Home / Research / POPIA and small business websites
Simplifico Knowledge Report 1 · Data collected 22 October 2026
Most small business websites ask for your details without saying why
We read 187 South African small business websites across ten sectors and four cities. Seven in ten that collect customer details have no privacy notice, and nine in ten contact forms say nothing about privacy at all.
Why this matters
The Protection of Personal Information Act (POPIA) asks every business that collects personal information to tell people what it collects and why, before or at the moment it collects it. On a website, that moment is the contact form, the WhatsApp button or the booking page. A short line under the form and a linked privacy notice are usually all it takes, yet most of the websites we read had neither.
These are small, owner-run businesses: plumbers, guest houses, salons, accountants and the like. Most are simply unaware of what their website is missing, and every gap below has a fix that takes minutes, not a consultant.
Everything we observed
| What we observed | Rate | Count | Out of |
|---|---|---|---|
| Collect personal details through a form, WhatsApp, booking or chat | 76% | 142 of 187 | of websites read |
| Collect details but have no privacy notice | 68% | 97 of 142 | of websites that collect details |
| Have a contact form with nothing about privacy at the form | 91% | 101 of 111 | of websites with a readable form |
| Have a contact form with no consent tick box | 94% | 104 of 111 | of websites with a readable form |
| Name no Information Officer | 94% | 175 of 187 | of websites read |
| Do not link a PAIA manual | 91% | 170 of 187 | of websites read |
| Have a privacy notice that does not mention POPIA | 54% | 27 of 50 | of websites with a notice |
| Have a privacy notice that does not mention the Information Regulator | 74% | 37 of 50 | of websites with a notice |
| Have a privacy notice written for Europe's GDPR only | 4% | 2 of 50 | of websites with a notice |
| Load tracking tools with no consent tool in the page | 69% | 65 of 94 | of websites with tracking |
| Do not move visitors from http to the secure https address | 19% | 35 of 182 | of websites tested |
By sector: collecting details with no privacy notice
Each bar shows how many websites in that sector collect customer details but link no privacy notice. Each sector has 9 to 19 websites that collect details, so read these as a pattern rather than a precise rate.
- Guest houses and beauty salons had the widest gap: 14 of 15 in each collect details with no privacy notice, and not one of their readable forms said anything about privacy.
- Medical and dental practices handle some of the most sensitive information, yet all 8 that use tracking tools had no consent tool.
- Estate agents were the clear exception: 11 of the 12 that collect details link a privacy notice.
Two independent scans, the same picture
In August 2026, ClearComply published an automated scan of 157 South African business websites. Where our checks measure the same thing, the results are close: they found 95% name no Information Officer and 90% link no PAIA manual. We found 94% and 91%. Our sample is small businesses only, which may be why more of our websites had no privacy notice at all (73% of all websites read, against their 59%).
Five fixes you can make this week
- Publish a privacy notice and link it in your footer. Say what you collect, why, who you share it with, how long you keep it and how people can reach you.
- Add one line and a tick box under every form. For example: "I agree that [your business] may use my details to reply to my enquiry, as explained in our privacy notice."
- Name your Information Officer. For most small businesses it is the owner. Name them in your notice and register them on the Information Regulator's eServices portal.
- Ask before you track. If you use Google Analytics, Google Ads or a Meta Pixel, add a cookie banner that holds them back until a visitor agrees.
- Make the secure address the only address. Ask your web host to forward every http visit to https.
See where your website stands
The free POPIA Readiness Check runs a similar check on your website and explains how to fix each gap.
How we did it
- Sample: Google Maps listings for ten sectors in Pretoria and Centurion, Johannesburg, Cape Town and Durban, picked at random among businesses with a website of their own. Directories, social media pages, chains and franchise branches were left out.
- Coverage: 220 websites attempted on 22 October 2026, including 20 from a pilot run the same day. 187 were read. 33 could not be read (19 did not load, 12 refused automated readers and 2 returned errors).
- What we read: up to four public pages per website: robots.txt, the homepage, the contact page and the privacy notice. Our crawler identified itself, respected robots.txt, never submitted a form and kept no personal information. More about the crawler.
- Accuracy: we checked 210 findings on 40 websites by hand. The scanner agreed 207 times (98.6%).
- Limits: these are observations, not legal findings. Forms or tracking that appear only after scripts run can be missed. A cookie banner a business built itself counted as a consent tool, so the tracking figure is, if anything, generous. Rates for single sectors and cities rest on small numbers.
- No names: we publish totals only. We do not name any business, and we did not contact the businesses we studied.
- Our own website: we ran the same checks on simplifico.xyz before publishing. It passes every one.
This report is general information, not legal advice.