What Is POPIA? A Guide for South African Small Businesses

Published by the Lawly team · Published · Sources last checked

General information, not legal advice. Written by the Lawly team from the official sources listed at the end of this guide.

POPIA is the Protection of Personal Information Act 4 of 2013, South Africa's law on how organisations collect, use, store and share information about people. According to the Information Regulator, most of it took effect on 1 July 2020. The Act's definition of a "private body" includes sole traders and partnerships, so if you run a small business, it covers you.

What POPIA is and when it started

Section 2 of the Protection of Personal Information Act (POPIA) says its purpose includes to "give effect to the constitutional right to privacy, by safeguarding personal information when processed by a responsible party". The Act also sets up the Information Regulator, which enforces it.

According to the Regulator's statement on the commencement proclamation, sections 2 to 38, 55 to 109, 111 and 114(1) to (3) came into effect on 1 July 2020. Section 114(1) gave organisations one year from then to bring existing processing into line, which the Regulator described as "a grace period of 1 year up to 1 July 2021". That period is over.

Key terms in section 1

Personal information is information relating to an identifiable, living person (and, where applicable, an existing juristic person such as a company). Section 1 gives examples such as email and physical addresses, phone numbers, identity numbers, financial and employment history, health information and private correspondence.

Processing covers almost anything you do with personal information, from collecting and storing it to using, sharing and finally destroying it. Section 3 applies the Act to paper records that form part of a filing system, not only to digital ones.

The responsible party is the person or body that decides why and how the information is processed. For most small businesses, that's the business itself. The data subject is the person the information is about, such as a customer or employee.

Does POPIA apply to small businesses?

Yes. POPIA has no general exemption for small businesses. Section 1 defines a "private body" to include "a natural person who carries or has carried on any trade, business or profession, but only in such capacity", along with partnerships and companies.

Section 6 lists what the Act doesn't apply to, including processing "in the course of a purely personal or household activity". Running a business isn't on that list. If you're unsure whether a specific activity is covered, ask the Information Regulator.

The eight conditions for lawful processing

Section 4(1) of POPIA lists eight conditions for lawful processing:

  1. Accountability (section 8)
  2. Processing limitation (sections 9 to 12)
  3. Purpose specification (sections 13 and 14)
  4. Further processing limitation (section 15)
  5. Information quality (section 16)
  6. Openness (sections 17 and 18)
  7. Security safeguards (sections 19 to 22)
  8. Data subject participation (sections 23 to 25)

Section 26 sets stricter rules for "special personal information": health, religious beliefs, race, trade union membership, biometric information and criminal behaviour, among others.

Telling people when you collect their information (section 18)

Section 18 of POPIA says the responsible party "must take reasonably practicable steps to ensure that the data subject is aware of" certain points when it collects personal information. In summary, the person should know:

  • what is being collected, and where it came from if not from them directly
  • the name and address of the business collecting it
  • why it's being collected
  • whether supplying it is voluntary or mandatory, and what happens if they don't
  • any law that authorises or requires the collection
  • any plan to transfer it to another country
  • further information, such as who will receive it, their rights to access, correct and object, and their right to complain to the Information Regulator

When you collect the information directly from the person, section 18(2) says these steps come before collection. Many businesses use a privacy notice or privacy policy to give people this information.

Security safeguards and data breaches (sections 19 and 22)

Section 19 says a responsible party "must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures". Section 19(2) describes the steps: identify foreseeable risks, put safeguards in place, check they work, and keep them up to date.

If an outside provider processes personal information for you, such as a payroll bureau, section 21 says you must make sure, "in terms of a written contract" with that operator, that it maintains these security measures.

Section 22 deals with security compromises, usually called data breaches. Where there are reasonable grounds to believe someone unauthorised has accessed or acquired personal information, the responsible party must notify the Regulator and, in most cases, the affected people, "as soon as reasonably possible after the discovery of the compromise". The Regulator announced in April 2025 that from 1 April 2025 these reports go through its eServices portal rather than by email.

The information officer and registration

Section 1 of POPIA makes the information officer of a private body its "head" as defined in the Promotion of Access to Information Act. The Regulator's Guidance Note on Information Officers and Deputy Information Officers sets out who that is:

  • for a sole proprietor, the owner, or a person they authorise
  • for a partnership, any partner, or a person the partnership authorises
  • for a company, the CEO, managing director or equivalent, or a person they authorise

Section 55(1) lists the officer's responsibilities, which include encouraging the business to follow the conditions for lawful processing and working with the Regulator during investigations.

Section 55(2) says officers "must take up their duties in terms of this Act only after the responsible party has registered them with the Regulator". The Regulator's guidance note calls registration "a compulsory requirement", and its registration page says it "can be done on the Regulator's E-Services Portal".

Direct marketing by email and SMS (section 69)

Section 69 of POPIA prohibits direct marketing by electronic communication, including SMS and email, unless the person has consented or is an existing customer. For existing customers, section 69(3) limits it to your own similar products or services, using details you obtained in a sale, and the customer must have had a chance to opt out when you collected the details and with each message. Under section 69(2) you may ask for consent "only once", and section 69(4) says each message must identify the sender and give opt-out contact details.

What are the penalties under POPIA?

There are two kinds. Under section 109, where a responsible party is alleged to have committed an offence under the Act, the Regulator may issue an infringement notice with an administrative fine that "may, subject to subsection (10), not exceed R10 million".

Section 107 sets out criminal penalties for the offences in sections 59 and 100 to 106. For some, including obstructing the Regulator and failing to comply with an enforcement notice, the penalty is a fine or imprisonment "for a period not exceeding 10 years", or both. For the others, the maximum term is 12 months.

A practical POPIA review list for small businesses

These are questions small businesses commonly work through, following the Act's structure. How each one applies depends on your facts.

  • What personal information do we collect? Think of customers, employees, suppliers and website visitors, on paper and digitally.
  • Why do we collect each item? Section 13 deals with purpose.
  • Where is it stored? Email, accounting software, cloud drives, filing cabinets.
  • Who can access it? Staff and outside providers. Is there a written contract with each provider (section 21)?
  • What security is in place? Passwords, backups, locked cabinets (section 19).
  • How long do we keep it? Section 14 deals with retention.
  • Do we tell people what we collect? Compare your website privacy notice and forms with section 18.
  • Do we market by email or SMS? Check consent and opt-outs against section 69.
  • Is our information officer registered? Check on the Regulator's eServices portal.
  • Do we know what to do after a breach? Note who reports it and where (section 22).

What to watch for

Paper records are easy to forget. Section 3 applies the Act to manual records that form part of a filing system, such as printed employee files.

A website privacy notice isn't the whole picture. Openness (sections 17 and 18) is one of the eight conditions in section 4.

Be careful with bought marketing lists. Section 69 limits electronic direct marketing to people who consented or are existing customers.

Frequently asked questions

Does POPIA apply to sole proprietors?

Yes. Section 1 of POPIA defines a "private body" to include a natural person who carries on a trade, business or profession, in that capacity. The Act has no general small-business exemption. Section 6 excludes processing for "a purely personal or household activity", which doesn't cover running a business. The Information Regulator can answer questions about specific situations.

Who is the information officer in a small business?

According to the Information Regulator's guidance note, the information officer of a sole proprietorship is the owner, or a person they authorise. In a partnership it's any partner or an authorised person. In a company it's the CEO, managing director or equivalent officer, who may authorise someone else. Registration is done on the Regulator's eServices portal.

What happens if my business has a data breach?

Section 22 of POPIA says that where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, the responsible party must notify the Regulator and, in most cases, the affected people, as soon as reasonably possible. Since 1 April 2025, the Regulator has required these reports through its eServices portal.

What is the maximum fine under POPIA?

Section 109 of POPIA allows the Information Regulator to issue an administrative fine that may not exceed R10 million, subject to subsection (10). Separately, section 107 provides criminal penalties for specific offences in the Act, including imprisonment of up to 10 years for some and up to 12 months for others.

Getting the privacy paperwork in place

A privacy policy is one way to give people the information listed in section 18. Lawly's Privacy Policy is drafted using South African legal frameworks, with sections based on the points POPIA lists, and the POPIA bundle pairs it with Terms of Service.

Check the draft against your own procedures and the sources above before you use it. If your business handles sensitive personal information, an attorney review is sensible.

Sources

  1. Protection of Personal Information Act 4 of 2013 (sections 1 to 4, 6, 14, 18 to 22, 26, 55, 69, 107, 109 and 114), South African Government (PDF of the Act)
  2. Commencement of certain sections of the Protection of Personal Information Act (press statement, 22 June 2020), Information Regulator
  3. Guidance Note on Information Officers and Deputy Information Officers, Information Regulator
  4. Registration of Information Officers, Information Regulator
  5. eServices Portal, Information Regulator
  6. Regulator launches online reporting platform for security compromises (media statement, 7 April 2025), Information Regulator

Disclaimer: This guide is general information about business documentation in South Africa, not legal advice. Lawly is an AI business document generation service, not a law firm. Review any document before you use it, with the depth of review matching what it carries for your business. For advice on your specific situation, speak to a qualified attorney.