What Is POPIA and Does It Apply to My Small Business?
Quick Answer
What Is POPIA and Does It Apply to My Small Business?
POPIA (the Protection of Personal Information Act) governs how businesses collect, store and use personal information. It applies to every South African business – there is no small-business exemption. The basics: a privacy policy, minimal data collection, reasonable security, and deletion when no longer needed.
What this means in plain language
If you keep a customer WhatsApp list, employee files or a debtor spreadsheet, you process personal information and POPIA applies. The Information Regulator can fine non-compliance – and customers increasingly ask.
Practical POPIA for a small business is not a legal marathon: tell people what you collect and why, collect only what you need, protect it with passwords and access limits, do not share it without consent, and delete it when the reason is gone.
Who this applies to
- Every business with a customer list, employee records or a website contact form
- Businesses doing direct marketing by email or SMS
Step by step
- List what personal information you hold and why (customers, staff, suppliers).
- Publish a simple privacy policy (website and on request).
- Secure the data: passwords, locked cabinets, limited access, POPIA-aware cloud tools.
- Get consent for marketing lists and honour opt-outs immediately.
- Set deletion rules – do not keep old customer data forever.
Common mistakes to avoid
- Buying contact lists – marketing without consent breaches POPIA.
- Sharing customer data with “partner” businesses without telling customers.
- Leaving employee files and customer spreadsheets on unsecured shared computers.
A South African example
A Paarl gym stores member IDs and debit order details. POPIA compliance for them: a privacy policy on the wall and website, password-protected systems, contractor agreements with their billing company, and deleting ex-members’ data after the retention period.
Related questions
Always verify this information with official South African government sources. Rules, fees and thresholds change. Check SARS, CIPC, the Department of Employment and Labour or gov.za before you act.
Frequently Asked Questions
Does POPIA apply to small businesses?
Yes. POPIA has no turnover threshold – any business processing personal information of customers, employees or suppliers must comply, from a one-person consultancy upward.
What are the POPIA penalties?
The Information Regulator can impose administrative fines up to R10 million, and serious offences carry criminal liability. Civil claims from data subjects are also possible.
Do I need to register with the Information Regulator?
Certain responsible parties must register their Information Officer with the Information Regulator. For most small businesses the practical duties – policy, security, consent, retention – matter most day to day.
Official sources
About BizAnswers: BizAnswers is a privately owned South African company – not a government department. Our guides are free to read and show you how to do things yourself through official channels. If you would rather have the paperwork handled for you, we assist individuals and businesses with filing their South African tax returns and staying compliant, which is a paid service, not a free government service. Contact us for help.
Last reviewed: September 2026 by the BizAnswers editorial team. How we write and check our guides.
You May Also Like
What Is Business Rescue in South Africa?
