A small business does not need thousands of customers to create a data-protection responsibility.
If you collect a customer’s name and phone number, store employee records, receive CVs or maintain supplier contact details, you are handling personal information.
The Protection of Personal Information Act (POPIA) regulates how personal information is processed in South Africa.
Many owners think POPIA is something only banks, large companies and online platforms need to worry about.
That is a mistake.
A small retailer with a WhatsApp customer list, a local electrician with customer addresses or a home-based business storing order information may all have POPIA responsibilities.
1. What is POPIA?
POPIA is South Africa’s data-protection law.
Its purpose is to protect personal information and regulate how responsible parties collect, use, store, share and otherwise process that information.
Personal information can include:
- Names and surnames.
- Phone numbers.
- Email addresses.
- Home and delivery addresses.
- Identity numbers.
- Employment records.
- Customer purchase histories.
- Photographs and recordings.
- Information relating to an identifiable person.
The law applies according to the processing activity and relevant statutory conditions, not simply the size of the business.
2. Who is responsible for compliance?
The business or other person deciding why and how personal information is processed will often be the responsible party.
For example, a small online store decides to collect customer details to process orders and arrange deliveries.
The store is responsible for ensuring that the information is processed lawfully and protected appropriately.
If it uses a third-party service provider to store or process information, the relationship also needs to be managed properly.
3. Understand the core POPIA principles
Accountability
The responsible party must ensure that appropriate measures are in place to comply with POPIA.
Processing limitation
Personal information must be processed lawfully and reasonably. Collect only information that is relevant and not excessive for the purpose.
Purpose specification
Tell people why you are collecting their information. Do not collect information for one purpose and then use it for an unrelated purpose without a lawful basis.
Further processing limitation
Further use of information must be compatible with the original purpose or otherwise permitted by the law.
Information quality
Take reasonable steps to ensure that personal information is accurate, complete and updated where necessary.
Openness
People should receive appropriate information about the collection and use of their personal information.
Security safeguards
Protect information against loss, damage, unauthorised access and other risks.
Data subject participation
People have rights relating to their personal information, including rights to request access and correction, subject to the law.
4. A practical example: A small online retailer
A retailer sells products through a website and WhatsApp.
To process an order, it collects:
- Customer name.
- Contact number.
- Delivery address.
- Product ordered.
- Payment and order-status information.
This information is needed to complete the transaction.
But the retailer should not assume that a customer who placed an order has automatically agreed to receive unrelated promotional messages indefinitely.
The business should distinguish between information needed to fulfil an order and information used for marketing.
5. POPIA and WhatsApp marketing
WhatsApp is widely used by South African small businesses to communicate with customers.
But having someone’s phone number does not automatically mean you can send them any marketing message you want.
Section 69 of POPIA regulates unsolicited electronic direct marketing, including electronic communications such as email, SMS and relevant messaging channels.
The default position is that consent is generally required, subject to the limited existing-customer exception and other applicable provisions.
Businesses should:
- Keep a record of marketing consent where required.
- Clearly explain what a person is signing up to receive.
- Provide a straightforward way to opt out.
- Honour objections and opt-outs.
- Avoid adding people to marketing lists simply because they made an enquiry.
- Avoid sharing contact lists without a lawful basis.
The existing-customer exception is limited. It does not give a business permission to market any product or service to every person who has ever contacted it.
6. Protect the information you collect
A small business can start with basic safeguards.
For example:
- Use strong passwords.
- Enable multi-factor authentication where available.
- Limit access to customer records.
- Secure laptops and mobile phones.
- Avoid sending sensitive information to the wrong recipient.
- Back up important business records.
- Remove access when an employee leaves.
- Check how external service providers use and protect information.
If a security compromise occurs, the business should assess whether the incident constitutes a security compromise requiring notification under POPIA and follow the applicable process.
7. Appoint and register an information officer
Businesses should understand their information officer responsibilities and the Information Regulator’s registration requirements.
For many smaller organisations, the head of the organisation or an appropriate senior person will fulfil this role.
The information officer should help oversee the organisation’s POPIA compliance, internal procedures and communication with the Information Regulator.
8. What can happen if a business ignores POPIA?
Non-compliance can lead to regulatory investigations, enforcement notices, civil claims and administrative fines, depending on the contravention and applicable legal provisions.
Certain offences under POPIA carry criminal consequences.
Do not treat the maximum penalty as the likely penalty for every mistake. The consequences depend on the facts and legal provisions involved.
FAQs
Yes. Small businesses that process personal information may have POPIA responsibilities. There is no general exemption simply because a business has few employees or low turnover.
Do not assume that a customer enquiry or purchase gives permission for every future marketing message. Follow the applicable direct-marketing rules and maintain appropriate consent records.
A privacy notice or policy is a useful way to explain how your business handles personal information. It should accurately describe your actual practices rather than make promises your business cannot meet.
You remain responsible for assessing how personal information is collected, stored and shared. Consider security, access controls, service-provider arrangements and cross-border processing where relevant.