Your website collects personal information — so POPIA applies
The Protection of Personal Information Act (POPIA) applies to any South African business that collects information about people. If your website has a contact form, takes bookings, sells online, runs a chat or collects email addresses for a newsletter, that is you.
Under POPIA your business is the "responsible party" for that information. SiteHub builds and hosts your website and stores the information on your behalf, but the decisions — what you collect, why, and what you do with it — are yours, and so is the responsibility.
This guide sets out the steps most small businesses need to take. It is general guidance, not legal advice, and following it does not on its own make you compliant. Every business is different; if you handle sensitive information or are unsure, speak to a qualified advisor.
1. Register your Information Officer
Every business has an Information Officer. By default it is the owner or head of the business — no one needs to be hired.
- Register your Information Officer with the Information Regulator. It is free and done online at inforegulator.org.za.
- You can also name a Deputy Information Officer, so someone can act when you are away.
2. Check your website's Privacy Notice
Your SiteHub website comes with a Privacy Notice written for POPIA. It is a template, so read it and make sure it matches what your business really does.
- Is your business name and contact email right?
- Does it describe what you actually collect — forms, bookings, orders, newsletters?
- If you use other tools (an accounting system, a mailing list, a courier), is that covered?
- Have it checked by someone qualified, especially if your business is in a regulated field.
3. Only ask for what you need
POPIA expects you to collect only the information you need for a clear purpose.
- Look at your contact and booking forms. Do you need every field?
- Do not ask for ID numbers, dates of birth or medical details unless you genuinely need them.
4. Marketing needs permission
- Only send marketing emails, SMSes or WhatsApps to people who agreed to receive them, or to existing customers about similar products or services.
- Every marketing message needs an easy way to unsubscribe.
- When someone asks you to stop — by email, phone or in person — stop, and keep a note so it does not happen again.
5. Take extra care with children's and health information
- Children: a parent or guardian must provide and agree to a child's information. Schools, crèches, tutors and sports clubs need to get this right.
- Health: health information is "special personal information". Use it only with the person's consent or where the law allows, and keep it strictly confidential.
6. Keep your information secure
- Know who has a login to your SiteHub dashboard, and give access only to people who need it.
- Use strong passwords and do not share logins.
- Remove access straight away when someone leaves.
- Be careful with downloads and exports of customer lists — they leave the protection of your dashboard.
7. Answer requests from your customers
People can ask what information you hold about them, ask you to correct or delete it, or object to how you use it.
- Check it is really them before you act.
- Reply within a reasonable time — 30 days is a good rule.
- Some records, such as invoices, you must keep for tax purposes even if asked to delete them. Tell the person when that applies.
- SiteHub can help you find or remove a customer's information in your dashboard. Just ask.
8. If information leaks, act quickly
If personal information is lost, stolen or seen by someone who should not have it:
- Stop it from getting worse — change passwords, remove access.
- Tell the Information Regulator and the people affected as soon as reasonably possible.
- Tell SiteHub too, so we can help.
- Write down what happened and what you did.
9. Advertising and tracking tools need consent
If you use Google Analytics, or advertising pixels from Meta (Facebook and Instagram) or TikTok, they may only run once a visitor has accepted cookies.
- SiteHub websites hold tracking back until the visitor accepts the cookie banner.
- If you or your marketer add a Meta or TikTok pixel through Google Tag Manager, make sure it is set to wait for marketing consent.
10. Keep simple records and review once a year
- Keep a short note of what information you collect, why, where it is kept and who can see it.
- Keep a list of requests you received and how you answered them.
- Once a year, re-read your Privacy Notice and check it still matches what you do.
- Ask your advisor whether you also need a PAIA manual (a guide to the records you hold and how to request them).
The short version
Register your Information Officer. Make sure your Privacy Notice tells the truth. Collect only what you need. Market only with permission. Keep logins tight. Answer requests. Act fast if something leaks. Review once a year.
Your SiteHub website gives you a strong starting point — but compliance is about how your business handles information every day, and that part is yours.