POPIA Compliance for South African Websites

South Africa's Protection of Personal Information Act, known as POPIA, governs how organisations process personal information. It came into full force in 2021 and is overseen by the Information Regulator. This is a plain-English overview for website owners, not legal advice.

The eight conditions

POPIA is built around eight conditions for lawful processing, covering accountability, limiting collection to what you need, being open about purpose, securing the information, and respecting the rights of the people whose data you hold.

For a website, that means collecting only what your forms genuinely need, being clear about why, and protecting it properly.

Appoint an Information Officer

Every organisation has an Information Officer, often the head of the business by default, who is responsible for POPIA compliance. The Information Regulator expects Information Officers to be registered with it. Make sure yours is identified and registered, and publish a contact point.

This is a common gap for smaller businesses, so it is worth checking off early.

Breach notification

If personal information is accessed or acquired by an unauthorised person, POPIA requires you to notify the Information Regulator and the affected people as soon as reasonably possible. Keeping a record of what data you hold and where makes that far easier to handle.

A short incident plan turns a stressful event into a clear set of steps.

What a typical site needs

• A privacy policy that explains what you collect, why, and how people exercise their rights.
• A registered Information Officer with a published contact.
• Consent or another lawful basis for your processing.
• SSL across the site and sound security.
• A plan for handling access requests and breaches.