If your website has a contact form, a newsletter sign-up or an online shop, it collects personal information. In South Africa that means the Protection of Personal Information Act (POPIA) applies. The good news: for most small and medium business websites, getting the basics right is not complicated.
This is a practical guide, not legal advice. For anything specific to your business, speak to a legal professional.
What counts as personal information?
Anything that identifies a person: a name, email address, phone number, ID number, physical address, and even an IP address in some cases. If your website collects any of these, POPIA is relevant to you.
The website checklist
- Have a privacy policy that says, in plain language, what you collect, why, who you share it with and how long you keep it.
- Link to it from every form, and add a short line near the submit button so people know what they are agreeing to.
- Only ask for what you need. If you do not need a phone number to reply to an enquiry, make it optional.
- Do not add people to a marketing list just because they sent an enquiry. Ask for permission separately.
- Use https on every page so information is encrypted on the way to you.
- Keep enquiries somewhere secure, and delete them when you no longer need them.
- Know who your service providers are. Your hosting company and email provider handle this data on your behalf.
Cookies and tracking
If you use analytics or advertising tools that track visitors, say so in your privacy policy. Where tools collect personal information for marketing, ask for consent first. Many small sites need far less tracking than they think.
Information officers
Every business has an information officer under POPIA, by default the head of the business, and registration with the Information Regulator is expected. Check the Information Regulator's website for the current requirements.
When things go wrong
If personal information is lost or accessed without permission, POPIA requires you to notify the Information Regulator and the people affected. Secure hosting, strong passwords and up-to-date software are the best way to avoid ever needing to.
How we help
Every website we build includes a privacy policy page, consent wording on forms, https and secure handling of enquiries. If you are unsure whether your current site covers the basics, we are happy to take a look.