28/08/2026
If your website has a contact form, an email signup, a checkout page, or even a cookie, you’re collecting personal information – and POPIA applies to you in full. Most South African business owners know the Act exists. Far fewer have actually checked whether their website meets it.
That gap is getting riskier. The Information Regulator’s 2025/26 Annual Performance Plan, presented to Parliament’s Portfolio Committee on Justice and Constitutional Development in May 2026, signals a firmer enforcement posture: more proactive audits, tighter direct marketing rules following the April 2025 POPIA Regulations amendments, and mandatory use of the Regulator’s e-portal for breach notifications – which saw a 40% jump in monthly submissions in early 2025/26. Fines are already being issued, and SMEs are not exempt.
POPIA applies to every website, and there are no exceptions.
A practical guide to making your South African business website POPIA compliant — privacy policy, cookies, consent, and data retention, explained simply.