POPIA compliance for South African websites: a plain-English guide.

What POPIA means for a website

POPIA became enforceable on 1 July 2021. It regulates how organisations collect, use, store, share and delete personal information about people and, in South Africa, about companies too. Your website is often the main place you collect it.

A few terms you will see: personal information is anything that identifies a person, such as a name, email address, phone number, ID number, IP address or location. The responsible party is you, the business that decides why and how the information is used. An operator processes information on your behalf, such as your web host, email provider, booking tool, CRM or Meta for WhatsApp. The data subject is the person the information is about.

The eight conditions for lawful processing, applied to your website

• Accountability: you are responsible for compliance, including what your operators do with the data.
• Processing limitation: collect only what you need, and have a lawful reason, such as consent, taking steps towards a contract the person asked for, or a legitimate interest.
• Purpose specification: collect for a specific, explicit purpose, and keep it only as long as you need it.
• Further processing limitation: do not use information for a new purpose that is incompatible with the original one. An enquiry is not permission to send newsletters.
• Information quality: keep information accurate and up to date.
• Openness: tell people what you are collecting and why when you collect it (section 18). This is your privacy notice.
• Security safeguards: take reasonable technical and organisational measures to protect information (section 19), and notify the Information Regulator and affected people if there is a security compromise (section 22).
• Data subject participation: people can ask what you hold about them and ask you to correct or delete it.

POPIA website compliance checklist

• A privacy notice (privacy policy) linked in your footer and next to every form, written in plain language.
• A short notice at each form: what you collect, why, and a link to the full notice. See the line below the quote form on this page for an example.
• Only the fields you need. Do not ask for ID numbers, dates of birth or addresses unless you genuinely need them.
• A separate, unticked opt-in if you want to send marketing. Never bundle marketing consent into a contact form.
• HTTPS on every page, security headers, spam protection and up-to-date software and plugins.
• Secure storage of form entries and bookings, with limited access and a clear retention period.
• Operator agreements with your host, email provider, booking system, CRM and other tools that process personal information for you.
• Cross-border transfers (section 72): many tools, including Google, Meta and email platforms, store data outside South Africa. Mention this in your notice and choose providers with adequate protection.
• A cookie notice, and consent before loading advertising or tracking pixels.
• A registered Information Officer: by default the head of your business, registered with the Information Regulator through its online portal.
• A PAIA manual where required, and a simple process to handle access, correction and deletion requests.
• A breach response plan: who does what if your website, inbox or database is compromised.

Do contact forms and WhatsApp chats need POPIA consent notices?

Contact and quote forms

Every form that collects personal information needs a notice: section 18 requires you to make people aware of what you collect, who you are, and why, at the time you collect it. A short line under the form with a link to your privacy notice usually does the job.

Consent is not the only lawful reason to process information. When someone sends you an enquiry, replying to them is generally justified because they asked you to, so a consent checkbox is not always required just to answer. It becomes essential when you want to do something else with their details, such as adding them to a mailing list.

WhatsApp chats and chatbots

WhatsApp messages are processed by Meta under its own terms, often outside South Africa, so mention WhatsApp in your privacy notice. A WhatsApp chatbot should open with a short message that links to your privacy notice, avoid asking for sensitive information in chat, and only send marketing broadcasts to people who have opted in. WhatsApp's own Business policies also require opt-in before you message customers.

Cookies, analytics and tracking pixels

POPIA does not mention cookies by name, but cookie IDs, IP addresses and device data can be personal information when they can be linked to a person. Explain in your privacy notice which analytics and advertising tools you use. As good practice, ask for consent before loading advertising and remarketing pixels, and configure analytics to collect only what you need.

Direct marketing by email, SMS and WhatsApp (section 69)

Electronic direct marketing is where many businesses get caught. Under section 69 you may only send it to people who have given consent, or to existing customers about your own similar products or services, provided they had a chance to opt out when you collected their details. You may approach a person who has not previously refused only once to ask for consent. Every marketing message must say who it is from and give an easy way to opt out.

Children's and special personal information

Stricter rules apply to information about children and to special personal information, which includes health, religious beliefs, race or ethnic origin, biometric information and criminal behaviour. This matters for clinics and medical practices, schools and tutors, churches and similar organisations. Generally you need consent from a parent or guardian for children's information, and your forms should not collect special information unless it is essential and properly protected.

What happens if you do not comply?

The Information Regulator can investigate complaints, issue enforcement notices and impose administrative fines of up to R10 million. Some offences, including failing to comply with an enforcement notice, can lead to a fine or imprisonment of up to 10 years. Data subjects can also bring civil claims, and a publicised breach damages customer trust.

How we build POPIA-conscious websites

Every Rainbow website ships with consent built into forms, a clear privacy notice, only the fields you need, spam protection and secure, SSL-protected hosting. We also advise on how to handle customer data captured by chatbots and booking systems. Your business remains the responsible party under POPIA, so we recommend having your privacy notice reviewed by a legal professional. Based in Pretoria, we build for businesses across Gauteng and South Africa.

Sources: Protection of Personal Information Act 4 of 2013 and Information Regulator guidance. General information only, not legal advice.