POPIA — the Protection of Personal Information Act — has been in force since July 2021 and applies to essentially every South African business that collects information about people. That includes a contact form.
This is general guidance, not legal advice. If you handle sensitive data at scale, get professional help.
What counts as personal information
More than people assume. A name, an email address, a phone number, an ID number, a physical address, and in many cases an IP address. If your website has a contact form, a newsletter signup or analytics, you're processing personal information.
The practical checklist for a small business site
A privacy policy that's actually accurate. Not a copied template describing practices you don't follow. It should say what you collect, why, how long you keep it, who you share it with and how someone asks for their data to be deleted. Link it in the footer of every page.
Collect only what you need. If you don't need a physical address to quote on a job, don't ask for one. Minimisation is a legal principle here, not just good manners.
Consent for marketing. This is where small businesses most often slip. Electronic direct marketing to someone who isn't already your customer generally requires their consent. A tick box that's already ticked is not consent. Scraping addresses and mailing them is not consent.
An unsubscribe option on every marketing email, that works.
Reasonable security. SSL on the site, sensible password practices, and form submissions that don't sit in an unsecured inbox forever.
An information officer. By default this is the head of the business, and the role can be registered with the Information Regulator. Small businesses frequently skip this — it's inexpensive to do and awkward to explain if asked.
Cookie notice. If you run analytics or advertising pixels, tell people, and make the notice do something rather than just sit there.
Where websites usually fail
Three patterns come up repeatedly. A privacy policy copied from an overseas site referencing legislation that doesn't apply here. A contact form collecting far more than needed because the template had the fields. And a newsletter list built from business cards, quote requests and Facebook comments, all mailed as though everyone opted in.
Do it once, properly
None of this is expensive or difficult at small-business scale. It's a policy page, a short form, a working unsubscribe link and a registration. An afternoon of work that removes a real risk.
Related reading: Our pricing · Our privacy policy · Website design
Every website we build ships with a POPIA-appropriate privacy policy, minimal form fields and SSL as standard.
See what's included →Website Design
A new website built around one thing — bringing you enquiries. Fixed price, published timeline, no games.
See Website Design