POPIA for small businesses starts with knowing what personal information you hold, why you need it and what happens to it once it enters your business. A policy is useful, but it cannot protect customer records if staff share passwords or leave confidential documents where anyone can read them.
The Protection of Personal Information Act, commonly called POPIA, governs how personal information is handled in South Africa. For a business owner, the practical challenge is turning its requirements into routines that people understand and follow.
The six areas below provide a useful starting point. They are not an exhaustive compliance checklist, particularly for businesses handling children’s information, health records or other information subject to additional requirements.
1. Identify and register your Information Officer
Privacy compliance needs someone who can make decisions and follow through on them. If everyone assumes somebody else is responsible, requests go unanswered and problems remain unresolved.
The Information Officer is generally the head of the business by virtue of their position. The role should therefore be correctly identified before responsibilities are assigned. Any designation of deputies or delegation of duties should be properly documented.
The Information Regulator’s guidance confirms that registration is compulsory and must take place before the Information Officer takes up their POPIA duties. Deputies should be designated where necessary, taking account of the business’s structure and size.
Give the role practical authority
The person overseeing compliance needs access to the people, systems and records involved. They should be able to question an unnecessary form field, arrange staff training and ensure that a security concern receives attention.
In a small business, this work may sit alongside other responsibilities. That makes a simple written allocation of duties particularly useful.
Keep the registration details accessible and make sure staff know whom to contact. A customer asking about their information should not be passed between employees who have never heard of the role.
An outside adviser can help the business understand its obligations. Management still needs to ensure that the advice becomes part of everyday operations.
2. Map the personal information your business holds
You cannot manage information properly if you do not know where it is.
Start by looking at the records used in ordinary business activities. These might include customer contact details, employee files, job applications, supplier records, delivery addresses and enquiries submitted through your website.
A manageable spreadsheet is often a practical way to begin. For each category, record:
- What information is collected.
- Where it comes from.
- Why the business uses it.
- Where it is stored.
- Who can access it.
- Which service providers receive it.
- When it should be reviewed or removed.
This is a working inventory, so use descriptions that staff will recognise. “Customer delivery addresses in the order system” is more helpful than a vague reference to “operational data”.
Look beyond the main software system
Information often accumulates outside the place where management expects to find it.
An employee may download a customer list to prepare a report. A manager may keep copies of applications in an email folder. An old laptop may contain records that were never transferred or deleted.
Include paper files, shared inboxes, messaging apps, external drives and personal devices used for business work.
Ask employees how they actually complete their tasks. The answer may reveal informal arrangements that are missing from the official process.
Review the inventory when you introduce new software, change suppliers or start collecting information for a new service. Otherwise, it can become outdated while the business continues to rely on it.
3. Establish a lawful purpose and explain it clearly
Every collection of personal information should have a reason you can explain.
A delivery business may need an address to complete an order. It should still ask whether every field on its customer form serves a necessary purpose.
POPIA requires a defined, lawful purpose and information that is not excessive for that purpose. Consent is one possible basis for processing, but others include contractual necessity and legal obligations. Section 18 addresses what people must be told about collection.
Check the form before asking for more information
Review each field and ask what would happen if you removed it.
Would the business still be able to deliver the service? Is the information needed now, or only if the customer proceeds further? Has somebody added the field simply because another business uses it?
These questions can reduce unnecessary collection and make forms easier to complete.
They also help avoid treating every activity as a consent exercise. A broad tick box does not explain why the business needs each category of information.
Write notices people can understand
A privacy notice should help someone understand what will happen to their information. Explain the collection, its purpose, relevant sharing arrangements and how to raise a question or exercise a right.
Include the business’s details and the other disclosures applicable to the activity. Explain retention arrangements clearly enough for people to understand the approach.
Place the relevant notice where people provide their information. A customer completing an enquiry form should not have to search several pages to find it.
Be specific about important differences. Information supplied to answer an enquiry should not quietly become part of an unrelated campaign without checking whether that use is lawful.
4. Secure information and prepare for incidents
Good security begins with understanding how something could go wrong in your particular business.
Think about who can open payroll records, whether a stolen laptop would expose customer files and how staff confirm a request to change banking details.
Useful practical measures include:
- Unique accounts and strong passwords.
- An additional verification step when signing into important systems.
- Access permissions suited to each employee’s work.
- Updated software and protected devices.
- Backups that are tested.
- Secure storage and disposal of paper records.
- Prompt removal of access when someone leaves.
These measures need maintenance. A permission granted for a temporary assignment can become a permanent risk if nobody reviews it.
Teach staff how to respond
Employees should know how to check recipients before sending attachments, recognise suspicious messages and report mistakes promptly.
Make reporting straightforward. If an employee sends a document to the wrong person, early notification gives the business a better opportunity to respond.
Your incident process should identify who coordinates the response, whom to contact for technical help and how to preserve relevant evidence.
Understand breach notification
POPIA requires notification where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. Notification goes to the Regulator and, subject to statutory qualifications, the affected people.
The Information Regulator’s security compromise fact sheet explains that an investigation does not have to be completed before reporting. Notification should be made as soon as reasonably possible, and further information can follow. Reports to the Regulator are submitted through its eServices portal.
Knowing this process before an incident is far easier than trying to work it out during one.
5. Put appropriate terms in place with service providers
Small businesses often depend on outside providers for payroll, accounting, marketing, IT support and document storage.
Before choosing a provider, establish what information it will receive and what it will do with it. A familiar brand or a statement that its platform is secure should not end the enquiry.
Where a provider acts as an operator, section 21 requires a written contract addressing the required security measures. Whether a provider is an operator depends on its actual role.
Ask what happens throughout the relationship
Suitable terms should address authorised use, confidentiality, security, incident reporting and what happens to information when the service ends.
Questions worth asking include:
- Can the provider use the information for its own purposes?
- Who else can access it?
- Are other providers involved?
- How will you recover your records if you cancel?
- What will be deleted, and when?
- Where will the information be processed or stored?
If information is transferred outside South Africa, check the requirements of section 72. Using an overseas service calls for a proper assessment of the transfer arrangements.
Keep the contract and relevant service terms where they can be found. Review them when the provider changes its service or the business starts using it differently.
6. Handle requests, retention and direct marketing properly
Privacy compliance continues after information has been collected.
People may ask what you hold, request a correction or seek deletion where the law allows. Staff need a process for recognising these requests and directing them to the right person.
Respond carefully to information requests
Record the request, verify the person’s identity appropriately and assess what response is required. Avoid sending confidential records simply because an email appears to come from a familiar address.
A deletion request also needs assessment. POPIA’s rights and retention rules are qualified, and another lawful requirement may justify keeping certain records. Explain the decision rather than ignoring the request.
Set retention periods that make sense
Create a schedule for the main categories of records. Include the reason for keeping them and the event that starts the retention period.
Different records may need different treatment. An unsuccessful application, a completed order and an employee payroll record should not automatically share one blanket period.
Assign someone to carry out the review. A retention schedule does little if old files remain indefinitely in shared folders and inboxes.
Check permission before sending marketing
Finding an email address online or buying a database does not automatically authorise promotional messages.
Under section 69, unsolicited electronic direct marketing generally requires consent unless the customer exception applies. That exception covers the business’s own similar products or services, using details obtained during a sale, with a free opportunity to object when collected and in each message.
A consent request is permitted only once where the person has not previously withheld consent, using the prescribed manner and form.
The Information Regulator’s direct marketing guidance is a useful reference when planning a campaign. It addresses both electronic and other forms of direct marketing.
Keep a record of the basis for contacting recipients and ensure objections reach every relevant mailing system. Otherwise, someone removed from one list may be added again through an old spreadsheet.
Make POPIA part of running the business
A small business needs privacy arrangements that fit its work and can be maintained.
Begin with an honest picture of what happens to information. Then address unnecessary collection, unclear responsibilities, excessive access and gaps in supplier arrangements.
Keep the documentation useful. Staff should be able to find the relevant instruction and understand what to do without interpreting a lengthy policy.
POPIA compliance for small businesses becomes more manageable when it is included in ordinary decisions: choosing software, hiring an employee, creating a form or preparing a campaign.
The test is whether your business can explain its practices and consistently follow them.
