If your website collects any personal information, it should show a privacy notice, ask for consent on forms, name your Information Officer, explain tracking, and make opting out of marketing easy. This checklist covers the eight website basics. It is not legal advice.
Enter your website and see which POPIA signals are visible: privacy notice, Information Officer, consent on forms, marketing opt-outs and more.
Most South African business websites collect personal information without thinking of it that way. An enquiry form collects names, emails and phone numbers. Google Analytics and advertising pixels collect information about how people use the site. A newsletter sign-up collects permission to market.
The Protection of Personal Information Act (POPIA) sets out how that information must be handled. Much of it happens behind the scenes, but several requirements are visible on your website, which means clients, competitors and the Information Regulator can see whether they are in place.
The checklist
1. Your site uses HTTPS
Section 19 of POPIA requires reasonable security measures to protect personal information. A site without HTTPS sends form details unencrypted. Most hosting providers now include a free SSL certificate, so this is usually a quick fix.
2. A privacy notice is linked from every page
Section 18 requires telling people what you collect and why, when you collect it. The standard way is a privacy notice linked in your footer and next to every form.
3. The notice is written for South African law
A notice copied from an overseas template often mentions GDPR and never mentions POPIA. Refer to POPIA by name, and describe what your business actually collects.
4. Your Information Officer is named
Every responsible party has an Information Officer. By default that is the head of the business. Name them, and give a way to contact them.
5. People are told how to complain
People have the right to complain to the Information Regulator. Your notice should say so and include the Regulator's contact details.
Your notice should also explain that people can ask to see, correct or delete their information, and object to it being used.
6. Forms ask for consent
A tick box next to your form, linked to the privacy notice, records permission at the point of collection. Keep the wording specific: what you will use the details for, and nothing broader.
7. Tracking is explained
If you use Google Analytics, advertising pixels or session recording tools, your notice should say so in plain language and explain how people can limit tracking.
8. Marketing opt-outs are easy
Section 69 limits direct marketing by email, SMS and WhatsApp. Explain how people can opt out, and make every marketing message carry an easy way to do it.
Frequently asked questions
Does my website need a privacy notice under POPIA?
If your website collects personal information, for example through an enquiry form, bookings or analytics, you need to tell people what you collect and why at the point of collection. Section 18 of POPIA sets this out, and a privacy notice linked from every page is the usual way websites do it.
Who is the Information Officer of a small business?
By default it is the head of the business, such as the owner or managing director, unless someone else has been appointed.
Do I need consent to send marketing by WhatsApp or email?
Section 69 of POPIA limits direct marketing by electronic communication. In general you need consent, unless the person is an existing customer and the marketing is about similar products or services, and every message must offer a way to opt out.
Is a website check enough to be POPIA compliant?
No. A website shows only part of the picture. Compliance also covers how you store, secure and use information inside the business. Speak to a legal professional about your situation.
Want your website checked?
Our free POPIA Readiness Check reads your homepage and privacy notice and shows which of these signals are visible, with the source for every result.
This article is general information about POPIA, not legal advice. For advice on your business, speak to a legal professional.