By Yaaseen Ebrahim, founder of Innovation by Design. Updated 18 October 2026.
If your website has a contact form, a newsletter sign-up or a checkout, it collects personal information, and the Protection of Personal Information Act (POPIA) applies. This checklist explains, in plain language, what POPIA means for a South African business website in 2026, including the rule changes since 2025.
We are a web design and marketing agency, not a law firm. This guide is general information, not legal advice. For advice on your own situation, speak to an attorney who works with POPIA.
The short answer
If your website collects names, email addresses, phone numbers or orders, POPIA applies to you, whatever the size of your business. At a minimum you need a clear privacy notice, forms that collect only what you need, proper consent before you send marketing, written agreements with the companies that host and process your data, sensible security, a registered Information Officer and a PAIA manual on your website.
The checklist at a glance
| What to check | What it means for your website | Where it comes from |
|---|---|---|
| Privacy notice | Tell people what you collect, why, who receives it, and their rights, before they submit a form | POPIA section 18 |
| Collect only what you need | Remove form fields you do not use | POPIA section 10 |
| Marketing consent | Use an unticked box for newsletters and offers; include an opt-out in every message | POPIA section 69 and the 2025 regulations |
| Agreements with providers | Have written terms with your host, email platform, form tools and developer | POPIA sections 20 and 21 |
| Security | HTTPS, updates, strong logins, limited admin access and backups | POPIA section 19 |
| Breach plan | Know how you will report a compromise through the Regulator’s portal | POPIA section 22 |
| Information Officer | Register the head of the business with the Information Regulator | POPIA section 55 and Regulator guidance |
| PAIA manual | Publish your manual on your website | PAIA section 51 |
| Data sent overseas | Say so in your privacy notice and check your providers’ terms | POPIA sections 18 and 72 |
| Cookies and analytics | Explain your cookies and ask before marketing cookies | Good practice; POPIA covers online identifiers |
| Children | Get a parent’s or guardian’s consent before publishing learners’ details or photos | POPIA sections 34 and 35 |
| Keeping and deleting | Delete old form entries and leads you no longer need; answer access and correction requests | POPIA sections 14, 23 and 24 |
1. A privacy notice people can actually find
Section 18 of the Act says that when you collect personal information directly from someone, you must tell them, before you collect it, things such as:
- what information you are collecting and why;
- your business name and address;
- whether giving the information is voluntary or required, and what happens if they do not give it;
- whether you intend to send it to another country;
- who will receive it; and
- their rights to see and correct their information, to object, and to complain to the Information Regulator.
The 2025 amendments to the regulations (regulation 2.4) repeat that you must tell people about their right to object when you collect their information. On a website, the practical answer is a plain-language privacy notice, linked next to every form, rather than a long legal page nobody reads.
2. Forms that collect only what you need
Section 10 of POPIA says personal information must be adequate, relevant and not excessive for its purpose. If your enquiry form asks for an ID number, a physical address or a date of birth that you never use, remove those fields. Shorter forms are also easier to complete, so this usually brings in more enquiries, not fewer.
3. Proper consent before you send marketing
Section 69 controls direct marketing by electronic communication, such as email and SMS, and the 2025 regulations also name WhatsApp as a way to request consent. You may only send electronic marketing to someone who has consented, or to an existing customer. The existing-customer route applies only if all of these are true:
- you got their details when they bought a product or service from you;
- you only market your own similar products or services; and
- you gave them a simple, free way to opt out when you collected their details, and you include one in every message.
You may ask a person for consent only once, and only if they have not already said no. The April 2025 amendments state plainly that “opt-out shall not constitute consent”, and the Regulator’s direct marketing guidance note says silence cannot mean consent. On a website, that means an unticked box that people choose to tick, not a box that is ticked for them.
Every marketing message must also say who it is from and give a way to stop receiving messages. In 2024 the Regulator issued an enforcement notice to a company that emailed marketing without consent, and found that offering an opt-out afterwards did not fix the problem.
A related change sits outside POPIA: on 7 October 2026 the National Consumer Commission launched a National Opt-Out Registry under the Consumer Protection Act, which direct marketers must register with by December 2026 and check their lists against. Consumers can start using it to block marketing from May 2027.
4. Written agreements with the companies that handle your data
POPIA calls the companies that process personal information on your behalf “operators”. For a website, that usually includes your hosting company, your email marketing platform, any online form or booking tool, your CRM, and your developer if they can see form submissions or customer records.
Section 21 requires a written contract that makes sure each operator keeps the information secure and tells you immediately if they suspect a breach. Many providers include data processing terms in their standard terms, so check that they cover this. In 2023 the Regulator issued an enforcement notice to Dis-Chem after a breach at one of its service providers, and ordered it to put written contracts in place with all of its operators.
5. Sensible security
Section 19 requires appropriate, reasonable technical and organisational measures to protect personal information, and regular checks that they work. On a typical business website, that means:
- HTTPS on every page, especially pages with forms;
- keeping WordPress, themes and plugins updated, and removing ones you do not use;
- strong, unique passwords and two-factor login for everyone with admin access;
- giving admin access only to people who need it, and removing old accounts;
- regular backups stored away from the website itself; and
- not leaving form submissions or customer exports sitting in shared inboxes and folders longer than needed.
6. A plan for when something goes wrong
If personal information is accessed by someone who should not have it, section 22 requires you to notify the Information Regulator and the affected people as soon as reasonably possible. Since 1 April 2025, the Regulator says reports must be made through its eServices portal rather than by email. Information Officers are also registered on the same portal, so set up your access before you need it.
You can notify affected people by email, by post, by a prominent notice on your website, or through the news media. Agree now who in your business would make that call, so you are not working it out during a crisis.
7. A registered Information Officer
Every business has an Information Officer. In a private business it is the head of the business, such as the CEO, managing director or owner, and for a sole trader it is that person. The Regulator’s guidance note on Information Officers says they may only take up their duties once registered, and registration is done on the eServices portal. Keep the details up to date.
8. A PAIA manual on your website
The Promotion of Access to Information Act (PAIA) requires private bodies to have a manual explaining how people can request access to records. Section 51 says it must be available on your website if you have one, at your main place of business, and on request. The exemption that once covered smaller businesses ended on 31 December 2021, and the Information Regulator publishes a template for private bodies.
9. Data that leaves South Africa
Many website tools, from analytics to email platforms and online store software, process data on servers outside South Africa. Section 72 allows this only in certain cases, for example when the recipient is bound by laws or an agreement that give protection similar to POPIA, when the person consents, or when the transfer is needed to fulfil a contract with them (section 72).
In practice: list the tools on your website that handle personal information, check where each one processes data and what its terms say, and mention transfers outside South Africa in your privacy notice, as section 18 requires.
10. Cookies and analytics
POPIA does not mention cookies, and we found no Information Regulator rule, as of October 2026, that specifically requires a cookie banner. But POPIA’s definition of personal information includes online identifiers, and the Regulator’s direct marketing guidance note lists the use of cookies as a method of direct marketing.
Legal commentators such as Michalsons recommend a cookie notice and asking before setting non-essential cookies. That is sensible practice, especially for advertising and tracking cookies. Keep your cookie notice short and make it easy to say no.
11. Children’s information, especially on school websites
POPIA treats anyone under 18 as a child. Sections 34 and 35 say you may not process a child’s personal information unless an exception applies, most commonly the prior consent of a parent or guardian. The Regulator’s guidance note on children’s information gives publishing a child’s information on social media with a parent’s or guardian’s consent as an example. For schools, that means getting consent before publishing learners’ names, photos or results on the website or social media.
In December 2024 the Regulator issued a R5 million infringement notice to the Department of Basic Education over the publication of matric results in newspapers. The full bench of the Pretoria High Court set it aside in December 2025, and the Regulator has applied for leave to appeal.
12. Keeping, deleting and answering requests
Section 14 says you should not keep personal information for longer than you need it, unless a law or contract requires it. Delete old form entries, stale leads and abandoned-cart records on a regular schedule, or anonymise them so they can no longer identify anyone.
People can ask whether you hold their information and request a copy (section 23), and ask you to correct or delete it (section 24). The Regulator publishes the correction and deletion form on its POPIA page; requests for a copy follow the PAIA request process. Under the 2025 regulations, you must tell the person in writing what you did about a correction or deletion request within 30 days.
What happens if you get it wrong
The Information Regulator can impose administrative fines of up to R10 million, and some offences, such as ignoring an enforcement notice, can lead to fines or imprisonment of up to ten years. Real cases so far include:
- Department of Justice and Constitutional Development: a R5 million infringement notice in July 2023 for failing to comply with an enforcement notice issued after a security compromise. The department has gone to court to have it set aside.
- Blouberg Local Municipality: published a staff member’s personal information on its website. In April 2026 the Polokwane High Court ruled for the Regulator but reduced its R500,000 fine to R250,000.
- Dis-Chem: an enforcement notice in 2023 after a breach at a service provider it had no written agreement with.
Enforcement often starts with an enforcement notice ordering specific changes, but fixing problems after a complaint usually costs more than getting the basics right now.
Frequently asked questions
Does POPIA apply to a small business website?
Yes, if the website collects personal information. A contact form, a newsletter sign-up, an online store or a booking form all collect names, email addresses or phone numbers, and that is personal information under POPIA. There is no exemption for small businesses.
Do I need a privacy policy on my website?
Section 18 of POPIA requires you to tell people certain things when you collect their personal information, such as what you collect, why, who receives it and what their rights are. A clear privacy notice on your website, linked from every form, is the practical way to do that.
Can I add people who fill in my contact form to my newsletter?
Not automatically. Under section 69 you need their consent to send electronic marketing, unless they are an existing customer who bought from you and you only market similar products of your own. Since the April 2025 amendments to the POPIA regulations, an opt-out does not count as consent, so use an unticked box that people choose to tick.
Do I need a cookie banner under POPIA?
POPIA does not mention cookies, and we found no Information Regulator rule that specifically requires a cookie banner. But POPIA’s definition of personal information includes online identifiers, and the Regulator’s guidance on direct marketing lists cookies as a direct marketing method. Many South African businesses use a cookie notice and ask before setting marketing cookies as good practice.
Do I have to register an Information Officer?
Yes. In a private business the Information Officer is the head of the business, such as the CEO or owner, and the Information Regulator says Information Officers may only take up their duties once they are registered. Registration is done on the Regulator’s eServices portal.
Where must my PAIA manual be published?
Section 51 of PAIA says your manual must be available on your website if you have one, at your main place of business, and on request. The exemption for small private bodies ended on 31 December 2021, and the Information Regulator publishes a template you can start from.
What do I do if my website is hacked and personal information is exposed?
Section 22 of POPIA requires you to notify the Information Regulator and the people affected as soon as reasonably possible. Since 1 April 2025, reports to the Regulator must be made through its eServices portal. Information Officers are registered on the same portal, so set up your access before you need it.
Is it legal to use website tools that store data outside South Africa?
It can be. Section 72 allows personal information to be sent to another country if, for example, the recipient is bound by laws or an agreement that give similar protection, the person consents, or it is needed to fulfil a contract with them. Your privacy notice should tell people when their information goes outside South Africa.
What are the penalties for breaking POPIA?
The Information Regulator can impose administrative fines of up to R10 million. Some offences, such as failing to comply with an enforcement notice, can lead to fines or imprisonment of up to ten years. In the cases made public so far, enforcement has often started with an enforcement notice that orders specific changes.
Where to start
Work through the checklist above with whoever manages your website. If you are building or rebuilding a site, ask for these items to be part of the brief, and see our guide to what a website costs in South Africa. For a quick look at your site’s security and trust basics, run it through our free Website Health Check, or book a free 30-minute call and we will talk it through with you. For legal questions, speak to an attorney, or contact the Information Regulator at enquiries@inforegulator.org.za.
Sources
- Protection of Personal Information Act 4 of 2013 (gov.za).
- POPIA regulations, as amended in 2025 (Information Regulator).
- Information Regulator: Guidance Note on Direct Marketing and Guidance Note on Processing Personal Information of Children.
- Information Regulator: Guidance Note on Information Officers, eServices portal and statement on reporting security compromises through the portal (7 April 2025).
- PAIA section 51, Department of Justice statement on the end of the PAIA manual exemption (29 June 2021) and PAIA manual template for private bodies.
- POPIA section 72 (popia.co.za).
- Information Regulator statements on Dis-Chem, a direct marketing complaint, the Department of Justice, Blouberg Local Municipality, the Department of Basic Education notice and the matric results appeal; ITWeb on the Department of Justice court challenge.
- National Consumer Commission: National Opt-Out Registry launch (7 October 2026).
- Michalsons: Cookie law in South Africa.
- All sources checked on 18 October 2026.
