Privacy Policy in South Africa: What POPIA Requires

If your website, shop or business collects names, email addresses, ID numbers or any other personal details from people in South Africa, you need a privacy policy that meets the Protection of Personal Information Act (POPIA). It must tell people in plain language what you collect, why, who sees it, how long you keep it and how they can exercise their rights. This guide explains what to put in it, who has to comply, and what to do if someone else misuses your information. It also covers where consumer refund rights fit in, because shoppers often confuse the two.

TL;DR

• POPIA applies to any person or company that processes personal information in South Africa, including a small website with a contact form.
• A privacy policy should state what you collect, why, who you are, whether supplying the information is voluntary, and what rights people have.
• Collect only what you need, get consent or rely on another lawful ground, and let people access, correct or delete their information.
• Complaints go first to the organisation's Information Officer, then to the Information Regulator.
• Refund rights for goods fall under the Consumer Protection Act, not POPIA, and a change of mind is not always a right to a refund.

Table of Contents

• Who must have a privacy policy under POPIA
• What a South African privacy policy should contain
• Consent and other lawful grounds
• Making the policy readable
• When someone misuses your information: how to complain
• Privacy policy versus refund policy
• Our perspective
• Getting the policy checked by an attorney
• FAQ
• Sources

Who must have a privacy policy under POPIA

POPIA aims to protect personal information processed by public and private bodies and sets minimum requirements for that processing. It does not matter whether you are a bank or a one-person consultancy. The Act applies to any responsible party that processes personal information in the Republic, or outside it where the party uses automated or non-automated means located in the Republic, unless it is merely forwarding data.

"Processing" is wide. Collecting an email address through a newsletter box, storing a customer's delivery address, recording a call or keeping a CV all count. So a website that does any of these needs to tell visitors what happens to their details.

Responsible parties and operators

Two roles matter when you draft the policy:

• The responsible party decides the purpose and means of processing. That is usually you.
• An operator processes information on your behalf, such as a payment processor, a hosting company or an email marketing tool. The Information Regulator describes both roles on its POPIA page.

Your policy should say which kinds of operators receive customer data, even if you do not name each one.

Whose information is protected

POPIA covers information about identifiable living people and, unlike many data laws elsewhere, identifiable existing companies and other juristic persons, according to the Information Regulator. The Act lists examples that include race, gender, marital status, age, health, religion, language, financial, criminal and employment history, contact details, biometric information and personal opinions, as set out in the Act itself. If a customer's email address, phone number or purchase history sits in your systems, it is in scope.

What a South African privacy policy should contain

There is no official template, but guidance from South African bodies is consistent. The industry guidelines published by ASISA in March 2024 say a privacy notice must be transparent and in plain language. It should disclose:

1. The categories of information you collect.
2. The purpose of collection.
3. Your identity as the organisation collecting it.
4. Whether supplying the information is voluntary or mandatory.
5. The existence of data subject rights.
6. Any possible transfer of the information to another country.
7. Contact details for the Information Regulator, for complaints.

Below is how to turn each of those into usable text.

Who you are and how to reach you

Give your registered name, physical or postal address, and an email address for privacy requests. Name your Information Officer. Public and private bodies must register their Information Officers with the Regulator, and that person's duties include making sure the body complies with POPIA. In a sole proprietorship, that is usually the owner.

What you collect and why

List the categories in plain words: name, email, phone number, delivery address, payment confirmation, IP address, browsing behaviour through cookies. Next to each, say why you need it. "To deliver your order" and "to send you our monthly newsletter" are specific. "For business purposes" is not.

The principle of minimality matters here. The Western Cape Department of Cultural Affairs and Sport explains in its POPIA FAQ that organisations should collect only the personal information that is absolutely necessary for the service. If your contact form asks for an ID number you never use, delete the field. A shorter data list also makes the policy shorter and easier to keep accurate.

Voluntary or mandatory

For each item, say whether the person must provide it. A delivery address is mandatory for a courier order. A phone number on a newsletter form should be optional. Say what happens if they decline: "we cannot deliver your order" or "nothing, you will simply receive emails only".

Who you share it with

Describe the types of recipients: couriers, payment providers, accountants, IT and hosting providers, and any authority that can lawfully demand records. State that these parties may only use the information to provide their service to you. If your hosting, email platform or analytics tool stores data on servers outside South Africa, say so. That is the international transfer disclosure the guidelines call for.

How long you keep it and how it is deleted

Say how long you keep each type of record and what triggers deletion. Some records, such as invoices, may need to be kept for tax or other legal reasons. State that reason rather than promising deletion on request for everything. Be honest here: a policy that promises more than your systems can do is a liability, not protection.

Cookies and tracking

If your site uses analytics, advertising pixels or embedded content, explain which cookies you set, what they do and how to switch them off in the browser. Many South African organisations publish a separate cookie policy that sits alongside the privacy policy and cross-refers to it. That works well, provided the two documents do not contradict each other.

Consent and other lawful grounds

Consent is not the only basis for processing. The National Treasury's POPIA page explains that personal information may be processed with consent or when necessary for a contract. In practice:

Situation	Likely basis	What your policy should say
Customer places an order	Necessary to perform the contract	You use the details to deliver and invoice
Visitor joins your newsletter	Consent	They can unsubscribe at any time
Job applicant sends a CV	Steps needed for the application, plus consent for keeping it on file	How long CVs are kept
Website analytics cookies	Consent through a cookie banner or settings	What each cookie does and how to refuse

The same Treasury page confirms that people may ask for access to their information, ask for correction or deletion, and withdraw consent. Your policy should name a simple way to do each, usually a dedicated email address, and you should be ready to act on requests without making people jump through hoops.

Pre-ticked boxes and "by browsing you agree" notices are weak ways to show consent. Use a clear action, keep a record of when and how consent was given, and make withdrawing it as easy as giving it.

Making the policy readable

A 12-page wall of legal text defeats the purpose. ASISA recommends a layered privacy notice: a short notice with the key points at the place where you collect information, linking to the fuller policy for detail. On a website, that means a few lines under the signup or checkout form ("We use your details to process your order. Read our privacy policy") with a link to the complete document.

A practical structure

1. Who we are and our Information Officer
2. What we collect and why
3. Whether providing it is voluntary
4. Who we share it with, including operators and any foreign transfers
5. How long we keep it and how we protect it
6. Your rights and how to use them
7. Cookies
8. How to complain, including the Information Regulator's details
9. When the policy was last updated

The last point is not decoration. If your practices change, update the policy and the date, and tell existing customers about material changes.

When someone misuses your information: how to complain

This section is for readers on the other side of the table, whose details were mishandled by a company.

1. Write to the organisation's Information Officer. Describe what happened, what you want (deletion, correction, an explanation) and a reasonable deadline. Keep copies.
2. Escalate to the Information Regulator if you are not satisfied. Complaints may be lodged with the responsible party's Information Officer first and then taken to the Regulator, whose website explains how to submit one.
3. Get legal advice if you have suffered real loss, for instance after identity theft linked to a data leak. A civil claim is a different route from a regulator complaint, and an attorney can tell you which fits. Our guide on what an attorney does is a start, and if money is tight, see where to get free legal advice in South Africa.

If the dispute is with your own lawyer's handling of your information, here is where to report lawyers in South Africa.

Privacy policy versus refund policy

Many South African shops put their returns rules in the same document as their privacy terms, and consumers search for both at once. They are governed by different laws, so keep the rules straight.

Defective or unsuitable goods

Under the Consumer Protection Act (CPA), the dtic's consumer brochure says consumers can return unsafe or defective goods and ask for a full refund within a reasonable period. The same brochure says consumers can reject goods that do not match a sample they approved, or that they had no reasonable opportunity to examine before delivery. A shop cannot contract out of these rights with a "no refunds" sign or a clause in its terms.

Goods returned under section 20

Where goods are returned under section 20 of the CPA, for example after direct marketing or when they were unsuitable for a purpose the consumer communicated, the supplier must refund the consumer. The National Consumer Commission's gazetted guidance adds that reasonable charges for use or restoration may be deducted, but a supplier may not charge for use or depletion if the goods are in their original, unopened packaging.

Change of mind and online purchases

There is no blanket right to a refund simply because you changed your mind. Section 16 of the CPA gives a five-business-day cooling-off period for transactions resulting from direct marketing, while returns for defective goods fall under section 56 and are a separate right, as the same gazetted notice explains. The notice also points out that where the Electronic Communications and Transactions Act already applies to a transaction, the CPA cooling-off provisions may not. Online sellers should therefore state their return terms clearly, without promising less than the law gives or implying that all change-of-mind returns are refused.

If a seller will not honour your rights, a small dispute may be suitable for the small claims court. Read how the small claims court works before you decide.

Our perspective

We see the same pattern in the questions that reach us: businesses treat a privacy policy as a document to download once, and consumers treat it as fine print nobody reads. Both are costly. A policy copied from another website describes someone else's data practices, and it falls apart the first time a customer asks for their information to be deleted.

Our advice is to write the policy last, after you have mapped what your business really does. List every form, tool and supplier that touches customer details. Then write what is true, in words your customers use. If a statement cannot be backed by how your systems work, take it out.

We built Justibly on the same principle. Attorney listings reflect verified Legal Practice Council data and are not ranked by payment, and answers in our free Q&A forum come only from LPC-registered lawyers. Trust comes from being accurate about who you are and what you do with people's information.

— Nkosi

Getting the policy checked by an attorney

A privacy policy does not have to be drafted by a lawyer, but it is worth having one review it if you handle sensitive information (health, children's data, financial records), transfer data abroad regularly, or run a business where a breach would be serious. A data protection or commercial attorney can check that your policy matches your processing, your contracts with operators, and your internal procedures.

On Justibly you can search attorneys by practice area and location across all nine provinces and contact those whose registration status has been validated against Legal Practice Council data. Attorneys can also upgrade their profiles through our pricing plans, though a paid plan never changes where a listing appears.

Start on the Justibly home page, pick the area of law and your city, and ask your question in our free Q&A forum if you are not yet sure what kind of attorney you need.

FAQ

Does a small website need a privacy policy in South Africa?

Yes, if it collects personal information such as names or emails through contact forms, newsletters, orders or cookies. POPIA applies to any responsible party that processes personal information in South Africa, whatever its size. A short, accurate policy is better than a long copied one.

Can I copy another company's privacy policy?

It is a poor idea. Your policy must describe your own collection, purposes, operators and retention, and a copied one will almost certainly describe someone else's. Use other policies to see the typical headings, then write your own content from what your business actually does.

Who do I complain to about a POPIA breach?

Start with the organisation's Information Officer, in writing. If the response is inadequate, you can escalate to the Information Regulator, the official body that oversees POPIA. Keep copies of everything you send and receive.

Can I get a refund just because I changed my mind?

Not automatically. The CPA gives a five-business-day cooling-off period for transactions resulting from direct marketing, and the right to return defective goods is separate. A seller's own returns policy may be more generous, so check it before buying.

Sources

• Protection of Personal Information Act 4 of 2013, gov.za
• Protection of Personal Information Act 4 of 2013, full text
• Information Regulator, POPIA
• ASISA guidelines on the protection of personal information, March 2024
• Western Cape Government, POPIA FAQ
• National Treasury, POPIA
• Information Regulator, complaints route in an approved code of conduct
• dtic, Consumer Protection Act brochure
• National Consumer Commission, CPA gazetted notice

Recommended

• Power of Attorney in South Africa — Types, Requirements, and Limitations
• Parental Rights in South Africa: What the Law Gives You