POPIA applies to every business that handles personal information, including one-person operations with a customer list.
What counts as personal information
Anything identifying a living person or an existing company: names, contact details, ID numbers, addresses, banking details, employment history, even a photograph.
If you keep a customer database, employ anyone, or run a mailing list, POPIA applies to you.
The eight conditions, in practice
| Condition | What it means day to day |
|---|---|
| Accountability | Someone is responsible. In a small business, that is the owner |
| Processing limitation | Collect only what you need, with a lawful basis |
| Purpose specification | Say why you are collecting it |
| Further processing | Do not repurpose data for something unrelated |
| Information quality | Keep it accurate and current |
| Openness | Have a privacy notice people can read |
| Security safeguards | Protect it, and report breaches |
| Data subject participation | People can ask what you hold and have it corrected |
The practical minimum
- A privacy policy on your website
- An Information Officer registered with the Information Regulator
- Consent for marketing, with an unsubscribe option
- Reasonable security on customer and employee data
- A retention decision — how long you keep things and why
- Contracts with suppliers who process data for you
Direct marketing
Electronic direct marketing to people who are not existing customers generally requires consent. Buying a list and emailing it is the clearest way to attract a complaint.
Existing customers may be marketed to on related products, with an opt-out on every message.
Where personal information is accessed or lost unlawfully, you must notify the Information Regulator and the affected people. A stolen laptop with unencrypted customer records is a reportable breach.
Where small businesses slip
- Employee records kept in an unlocked drawer
- Customer data on a personal phone with no passcode
- Old databases kept indefinitely with no reason
- Sharing customer lists with third parties without consent
- No privacy policy at all
Need the document itself?
94 South African legal and HR documents, drafted from your details and emailed in minutes. From R99, no attorney fees.
General information, not legal advice. Lightbizhub is not a law firm. For complex, disputed or high-value matters, have any document reviewed by an admitted attorney before you rely on it.