Home Resources POPIA for small businesses: what you actually need to do
POPIA & DATA
POPIA for small businesses: what you actually need to do
If you collect names, emails, ID numbers, employee records or customer details, POPIA applies to you. It has been fully in force since 1 July 2021, and it applies to every business, not just big ones. The Information Regulator can impose administrative fines of up to R10 million. Most small businesses are nowhere near that risk, but ignoring POPIA entirely isn’t a strategy.
The eight conditions, in brief
POPIA sets eight conditions for lawful processing of personal information: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. In practice, they mean collect only what you need, tell people why, keep it accurate, keep it safe, and let people see and correct their own information.
The practical checklist
Appoint and register an Information Officer
In a private body, the head of the business (for example the CEO or owner) is the Information Officer by default, and Information Officers must be registered with the Information Regulator.
Publish a privacy notice
Tell people what you collect, why, who you share it with, and how they can exercise their rights.
Get direct marketing right
Unsolicited electronic marketing generally requires opt-in consent, with a limited exception for existing customers. Always offer a way to opt out.
Have contracts with your operators
If someone processes personal information for you (a payroll provider, cloud host or email platform), POPIA requires a written contract requiring them to protect it.
Know your breach procedure
If personal information is compromised, you must notify the Information Regulator and the affected people as soon as reasonably possible.
Watch cross-border transfers
If your providers store data outside South Africa, POPIA restricts transfers unless certain conditions are met.
Take extra care with special personal information
Health, biometric or children’s data, for example, carry stricter rules.
Where to start
Start with what personal information you hold, where it lives and who can access it. That map drives everything else. Our POPIA Compliance Pack (R4,300) gives you attorney-drafted documents to put the paperwork in place.
Guides in this section
- Information Officer: who is yours, and how to register Coming soon
- Writing a privacy notice for a South African website Coming soon
- POPIA and marketing emails: consent, opt-out and existing customers Coming soon
- What to do after a data breach Coming soon
Information, not advice
ELS provides legal information, not legal advice. Nothing on this site creates an attorney-client relationship.