POPIA: What your website needs to get right for South African customers

Does POPIA apply to your business?

POPIA generally applies to relevant processing by a responsible party domiciled in South Africa, or a party outside South Africa using processing means in the country other than solely for transit.

It protects information relating to identifiable living individuals and, where applicable, identifiable existing juristic persons. There is no general revenue threshold that exempts every small business.

The South African government’s POPIA publication provides the Act. Check the scope against your actual activities and applicable exclusions rather than assuming that only large companies need to act.

How cookies and marketing fit together

Cookies and similar technologies can involve personal information when identifiers or browsing activity relate to an identifiable person. Whether a tool uses a first-party domain does not settle that question.

POPIA permits processing on different grounds in appropriate circumstances. Consent is one route, but it is not the only possible justification for every website function.

Direct marketing also has specific rules. The Information Regulator’s guidance on direct marketing includes the use of cookies among methods of electronic direct marketing. Do not assess an advertising cookie solely as a technical storage choice while ignoring what the resulting information is used to do.

Five things to get right

1. Collect information for a clear, justified purpose

List the data collected by each tool and why it is needed. Separate requested functions, service measurement and optional advertising uses.

POPIA’s conditions include processing limitation, purpose specification, openness and security. Collecting everything a platform makes available is not the same as demonstrating a justified need.

A useful practical test is whether you can explain the purpose in one clear sentence. If your team cannot explain a field or event, review whether it should be collected at all.

2. Choose the appropriate legal route

Assess the relevant justification for each activity under the Act. Where consent is needed, obtain a voluntary, specific and informed choice and make it effective.

Optional advertising deserves particular attention because of the direct-marketing rules. Section 69 generally requires consent for unsolicited electronic direct marketing unless the narrow existing-customer conditions apply.

Those conditions are not a general permission to market to everyone who has ever visited your website. They concern specific circumstances, including your own similar products or services and appropriate opportunities to object. The regulator’s guidance explains the distinction.

3. Explain collection and make the choice understandable

Tell people what is collected, why, who is responsible, relevant recipients and how to exercise their rights, as applicable. Make privacy contact details easy to find.

Use a concise first layer with accessible detail. For consent-based tracking, provide clear acceptance and rejection routes and keep optional activity off until permission is given.

Avoid treating agreement to a purchase or account terms as automatic consent to every advertising use. The customer should understand the separate purpose and practical effect of the choice.

4. Make objections, withdrawal and requests work

People have applicable rights concerning access, correction and deletion, and can object to relevant processing, including direct marketing. The conditions and exceptions differ by request.

Provide a practical channel and connect it to the systems holding the information. If someone objects to direct marketing, check audiences and scheduled campaigns, not only the contact preference visible in one account screen.

Where consent is the basis, implement withdrawal for future consent-based activity. Explain any information that must be retained for another valid purpose rather than silently continuing optional use.

5. Keep suppliers and transfers under control

POPIA distinguishes responsible parties from operators processing information on their behalf. Review the operator arrangement, security obligations and actual instructions.

The Information Regulator’s POPIA resources provide access to the regulatory framework and guidance. Use the Act’s requirements when reviewing retention, information-officer responsibilities and overseas transfers.

An international advertising platform does not become unrestricted simply because the customer clicked “accept”. Assess the transfer and the recipient’s use separately, and ensure your explanation matches the arrangement.

A practical ecommerce example

A customer buys a product from your store. You process the information needed to complete the order and separately consider using browsing information for advertising.

The order does not automatically authorise all behavioural marketing. Assess the advertising purpose and any applicable electronic direct-marketing rule. If the customer refuses or later objects, verify the relevant activity stops across your tools.

A general promotion shown to everyone on the site and a personalised message based on an identifiable profile may need different assessments. Keep the analysis tied to the actual use.

What this means for your marketing team

Maintain separate records for different purposes and channels. A single “marketing allowed” field can hide important differences between cookie tracking, email messages and other communications.

Use privacy changes as part of campaign quality checks. Before launching a new audience or platform, review the source of the information, the purpose, the relevant permission and how objections will reach the destination.

For performance reporting, explain when a smaller audience reflects valid preferences. Do not try to recreate a refused marketing use through a differently named integration.

Website checklist

• Check scope: assess the responsible party, processing means and applicable exclusions.
• Check information: identify personal data in cookies, events and connected records.
• Check purposes: record the justification for each use.
• Check direct marketing: assess section 69 and any claimed customer exception.
• Test consent: keep consent-dependent activity off until permission.
• Test objections: include audiences, exports and scheduled campaigns.
• Check operations: review retention, security, operators and overseas transfers.
• Test rights: make privacy contacts and request handling usable.

FAQ