POPIA compliance checklist for websites

For POPIA website compliance, a site needs a lawful reason for every piece of personal information it collects, a clear notice at the point of collection, opt-in consent for electronic marketing to new contacts, reasonable security, written contracts with the companies that process data for you, and a plan for breaches. The checklist below follows the Protection of Personal Information Act section by section.

This article is general information, not legal advice. Working through it does not make a website or a business compliant. POPIA applies to how the whole organisation handles personal information, and the website is one part of that. Confirm your obligations with your own legal counsel or the Information Regulator.

Terms used in the Act

• Personal information is information about an identifiable living person and, where applicable, an existing juristic person such as a company. The definition in section 1 includes email addresses, telephone numbers, physical addresses, location information and online identifiers.
• The responsible party decides why and how personal information is processed. For a website, that is the business that owns it.
• An operator processes personal information for the responsible party under a contract or mandate. A web host, a web developer with access to form entries and an email marketing platform are typical examples.
• The data subject is the person the information is about.

The text of the Act can be read section by section at popia.co.za.

The checklist

1. List what the website collects

• Every form: contact, quote, booking, newsletter, job application, checkout.
• Every tool that receives visitor data: analytics, advertising pixels, chat, maps, embedded video, booking engines, payment gateways.
• Where each piece of information goes: email inbox, website database, CRM, mailing platform.
• Who can see it, and how long it is kept.

2. Have a lawful basis for each item (section 11)

Section 11 lists the grounds on which personal information may be processed. They include consent, the conclusion or performance of a contract with the data subject, a legal obligation, and the legitimate interests of the data subject, the responsible party or a third party.

• Write down which ground applies to each form and tool.
• Where you rely on consent, be ready to prove it. Section 11 places the burden of proof on the responsible party.
• Make it possible to withdraw consent. The Act allows withdrawal at any time.
• Ask only for what the purpose needs. Every extra field is more information to protect.

3. Tell people what you collect (section 18)

Section 18 requires reasonably practicable steps to make the data subject aware of certain things. Where information is collected directly from the person, this must happen before collection. The points include:

• what information is collected
• the name and address of the responsible party
• the purpose of collection
• whether supplying the information is voluntary or mandatory, and the consequences of not supplying it
• any law that requires the collection
• whether the information will be sent to another country, and the level of protection there
• who receives the information
• the right to access and correct the information, the right to object, and the right to complain to the Information Regulator, with the Regulator's contact details

In practice, that means a privacy notice written for your own site, linked in the footer and next to every form.

4. Get marketing consent right (section 69)

Section 69 prohibits direct marketing by electronic communication, such as email and SMS, unless the person has consented or is an existing customer.

• New contacts. Consent is needed first. You may ask a person for consent only once, and only if they have not refused before.
• Existing customers. You may market your own similar products or services to a customer whose details you obtained in the context of a sale, provided they could object when the details were collected and can object in every message.
• Every message must identify the sender and give an address or other contact details for opting out.
• On forms. The Information Regulator's guidance note on direct marketing, issued in December 2024, says consent must be a voluntary, specific and informed expression of will, and that silence is not consent. A newsletter tick box should therefore be separate from the enquiry itself and should not be ticked in advance.
• Keep records of who consented, when and to what, and of who refused or opted out.

5. Decide how to handle cookies

POPIA has no section on cookies. Two points make them relevant. The definition of personal information includes online identifiers and location information, and the Regulator's direct marketing guidance note refers to cookies in the context of electronic marketing.

• List the cookies and tracking scripts the site sets, and what each is for.
• Describe them in the privacy notice.
• A cautious approach is a consent banner that lets visitors accept or refuse analytics and advertising cookies before they are set. How far POPIA requires this is a question for your legal counsel.

6. Secure the site (section 19)

Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unlawful access to personal information. The responsible party must identify foreseeable risks, put safeguards in place, check that they work and update them as risks change.

• HTTPS on every page
• Software, themes and plugins kept up to date
• Individual logins with strong passwords and two-factor authentication
• Access removed when staff or suppliers leave
• Backups that are tested
• Form entries not stored on the website longer than needed
• Malware scanning and monitoring

7. Sign contracts with operators (section 21)

Section 21 requires a written contract between the responsible party and each operator, under which the operator maintains the security measures in section 19. The operator must notify the responsible party immediately if there are reasonable grounds to believe personal information has been accessed by an unauthorised person.

• List your operators: host, developer or maintenance provider, email platform, CRM, booking system.
• Check that each has a written agreement that covers security and breach notification.

8. Check where the data goes (section 72)

Section 72 allows personal information to be transferred outside South Africa only on certain conditions. They include that the recipient is bound by a law, binding corporate rules or an agreement that gives adequate protection, that the data subject consents, or that the transfer is necessary to perform a contract with the data subject.

• Find out where the site is hosted and where each tool stores its data.
• Mention cross-border transfers in the privacy notice.

9. Plan for a breach (section 22)

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, section 22 requires the responsible party to notify the Information Regulator and the affected data subjects as soon as reasonably possible.

• Decide who is told internally, who contacts the host and who drafts the notices.
• Keep contact details for the Regulator and your operators in one place.

10. Register an Information Officer (section 55)

Section 55 sets out the duties of the Information Officer, who must be registered with the Information Regulator before taking up those duties.

• Confirm that your Information Officer is registered.
• Give website visitors a way to reach that person with requests to access, correct or delete their information.

What a website cannot do for you

A privacy notice and a consent box do not cover staff training, paper records, retention schedules or how enquiries are handled once they reach an inbox. Those belong to the wider compliance work of the business. Other laws may also apply to your sector.

Where Stryx stands

Under POPIA, Stryx acts as the client's operator, and the operator agreement is part of the service agreement. Care plan clients choose their hosting region, including South Africa. Stryx gives guidelines only and makes no warranty that a site is compliant.

Related: web design in South Africa, website security, managed hosting and website accessibility in South Africa. To discuss a site, get in touch.