clear privacy policy
A dedicated page answering four questions in plain language:
- What data do you collect? (names, emails, IP addresses)
- Why are you collecting it? (to send quotes, deliver products)
- How do you use it? (processing orders, sending updates)
- Who do you share it with? (courier companies, email platforms)
2. A simple cookie notice
Cookies track behaviour, from cart contents to login sessions to analytics, so POPIA requires you to disclose their use. A banner on first visit is the standard, low-friction fix.
3. Clear contact form consent
If someone submits a form for a quote, you can’t start emailing them a weekly newsletter without separate, explicit permission. Add a short statement or checkbox above the submit button:
- “By submitting this form, you agree that we can use your details to contact you about your quote request.”
- “[ ] Tick this box if you’d like our monthly newsletter with industry tips and discounts.” (Leave unticked by default, this isn’t optional.)
4. A data retention statement
You can’t hold personal data indefinitely just because it’s convenient. Keep it only as long as needed for its original purpose, or as long as South African tax law requires for financial records, and state that timeframe in your privacy policy.
What happens if you don't fix this
Fines are real, and enforcement is trending up. But the bigger risk for most small businesses is reputational: a breach that goes public, or a spam complaint from someone who never opted in, costs you customers who won’t come back, and hurts every lead you try to generate afterward. Getting the four essentials right does the opposite: it signals a professional, trustworthy business people are comfortable handing their information to.
Next steps
Start with your privacy policy, it’s the foundation the other three items reference. Then add the cookie banner, tighten your form consent language, and set a retention period you can actually defend if asked.
Not sure whether your website is meeting POPIA requirements? We can help you identify the gaps, understand what needs attention and make the necessary website changes. Start with a practical conversation about your website and what compliance means for your business.
Frequently Asked Questions about POPIA Compliance
Does POPIA apply to my website?
Yes. If your website collects or processes personal information such as names, email addresses, telephone numbers, IP addresses or customer details, POPIA may apply to your business. The size of your business does not automatically exempt you from POPIA requirements, so even a small business website can have compliance obligations.
What does a website need to be POPIA compliant?
A POPIA-compliant website should clearly explain how personal information is collected, used, stored and shared. Depending on how your website operates, this may include a clear privacy policy, appropriate cookie disclosures, consent mechanisms on forms, suitable direct marketing consent and a defined data retention approach.
Do I need a privacy policy on my website for POPIA?
If your website processes personal information, a clear privacy policy is an important part of demonstrating how your business handles that information. It should explain what information you collect, why you collect it, how it is used, who it may be shared with and how long it is retained.
Does my website contact form need a POPIA consent checkbox?
Not every contact form needs the same type of consent mechanism. If someone is submitting their information to request a quote or make an enquiry, the form should clearly explain how their information will be used. Separate consent should be obtained if you also want to use those details for marketing communications.
Can I add someone to my newsletter because they contacted my business?
Not automatically. Someone submitting a contact form does not necessarily mean they have agreed to receive ongoing marketing communications. If you want to use their details for newsletters or promotional messages, your marketing process should comply with POPIA’s direct marketing requirements and provide an appropriate way for recipients to opt out.
Does POPIA apply to small businesses and startups?
Yes. POPIA is not limited to large companies. A small business or startup that processes personal information can still have obligations under the Act. The practical steps required will depend on what information your business collects, why it is collected, how it is processed and who has access to it.