POPIA compliance checklist for small business

Who POPIA applies to

The Protection of Personal Information Act applies to anyone who processes personal information in South Africa: companies, sole traders, NPOs, landlords, schools. "Processing" means almost anything - collecting, storing, emailing, sharing, even deleting. If you have a customer list, an employee file or a WhatsApp group of client numbers, you are processing personal information and POPIA applies. There is no small-business exemption.

The regulator is the Information Regulator, which handles complaints, investigates breaches and can issue enforcement notices and fines. Serious offences carry criminal liability. In practice, the Regulator's attention lands first on businesses that leak data or spam people who opted out.

The practical checklist

• 1. Know what you hold. List the personal information in the business: customers, staff, suppliers, marketing lists, CCTV, website analytics. You cannot protect what you have not mapped, and this list drives everything else.
• 2. Privacy policy. A plain-language notice telling people what you collect, why, who you share it with, and how they can access or correct it. It belongs on your website and in your onboarding paperwork. It must describe what you actually do, not what a template imagines you do.
• 3. PAIA manual. A separate document required under the Promotion of Access to Information Act, describing your business and how someone can request records from it. Every private body must have one available; the Regulator publishes a template format.
• 4. Information officer. By default this is the business owner or CEO. The information officer must be registered with the Information Regulator through its registration portal before the business starts hiding behind "we didn't know". Registration is free.
• 5. Consent for direct marketing. Electronic marketing (email, SMS, WhatsApp) to new prospects requires consent, and every message needs a working opt-out. Existing customers may be marketed to about similar products, but the opt-out rule still applies. Bought lists are where most POPIA trouble starts.
• 6. Security safeguards. Reasonable measures for your size: password management, access limits, backups, POPIA clauses in contracts with anyone who processes data for you (your bookkeeper, your email platform, your IT support).
• 7. Breach procedure. If personal information is accessed or acquired by an unauthorised person, you must notify the Information Regulator and the affected people as soon as reasonably possible. Decide now who does that and how, because a breach is the wrong day to start planning.

Realistic first steps

Do not try to do everything in one weekend. A sensible order for a small business: map your data, publish a privacy policy and PAIA manual, register the information officer, then clean up your marketing lists and tighten passwords and access. That covers the visible obligations and the highest-risk gaps. Ongoing compliance after that is mostly discipline: collect only what you need, keep it only as long as you need it, and honour opt-outs immediately.

Frequently asked questions