POPIA Basics: What Small Businesses Actually Need to Do
South Africa's Protection of Personal Information Act (POPIA) applies to almost every business that keeps customer records - including small ones. This isn't legal advice, but here's the practical starting point most small businesses actually need.
You're Probably Already "Processing Personal Information"
If you keep customer names, phone numbers, emails, or ID numbers in a spreadsheet, CRM, or booking system, POPIA already applies to you. It doesn't matter how small the business is - the obligations are the same in principle, even if the scale of what you need to do is smaller.
The Practical Starting Point
Know what you collect. List the personal information your business actually stores - customer details, staff records, supplier contacts - and where it lives.
Limit access. Not everyone on the team needs access to everything. Restrict sensitive records to the people who actually need them.
Have a basic security baseline. Passwords that aren't shared in group chats, software that's kept updated, and backups that aren't sitting on one unlocked laptop.
Know how you'd respond to a request. If a customer asks what information you hold on them, or asks you to delete it, you should have a straightforward way to do both.
Where Your Website Fits In
A contact form, newsletter signup, or booking system on your website is a personal information collection point. At minimum, it should be clear to visitors what's collected and why - usually through a plain-language privacy policy, like the one on this site.
This Isn't a One-Person Job Forever
A basic checklist is a reasonable starting point for a small business, but as you grow - more staff, more customer data, more systems - it's worth having your setup reviewed by a professional who can confirm you're actually compliant, not just closer to it.
Back to Insights
Not Sure Where Your Systems Stand?
We can review what you have today and tell you plainly what's worth fixing first.
Get In Touch