Small business & POPIA

Running a small business in South Africa means being your own legal department for the first few years. Nobody tells you when a rule starts applying to you. You register a company, you take on a customer, you hire somebody, you collect email addresses, and each of those steps quietly attaches obligations. Then something goes wrong: an invoice is not paid, a partner wants out, a laptop with a client list is stolen. This page maps the obligations to the moments they arrive, and points you at the guide that deals with each.

What this area of law covers

Six statutes touch almost every small business. The Companies Act 71 of 2008 governs registration, directors' duties and shareholder relationships. The Protection of Personal Information Act 4 of 2013, known as POPIA, governs how you handle other people's personal information and is enforced by the Information Regulator. The Promotion of Access to Information Act 2 of 2000, known as PAIA, gives people a right of access to records and requires many businesses to keep a manual. The Consumer Protection Act 68 of 2008 governs how you sell to consumers, including returns, quotations and cancellation. The Basic Conditions of Employment Act 75 of 1997 and the Labour Relations Act 66 of 1995 govern hiring, and they apply from your first employee, not from your tenth. The Value-Added Tax Act 89 of 1991 governs invoicing once you are registered for VAT.

Underneath all of them sits contract law, which is not in a statute at all. Most disputes a small business has are contract disputes: what was agreed, when payment was due, what happens on cancellation. A clear written contract is the cheapest legal product you will ever buy.

Two regulators deal with the public directly and free of charge. The Companies and Intellectual Property Commission, known as CIPC, handles company registration, annual returns and trade mark applications. The Information Regulator handles POPIA and PAIA, including registering Information Officers and receiving breach notifications. Neither requires you to have an attorney.

Where to start, by problem

• You are about to start and do not know what structure to use. Read sole proprietor or (Pty) Ltd: which should I register. This decision affects your personal liability, so make it deliberately.
• You have decided to register a company. Read how to register a company with CIPC. You can do it yourself.
• You are going into business with somebody. Read do I need a shareholders' agreement before you take the money, not after.
• You and your partner have fallen out. Read how to resolve a dispute between business partners.
• You need something in writing with a customer or supplier. Read what should be in a basic supplier or service contract.
• A customer will not pay. Read how to recover a debt from a customer who will not pay. There is a free or cheap route before there is an expensive one.
• Your invoices keep getting queried. Read what must be on a tax invoice in South Africa.
• You are hiring your first person. Read what are my obligations when I hire my first employee. Registration, contracts and payslips all start on day one.
• The new person is not working out. Read can I dismiss someone during their probation period. Probation is not a free pass.
• You are not sure POPIA applies to you. Read does POPIA apply to my small business. If you hold customer or staff details, it almost certainly does.
• You send newsletters, promotions or bulk SMS. Read can I send marketing emails and SMS under POPIA.
• You need to appoint someone responsible for data. Read how to register an Information Officer with the Information Regulator.
• You have had a leak, a hack or a lost device. Read what to do after a data breach under POPIA. This one has a clock on it.
• Somebody has told you that you need a PAIA manual. Read do I need a PAIA manual for my business.
• You want to stop competitors using your name. Read how to protect your business name and logo. Registering a company name is not the same as owning a trade mark.

The deadlines that catch people out

Reporting a data breach. Where personal information has been accessed or acquired by somebody who should not have it, POPIA requires you to notify the Information Regulator and the affected people as soon as reasonably possible after discovering it. Delay is itself a compliance failure, and the Regulator deals with the public directly and free, so there is no cost reason to wait.

CIPC annual returns. A registered company must file an annual return each year, within a period that runs from the anniversary of its registration. Miss enough of them and CIPC begins deregistration. A deregistered company cannot contract, cannot sue and cannot open an account, and restoring it is slower and more expensive than filing was.

Prescription of debts you are owed. An unpaid invoice does not wait for you forever. Once a debt prescribes, it can no longer be enforced. Work out where your oldest outstanding invoices stand with the prescription checker.

Employment disputes. An employee who says they were unfairly dismissed generally has 30 days from the date of dismissal to refer the dispute to the CCMA. That deadline is the employee's, but it is the date you should know, because it tells you how long your exposure stays open. The CCMA deadlines calculator sets out the clocks.

Consumer cancellations and returns. The Consumer Protection Act gives consumers fixed windows to cancel certain agreements and to return defective goods. If your terms contradict those windows, your terms lose. The consumer returns calculator works out which window applies.

VAT registration. Compulsory registration is triggered by a turnover threshold set by SARS, and that threshold changes. Check the current figure with SARS rather than relying on a number you were told.

What it costs, and what is free

The full breakdown is on what does small business legal work cost. In short: registering a company yourself through CIPC is inexpensive, a properly drafted shareholders' agreement or set of trading terms is a one-off cost that pays for itself the first time it is used, and litigation is the expensive end you should be trying to avoid.

A surprising amount is free. CIPC registration and annual returns are done directly by you at published fees. Registering an Information Officer with the Information Regulator costs nothing. Notifying a breach costs nothing. A letter of demand you write yourself costs nothing and resolves a large share of unpaid invoices. The Small Claims Court has no court fee, allows no attorneys and awards no costs against you, which makes it the best value in the system for small debts. The CCMA deals with the public directly and free, and the Information Regulator does the same. If you are personally facing a matter you cannot afford, check Legal Aid South Africa.

The mistakes that cost the most

• Trading with no written terms. When the dispute comes, the argument is about what was agreed, and the person with nothing in writing usually loses it.
• Signing personal surety without noticing. A director who signs surety for the company has given away the entire point of registering a company. Read what you sign.
• Ignoring CIPC annual returns. Deregistration stops the business dead, usually at the moment you need a tax clearance or a bank facility.
• Collecting personal information with no privacy notice and no security. POPIA obligations attach whether or not you have read the Act, and the first time most businesses learn this is after a breach.
• Handling a first dismissal informally. No contract, no warning, no hearing and no record turns a small performance problem into a CCMA award.
• Letting invoices age quietly. Every month you wait reduces recovery and moves the debt closer to prescription.
• Assuming a registered company name protects your brand. It does not. Trade mark protection is separate, and somebody else can register the mark while you are trading under it.

The tools on this site that help here

• The POPIA compliance checker turns ten yes-or-no questions about how you handle personal information into the list of obligations that actually apply to your business.
• The POPIA privacy notice template is the document you put on your website and give to customers, telling them what you collect and why.
• The basic service agreement template covers scope, payment terms, cancellation and ownership of work, which is where most small business disputes start.
• The letter of demand for an unpaid debt is the first and cheapest step in collecting an invoice.
• The small claims court calculator tells you whether your claim can go there, where there is no court fee and no attorney.
• The court fees calculator gives you a cost band for suing in the District, Regional or High Court, so you can compare the debt to the cost of chasing it.
• The prescription checker tells you whether a debt is still enforceable, and the debt interest and in duplum calculator works out the interest you may add.

When you need an attorney

Get an attorney when you are taking on a shareholder, an investor or a co-founder, because a shareholders' agreement drafted after the fall-out is worth nothing. Get one when you are signing a lease, a franchise agreement, a distribution agreement or anything with a personal surety attached. Get one when the amount in dispute is large enough that losing it would close the business. Get one when the Information Regulator makes contact, or when a breach involves sensitive information or many people. Get one when you are dismissing somebody senior, retrenching, or facing a CCMA referral you do not understand. Get one when you are buying or selling a business, because the difference between buying the shares and buying the assets decides which liabilities you inherit. And get one for trade mark work if the brand is the business.

For everything below that line, the regulators deal with you directly and the templates on this site will usually get you there.

LawMatch is not a law firm. Everything here is general information about South African law, not legal advice on your business.