For South African business · 2 minute read
POPIA and your business website: what small business owners need to know
The moment a customer types their name and number into your website, you are collecting personal information. South Africa’s privacy law, POPIA, has applied to that since 1 July 2021. Most website builders made overseas leave it to you to work out.
The short answer
Every Appetite Host website is built with POPIA in mind: the contact form says who is collecting what and why, messages are handled for you under a written privacy agreement, and they are deleted after 12 months.
What POPIA asks of a business website
When you collect someone’s personal information, section 18 of POPIA says you must take reasonable steps to tell them what you are collecting and why, who you are and how to reach you, whether giving it is voluntary, and what their rights are, including the right to complain to the Information Regulator.
For a small business website, that usually comes down to the contact form. A form that just says “Send” with no explanation does not tell a visitor any of that.
What we do for you
- A privacy line under every form. Your visitors see who will receive their message and why.
- A written agreement. For the messages your website collects, we act for you under a privacy agreement in our Terms, as POPIA expects of anyone who handles information on your behalf.
- Messages go to you. Each message is emailed to you and kept for 12 months, then deleted.
- Spam protection without tracking. Forms are protected against spam without asking your visitors to tick puzzles or follow them around the internet.
- Plain privacy wording on our side. Our Privacy Policy explains, in plain language, what we collect and why.
What stays with you
POPIA treats you, the business, as the “responsible party” for your customers’ information. A few things are yours to do whatever website you use:
- Only use people’s details for what they gave them to you for: answering their enquiry.
- Ask before you add anyone to a marketing list.
- Know who your Information Officer is. In a small business that is usually the owner. The Information Regulator says small businesses that process personal information are also obliged to register their Information Officer.
Why it matters
POPIA allows the Information Regulator to impose administrative fines of up to R10 million. For most small businesses the bigger risk is trust: customers notice when a business takes their details seriously, and when it does not.
This post is a plain guide, not legal advice. For your own situation, speak to an attorney or read the Information Regulator’s guidance.
Questions
Does POPIA apply to my small business website?
If your website collects personal information, such as a name, phone number or email through a contact form, then yes. POPIA has applied since 1 July 2021, with no exemption for small businesses.
Who is responsible for my customers’ information, me or Appetite Host?
You are the responsible party for your customers’ information. Appetite Host handles the messages your website collects on your behalf, under a written privacy agreement in our Terms.
How long are messages from my website kept?
Each message is emailed to you, and we keep a copy for 12 months, then delete it.
Prices checked on 8 October 2026, as each provider showed them to a visitor in South Africa. They change; check with the provider before you decide.
Keep reading
Every post
For South African business
Why your business needs its own .co.za, in your name
A .co.za tells customers you are a real South African business. Who it is registered to decides who controls it. Why it matters, and how Appetite Host handles it for you.
For South African business
Pay for your website in rand, not dollars
Most website builders bill South African businesses in US dollars, so the price moves with the exchange rate. Why a rand price is easier to plan around, with real figures.
See yours before you decide
Tell Naya about your business and watch her build it. Free to try.