Guide
Does my website need a POPIA privacy policy?
If your website collects personal information, such as a name and phone number through an enquiry form, POPIA expects you to tell people what you collect and why, and a privacy page is the usual way to do it. This guide explains the basics in plain words; it is not legal advice.
What POPIA is
The Protection of Personal Information Act 4 of 2013, known as POPIA, sets the conditions for how businesses and other organisations collect, use, store and share information about people. Most of it came into force on 1 July 2020, with a one-year grace period that ended on 30 June 2021. The Information Regulator enforces it.
Does a small business website collect personal information?
Almost always. An enquiry form collects a name, a phone number, often an email address and a message. A booking request collects the same, sometimes with more detail. A chat started from a WhatsApp button shares a phone number. Under POPIA, personal information also includes online identifiers, so tracking tools that recognise returning visitors can count too.
What POPIA asks you to tell people
Section 18 of POPIA says that when you collect personal information, you must take reasonable steps to make sure the person knows:
- what information you are collecting, and where it comes from if not from them;
- your name and address;
- why you are collecting it;
- whether giving it is voluntary or required, and what happens if they do not;
- any law that requires you to collect it;
- whether you plan to send it to another country;
- who will receive it, and their rights to see it, correct it, object to how it is used, and complain to the Information Regulator.
A privacy page on your website covers this once, for everyone, and a short line next to your enquiry form can point to it.
Cookies and analytics
POPIA has no rule written only for cookies, but tracking that identifies people is still processing personal information. The careful approach is to ask first: load analytics only after a visitor agrees, and let them change their mind.
That is how the websites we build work. Unless a business asks us for Google Analytics, its site sets no tracking cookies, and taps on the call and WhatsApp buttons are counted without cookies. If it does ask, the site shows a consent banner, nothing from Google loads until the visitor accepts, and a Cookie settings link at the foot of every page lets them change their choice.
What our client websites include
- A POPIA privacy page, linked from the footer of every page.
- A line on the enquiry form explaining how the details will be used.
- Every enquiry stored securely and delivered to the business, and used for nothing else.
- Spam protection on the form, so the inbox holds real enquiries.
- Your own documents, such as a PAIA manual or terms, as pages linked from the footer, if you have them.
Some businesses also need a manual under the Promotion of Access to Information Act (PAIA). Whether yours does, and what your privacy policy must say about your wider business, is a question for the Information Regulator's guidance or your legal adviser.
Where to go from here
More guides: How much does a small business website cost in South Africa? · How to get your business on Google Maps · Free .co.za domain: what you get and what happens if you leave
Get your business online, from R299 per month
Sign up online in five short steps. We usually send your preview link within a few days, and nothing goes live until you approve it.