POPIA for small businesses, in plain language
If you keep a customer's name, number or address, the Protection of Personal Information Act (POPIA) applies to you. It is less scary than it sounds: most of it is common sense about collecting only what you need and looking after it.
What counts as personal information
Names, phone numbers, email addresses, ID numbers, addresses, photos and anything else that identifies a person, including your customers, staff and suppliers' contacts. Collect only what you need, for a clear reason, and tell people why.
Your Information Officer
Every business has an Information Officer, by default the owner or head of the business, who is responsible for POPIA compliance and must be registered with the Information Regulator.
Marketing needs consent
Sending marketing messages by email or SMS to people who are not your customers needs their consent first. Existing customers may be marketed to about similar products, but every message must offer an easy way to opt out, and you must honour it.
Keep it secure
- Passwords on devices and accounts, and two-step login where possible.
- Limit who can see customer data.
- Delete what you no longer need.
- Suppliers who handle data for you, like your IT company or bookkeeper, need a written agreement to keep it safe: see choosing an IT company.
If something goes wrong
If personal information is lost, stolen or accessed by someone who should not have it, you must notify the Information Regulator and the people affected as soon as reasonably possible. Write down what happened and what you did about it.
Common questions
Does POPIA apply to small businesses?
Yes. Any business that keeps personal information, such as customers' names and phone numbers, must comply with POPIA, whatever its size.
Who is the Information Officer in a small business?
By default the owner or head of the business. The Information Officer must be registered with the Information Regulator.
Can I send marketing WhatsApps or emails to customers?
To people who are not yet customers, only with their consent. Existing customers may receive marketing about similar products, but every message must offer an easy opt-out that you honour.