POPIA for Websites and Apps: A Practical Guide for South African Businesses

The Protection of Personal Information Act (POPIA) governs how organisations in South Africa collect, use, store and share personal information. If your website or app collects names, email addresses, phone numbers or other personal details, even through a simple contact form, POPIA applies to you. This guide gives a practical overview for business owners. It isn't legal advice: for your specific situation, speak to a legal professional.

What counts as personal information?

Personal information includes anything that identifies a person, such as names, email addresses, phone numbers, ID numbers, physical addresses, online identifiers and location data. POPIA also protects information about juristic persons, such as companies.

Where websites and apps collect personal information

• Contact and quote forms
• Newsletter sign-ups
• Online store checkouts and customer accounts
• Bookings and appointment forms
• App registrations and user profiles
• Analytics and advertising tools that use cookies or device identifiers
• Live chat and WhatsApp integrations

The key principles

POPIA sets out conditions for lawful processing. In practical terms:

1. Accountability: your business is responsible for compliance, and you need an information officer.
2. Collect only what you need, for a specific and lawful purpose.
3. Tell people why you're collecting their information and how it will be used.
4. Don't use it for something else without a lawful basis.
5. Keep it accurate and up to date.
6. Be open about your practices, for example in a privacy policy.
7. Keep it secure with appropriate technical and organisational measures.
8. Let people access and correct their information, and object to its use.

Practical checklist for your website or app

• Publish a privacy policy in plain language, linked from every page and every form.
• Minimise form fields: ask only for what you need to respond.
• Get clear consent for marketing. Don't add enquiries to a mailing list automatically; use an unticked opt-in box, and include an unsubscribe link in every email.
• Use SSL (HTTPS) on every page.
• Secure your admin accounts with strong, unique passwords and two-factor authentication.
• Keep software updated: outdated plugins are a common route to data breaches. See website maintenance.
• Know where data goes: list the services your site sends data to, such as email, analytics, CRM and payment providers, and check their privacy terms.
• Set retention periods, and delete information you no longer need.
• Plan for breaches: POPIA requires you to notify the Information Regulator and affected people if personal information is compromised.

Apps

Apps often collect more data than websites, including location, contacts and device identifiers. Ask for device permissions only when the feature needs them, explain why, and include a privacy policy in your app store listings. Both Apple and Google also require privacy disclosures for apps in their stores.

Consequences of non-compliance

The Information Regulator can investigate complaints and issue enforcement notices and fines, and serious offences can lead to criminal penalties. Just as important, customers are more likely to trust a business that clearly respects their data.

How we help

We build privacy into every website and app we make: secure hosting, minimal forms, consent for marketing, and a place for your privacy policy. Read our checklist of what you need to build a website, or contact us to discuss your project.