POPIA website requirements: what your site must tell people
The Protection of Personal Information Act (POPIA) applies to your website the moment it collects information about a person, and a contact form is enough. Here is what the Act says, section by section, and what that usually means on a site.
When POPIA applies to your website
POPIA protects "personal information", and its definition reaches further than most people expect.
What counts as personal information
Section 1 includes any identifying number, e-mail address, physical address, telephone number, location information and online identifier. It covers identifiable living people and, where applicable, existing companies and other juristic persons.
Where a website collects it
Contact and quote forms, newsletter sign-ups, online shop checkouts, booking forms and chat tools all collect personal information. POPIA does not name websites or cookies; it applies to personal information however it is collected.
Why you may process it
Section 11 allows processing with consent, to conclude or perform a contract, to meet a legal obligation, or for a legitimate interest, among other grounds. The business carries the burden of proving consent where it relies on it.
What your privacy notice must say (section 18)
Section 18 requires "reasonably practicable steps" to make sure people know the following before you collect their information directly from them.
- What information you collect, and the source if not from the persons18(1)(a)
- Your name and addresss18(1)(b)
- The purpose you collect it fors18(1)(c)
- Whether giving it is voluntary or mandatorys18(1)(d)
- What happens if they do not provide its18(1)(e)
- Any law that requires or authorises the collections18(1)(f)
- Any transfer to another country, and the protection theres18(1)(g)
- Who receives it, and their right of access and corrections18(1)(h)
- Their right to object to processings18(1)(h)
- Their right to complain to the Information Regulator, with its contact detailss18(1)(h)
The numbers in the Act
Three figures from POPIA that matter to any business with a website.
Section 109: an infringement notice may set an administrative fine that may not exceed R10 million.
Section 69(2): a business may approach a person whose consent it needs only once to ask for consent to electronic direct marketing.
Section 22: the Information Regulator and the affected person, as soon as reasonably possible after the compromise is discovered.
Marketing e-mails and SMSes (section 69)
Electronic direct marketing, including e-mail and SMS, is prohibited unless one of two conditions is met.
Consent
The person has given consent to the processing for direct marketing. Consent in POPIA means a voluntary, specific and informed expression of will.
Or an existing customer
You obtained their details in the context of a sale of a product or service, and you market only your own similar products or services.
An easy way to object
Customers must be given a reasonable opportunity to object, free of charge, when the details are collected and on each communication.
Identify yourself
Each communication must include your details and an address or other contact details to which the person can send a request to stop.
Security safeguards (section 19) on a website
Section 19 requires appropriate, reasonable technical and organisational measures. The left column is the Act; the right is how that is usually done on a site.
What section 19 requires
- Prevent loss of, damage to or unauthorised destruction of personal information
- Prevent unlawful access to or processing of personal information
- Identify reasonably foreseeable internal and external risks
- Establish and maintain appropriate safeguards against them
- Verify the safeguards and update them for new risks
What that usually means on a website
- Every page served over HTTPS, so form data is encrypted in transit
- Software, themes and plugins kept updated
- Form submissions stored only as long as needed, with restricted access
- Admin accounts with strong passwords and only the people who need them
- Backups kept, and a plan for who to notify if something goes wrong
HTTPS is covered in our SSL certificate guide. Keeping a site updated is what our website care plans do.
Questions people ask
Does POPIA require a cookie banner?
POPIA does not mention cookies. It applies to personal information, which section 1 defines to include online identifiers. If cookies or analytics tools on your site collect personal information, the same conditions apply as for any other collection, including the section 18 notice.
What is the maximum POPIA fine?
Section 109 allows the Information Regulator to issue an infringement notice with an administrative fine that may not exceed R10 million.
Do I have to tell anyone if my website is hacked?
If there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, section 22 requires you to notify the Information Regulator and the affected people, as soon as reasonably possible after discovering it.
Can I send newsletters to people who sent an enquiry?
Section 69 allows electronic direct marketing with consent, or to existing customers whose details you got in a sale, for your own similar products or services, with a free way to object each time. Someone who only sent an enquiry is not yet a customer, so ask for consent.
Who is the Information Regulator?
The Information Regulator enforces POPIA. Its 2021 guidance note covers the duties of Information Officers and their registration with the Regulator.
Sources
Every statement above comes from these pages, read on 15 November 2026. This guide explains the rules in plain language; it is not legal or tax advice for your particular business.
- POPIASection 1: definitions (personal information, consent)
- POPIASection 11: consent, justification and objection
- POPIASection 18: notification to data subject
- POPIASection 19: security measures
- POPIASection 22: notification of security compromises
- POPIASection 69: direct marketing by electronic communications
- POPIASection 109: administrative fines
- Information RegulatorInformation Officers: guidance note and registration
Related on this site
Want this handled for you?
The privacy notice, marketing consent, security and breach rules, section by section. Tell us about your business and we reply with a fixed price.