POPIA Explained for Small Businesses

Quick answer: POPIA controls how you collect, use, store and share personal information. Collect only what you need, keep it secure, be open about it and register your information officer.

What counts as personal information

Names, ID numbers, phone numbers, email addresses, addresses and more, about people and, in South Africa, also about companies.

The main obligations

• Collect only what you need, for a clear purpose
• Tell people why you collect it and how it is used
• Keep it secure
• Don't keep it longer than necessary
• Let people access or correct their information

Information officer

Every business has an information officer, by default the head of the business, who must be registered with the Information Regulator.

Your website

Publish a privacy policy, secure your forms with SSL and only ask for the information you need.

This is general information, not legal advice.