Does POPIA apply to my small business?

Yes. The Protection of Personal Information Act 4 of 2013 (POPIA) applies to every business that processes personal information in South Africa, whatever its size. There is no small business exemption. If you keep a customer's name and phone number on your phone, run a payroll for two staff, or take orders through a website, POPIA applies to you.

That sounds alarming, but for most small businesses the law asks for things you probably want to do anyway: know what information you hold, keep it safe, use it only for the reason you collected it, and be honest with people about what you do with it. This guide explains what "processing personal information" means, what POPIA actually requires of a small business, and what you can do this week without paying anyone.

What counts as personal information

Personal information is any information about an identifiable living person, and also about an identifiable company or other juristic person (a legal entity such as a company, close corporation or trust). It includes the obvious things: names, ID numbers, addresses, phone numbers, email addresses and bank details. It also includes a photograph, a vehicle registration, a customer's purchase history, an employee's performance review and an IP address linked to a person.

"Processing" is any operation with that information. Collecting, storing, using, sharing, backing up and deleting it are all processing. There is almost no way to run a business without processing personal information.

Some categories get extra protection. Special personal information covers a person's religion or beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and criminal behaviour. Children's information is also protected. You generally need a specific ground, most often the consent of the person or of the child's parent or guardian, before you may process these categories at all.

Who POPIA makes responsible

The responsible party is the business that decides why and how personal information is processed. That is you. If you are a sole proprietor, you personally. If you trade through a company or close corporation, the entity.

An operator is someone who processes personal information for you, on your instructions, without deciding the purpose. Your payroll bureau, bookkeeper, cloud storage provider and email marketing platform are all likely operators. You stay responsible for what they do with your customers' information, which is why POPIA requires a written agreement with each operator that obliges them to keep the information confidential and secure.

The Information Regulator is the independent body that enforces POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA). It investigates complaints, can issue enforcement notices requiring you to fix things, and can impose administrative fines. Some contraventions are criminal offences.

The eight conditions, in plain English

POPIA sets eight conditions for lawful processing. For a small business they translate into eight questions.

1. Accountability. Has someone in the business taken responsibility for compliance? By default, that is the head of the business, who is the Information Officer.
2. Processing limitation. Are you collecting only what you need, and do you have a lawful reason for it, such as a contract with the customer, a legal duty, consent, or a legitimate interest that does not override the person's rights?
3. Purpose specification. Do you know why you collect each piece of information, and have you told the person?
4. Further processing limitation. Do you only use the information for that purpose or something compatible with it? A delivery address collected to ship an order should not become a mailing list without a fresh basis.
5. Information quality. Do you keep the information accurate and up to date?
6. Openness. Do you tell people, at the time you collect their details, who you are, why you want the information and what their rights are? A short privacy notice does this.
7. Security safeguards. Do you take reasonable, appropriate steps to protect the information from loss, damage and unauthorised access? Passwords, backups, locked filing cabinets and operator agreements are all part of this.
8. Data subject participation. Can people ask what you hold about them, and can you correct or delete it on request?

If you can answer yes to all eight, you are most of the way there. The free POPIA compliance checker walks you through them.

Illustrative example: a hair salon with four staff

The example is illustrative only.

Thandi owns a salon in Pietermaritzburg with four stylists. She keeps a booking app with clients' names, phone numbers and treatment history, including notes on allergies to certain dyes. She pays staff through a payroll service and keeps their ID copies and bank details in a drawer. She sends a WhatsApp broadcast to all clients every month with specials.

POPIA applies to every part of that. The allergy notes are health information, which is special personal information, so Thandi needs a specific ground, most simply the client's consent, which she can record in a line on her intake form. The payroll service is an operator and needs a written agreement. The ID copies in the drawer need a lock. The monthly broadcast is direct marketing: existing clients may receive messages about similar services as long as each one offers a way to opt out, but numbers collected from walk-in enquiries who never became clients need opt-in consent first, and Thandi may ask only once. Thandi herself is the Information Officer and must register with the Information Regulator.

None of that requires a lawyer. It requires an afternoon, a lock, a two-line consent sentence and a registration form.

What to do this week

1. Write a one-page information inventory. List every place personal information lives: booking system, phones, email, spreadsheets, paper files, accounting software, website.
2. Note the purpose next to each item and delete anything you do not need.
3. Draft a short privacy notice for your website, your intake form or your invoice footer, saying who you are, what you collect, why, who you share it with and how people can contact you.
4. Register as Information Officer on the Regulator's portal. See how to register an Information Officer.
5. List your operators and ask each for their standard data processing terms, or send them a one-page agreement.
6. Fix the obvious security gaps: unique passwords, two-factor authentication on email and banking, backups, and locks on paper files.
7. Check your marketing lists against the rules in can I send marketing emails and SMS under POPIA.

Documents and records to set up

• An information inventory. A spreadsheet is fine.
• A privacy notice for customers and a separate short one for staff.
• A consent record for special personal information and for marketing opt-ins, showing who consented, to what, and when.
• Operator agreements with every third party that handles personal information for you.
• A PAIA manual, which PAIA requires you to compile and make available. The Regulator publishes a template.
• A security compromise procedure, even one page, so that you know what to do if a laptop is stolen. See what to do after a data breach.
• A data subject request log recording any requests for access, correction or deletion and how you responded.
• Proof of your Information Officer registration.

Realistic timeline

• Week one: inventory, privacy notice, Information Officer registration.
• Weeks two to four: operator agreements sent and returned, consent wording added to forms, security basics fixed.
• Months two to three: PAIA manual compiled, staff briefed, marketing lists cleaned.
• Ongoing: review the inventory once a year, and whenever you add a new system or start a new type of marketing.

A one-person business can be substantially compliant in a month. A business with staff, a website and outsourced payroll usually needs a quarter.

Common mistakes and what they cost

• Assuming POPIA is for big companies. It applies to every business. An unregistered Information Officer and no privacy notice are the first things the Regulator looks at when a complaint arrives.
• Keeping everything forever. Old customer lists, CVs from candidates you did not hire and ID copies of former staff all become liabilities in a breach. Delete what you do not need.
• Buying or scraping contact lists. Sending marketing to people who never opted in breaches the direct marketing rules in section 69 of POPIA and generates the complaints that trigger investigations.
• No operator agreement. If your bookkeeper's laptop is stolen with your payroll file on it, you are answerable to the Regulator and to your staff. The agreement is your evidence that you took reasonable steps.
• Ignoring a request from a customer. People have the right to ask what you hold and to have it corrected or deleted. Silence turns a request into a complaint.

The financial exposure ranges from the administrative cost of fixing things after an enforcement notice, through administrative fines imposed by the Regulator, to criminal liability for the most serious contraventions. Fine amounts are set by law and change, so treat any figure you read online with caution. See what small business and POPIA compliance costs.

If you cannot afford an attorney

You do not need one for the basics. The Information Regulator publishes free guidance notes, a free PAIA manual template and a free Information Officer registration portal. The Small Enterprise Development Agency (Seda) offers free and subsidised business support that includes compliance basics. University law clinics help small businesses at low or no cost in many centres. If a supplier will not honour an agreement, the Small Claims Court handles money claims up to its limit without attorneys. Legal Aid South Africa focuses on individuals rather than businesses.

Frequently asked questions

Does POPIA apply if I only have a handful of customers? Yes. The Act has no minimum size. What changes with size is what is reasonable: a sole trader's security measures are simpler than those of a firm with a server room.

Does POPIA apply to information about companies I deal with? Yes. POPIA protects juristic persons as well as natural persons, so a supplier's registration number and banking details are personal information too.

Do I need consent for everything? No. Consent is one lawful ground among several. Processing that is necessary to perform a contract with the customer, or to comply with a legal duty such as tax record-keeping, does not need consent. Consent is usually the right ground for special personal information and for marketing to people who are not customers.

Do I need a privacy policy on my website? If you collect any personal information through the site, including through a contact form, the openness condition means you must tell people. A short, honest notice is better than a long copied one.