POPIA privacy notice for a small business

Most small businesses copy a privacy notice off another website, change the name, and publish it. That notice is worse than nothing. It describes systems you do not use, promises security you have not implemented, and names an Information Officer who does not know they are one. This template works the other way round: you write it from an inventory of what your business actually holds.

What this document does and when to use it

A privacy notice is how you meet the openness requirement in the Protection of Personal Information Act 4 of 2013 (POPIA). It tells the people whose information you hold what you collect, why, who else sees it, how long you keep it and what they can do about it.

It is one of eight conditions for lawful processing, not all of them. Publishing it does not make you compliant. It makes you transparent, which is one part of compliant. Read does POPIA apply to my small business for the rest, and run the POPIA compliance checker to find the gaps.

Use it if you hold customer contact details, employee records, supplier contacts, CCTV footage, a mailing list, or job applications. That is almost every business with a phone and a spreadsheet. The Act covers information about identifiable companies too, not only people.

Get a professional to look at it if you process health, biometric, racial, religious or criminal information, information about children, or if you send personal information out of South Africa in bulk.

Before you start: get these facts straight

Do the inventory first. Write down every place personal information lives. The booking system. The staff WhatsApp group. The email inbox. The spreadsheet on the sales manager's laptop. The paper files in the storeroom. The accounting package. The CCTV recorder. You cannot describe what you do not know you hold, and the inventory usually turns up two or three systems nobody remembered.

Write the purpose next to each item. If you cannot say why you hold something, delete it. That is the fastest compliance win available to a small business.

List your operators. An operator is anyone who processes personal information on your instructions and for your purposes: payroll bureau, bookkeeper, cloud storage, email marketing platform, courier, IT support.

Find out where your data physically sits. Most small businesses transfer information abroad without knowing it, because their email, backups or booking system are hosted overseas. Check before you write section 5.

Identify your Information Officer. By default this is the head of the business. If you are a sole proprietor, it is you.

Get your legal entity right. The responsible party is the registered entity, not the trading name on the shopfront.

Walking through it, clause by clause

Section 1 names the responsible party and the Information Officer. The responsible party is the entity that decides why and how information is processed. Name it in full, with the registration number, and then give the trading name. The Information Officer table needs a working email that somebody actually reads, because access requests and complaints arrive there. The head of the business is the Information Officer by default, and that appointment must be registered with the Information Regulator. Read how to register an Information Officer.

Section 2 sets out what you collect and where you get it. Use categories, then say what is in each: "customer contact details: name, telephone number, email address, delivery address". Then list the three sources: directly from the person, automatically, and from third parties. Delete the third-party line if you truly receive nothing. If you collect special personal information, which includes health, religious or racial information, trade union membership, biometrics and criminal history, or information about children under 18, this is where you say so.

Section 3 is the lawful ground table, and it is the heart of the notice. Every purpose needs a ground: contract, legal obligation, consent, protecting a legitimate interest of the person, or your own legitimate interest that does not override their rights. Write one row per purpose. The common error is writing "consent" for everything. Consent must be voluntary, specific and informed, and it can be withdrawn. If the person had no real choice, it is not consent, and calling it consent means the processing has no ground at all.

Section 4 covers direct marketing. Delete it entirely if you do no marketing. If you do, say which channels, what you send and to whom. Electronic direct marketing under section 69 of the Act is strict. You may generally market similar goods or services to your own existing customers where they were given a chance to object when you collected their details, and every message must offer an opt out. For anyone who is not already your customer you need prior consent, requested in the prescribed manner, and you may ask only once. Read can I send marketing emails and SMS under POPIA.

Section 5 is who you share with. Operators first, then other recipients, then public bodies. The sentence that matters is that each operator is bound by a written agreement, which is a separate document you must actually have. The transfer paragraph forces a choice: either you do not send information out of South Africa, or you name the providers and the basis on which you do.

Section 6 is retention. A table of record types and periods. Do not write "indefinitely". Pick periods you can apply, then apply them.

Section 7 is security. List what you actually do. Password protected accounts, two factor authentication on email, access limited to staff who need it, locked cabinets, encrypted backups, trained staff. The last paragraph commits you to notifying the Regulator and the affected people after a breach, which section 22 of the Act requires. Read what to do after a data breach under POPIA now, not on the day.

Section 8 lists the person's rights, including access, correction, deletion, objection, withdrawal of consent, and complaint to the Information Regulator. It also points to the Promotion of Access to Information Act 2 of 2000 and your PAIA manual. Sections 9 and 10 are the complaints route and the version control. Two steps: your Information Officer first, then the Regulator. Check the Regulator's current contact details on its website on the day you publish.

A worked example

This example is illustrative only and the business is invented.

Karoo Signage CC makes and installs shopfront signs. Two owners, four staff. The owner, Ntombi, does the inventory and finds six places personal information lives: the quoting spreadsheet, the shared email account, a WhatsApp Business number, the payroll bureau's portal, paper job cards in the workshop, and two CCTV cameras over the yard.

In section 1 she names the close corporation in full with its registration number, then the trading name, and lists herself as Information Officer with a monitored email address. In section 2 she lists three categories: customer contact and site details, employee records including identity and tax numbers, and CCTV footage of the yard.

In section 3 she writes four rows. Supplying and invoicing sits on contract. Payroll and SARS records sit on legal obligation. CCTV sits on legitimate interest. Occasional emails about new services to past customers also sits on legitimate interest, with an opt out in every message, because they are existing customers.

She keeps section 4 because she sends those emails. In section 5 she lists her operators: the payroll bureau, the accountant, the email provider and the courier. She then discovers her email and backups are hosted outside South Africa, so she uses the second transfer option and names the providers. Section 7 lists two factor authentication on the shared inbox, a locked cabinet for job cards, and thirty days of CCTV retention.

The clauses people get wrong

Naming the wrong entity in section 1. The responsible party is the registered legal entity. Naming only the trading name means the notice describes nobody, and an access request has no addressee.

Writing "consent" in every row of section 3. If the customer had to hand over their details to get the service, that is contract, not consent. Mislabelling it leaves you with no lawful ground on record, and obliges you to honour a withdrawal you never relied on.

Publishing section 4 when you market to strangers. Buying a list and emailing it is the most common POPIA failure in small business, and section 69 does not permit it. Every electronic marketing message also needs an opt out and must identify the sender. The cost is a Regulator complaint from someone who never gave you their address.

Leaving the operator sentence in without the agreements behind it. Section 5 promises every operator is bound in writing. POPIA requires that contract, and you stay responsible for what your operators do. A notice promising an agreement you do not have is a written admission.

Promising security you do not have in section 7. Claiming encryption, restricted access or staff training you have not implemented turns a data breach into a misrepresentation as well.

Writing "indefinitely" in section 6. Keeping everything forever is not a retention policy, and each extra year of old records is extra exposure in a breach. Pick a period, then delete on it.

Signing it and keeping proof

A privacy notice is published rather than signed, but the paperwork behind it still has to exist and be findable.

Keep the dated version you published, and every version after it. The "last updated" date at the top is the first thing a complainant checks, so change it whenever the content changes and keep the superseded versions. If someone complains about processing that happened in March, you want to produce the notice that was live in March.

Keep the Information Officer registration confirmation with the notice. Keep your operator agreements in one folder, one per provider, signed by both sides, and where a provider offers only its own standard data processing terms, save the version you accepted and the date. Keep the inventory you built at the start, because it is the working document behind the notice.

Save the notice as a PDF each time you change it. A notice that lives only as a web page can be edited later, and a version nobody can produce is worth nothing when the question is what you told people at the time.

What happens if it goes wrong

If someone asks what you hold about them, respond. Requests come under the Promotion of Access to Information Act 2 of 2000, and there is a prescribed form and a prescribed fee for copies. Verify who they are before you hand anything over, because giving one person another person's information is itself a breach.

If personal information in your care is accessed or acquired by an unauthorised person, notify the Information Regulator and the affected people as soon as reasonably possible after you discover it. That includes a lost laptop, a hacked mailbox and an email sent to the wrong recipient list.

If a complaint reaches the Regulator, it can investigate, ask for information, and issue an enforcement notice. Answering with your inventory and operator agreements in hand goes very differently from answering with a copied notice.

The Information Regulator takes complaints free of charge and publishes the forms on its website. Legal Aid South Africa on 0800 110 110 applies a means test, and university law clinics assist small businesses in most major centres. For contract-side problems with your operators, see the basic service agreement, which contains an operator clause you can adapt.

LawMatch is not a law firm and this is general information, not legal advice about your situation.

Frequently asked questions

Does a one-person business really need a privacy notice?

If you hold anyone's personal information, yes. POPIA has no small business exemption. A sole proprietor is the responsible party and the Information Officer, and the notice can be short as long as it is true.

Who is my Information Officer?

The head of the business, by default. In a company that is usually the chief executive or managing director, in a close corporation a member, and in a sole proprietorship you. The appointment must be registered with the Information Regulator.

What is the difference between a responsible party and an operator?

The responsible party decides why and how information is processed. An operator processes it on the responsible party's instructions and may not use it for its own purposes. Your payroll bureau is an operator, you are the responsible party, and the operator must be bound in writing.

Can I email my old customer list about a new service?

Usually yes, where they are existing customers, the service is similar to what they bought, they were given a chance to object when you collected the details, and every message has an opt out. Bought or scraped lists need prior consent.

Do I need a PAIA manual as well?

Section 8 of the notice refers to one, so you should have it and say where it is. It is a separate document under the Promotion of Access to Information Act 2 of 2000, and it deals with access to records generally, not only personal information.

How often should I update the notice?

Review it every twelve months, and whenever you add a system, change a service provider or start doing something new with information you already hold.