Start with a data map before you start writing

One of the easiest mistakes is to download a privacy-policy template before understanding the business. That reverses the order. A better starting point is a simple data map: what comes in, why it comes in, where it goes, who can access it and how long it is kept.

Before drafting or obtaining a privacy policy, work through these questions:

1. What information do we collect? List the fields, uploads, identifiers and other information collected through the website or connected tools.

2. Why do we collect it? Tie each type of information to a real business purpose. POPIA requires a specific, explicitly defined and lawful purpose, and it also applies a minimality principle: information should be adequate, relevant and not excessive for that purpose.

3. Is providing it voluntary or required? For a form, be clear which information is necessary to handle the request and what may happen if it is not provided.

4. Where does the information go? A form may send information to an email mailbox, website database, booking system, CRM, newsletter platform or other service.

5. Who receives or processes it? Identify staff, service providers and other recipients that may handle the information. A third-party platform can still be part of your business’s information-processing chain.

6. Does information leave South Africa? Cloud services may store or process information in another country. POPIA has specific rules for transfers outside the Republic, so this is something to understand rather than assume.

7. How long is it kept? Do not write an arbitrary retention promise. POPIA generally requires that personal information not be kept longer than necessary for the purpose, subject to recognised exceptions such as legal or contractual requirements.

8. How can a person ask questions or exercise rights? Your business should know who handles privacy queries and how requests for access, correction or deletion are dealt with where applicable.

A small-business website can collect more personal information than its owner realises. A simple contact form may ask for a name, email address and phone number. A quote form may collect project details. A newsletter form collects contact information for future messages. An online account may store login and order information. Even some analytics or technical tools may process online identifiers or other data that falls within the broad definition of personal information under South Africa’s Protection of Personal Information Act (POPIA).

That raises an obvious question: does your website need a privacy policy?

For many businesses that collect or process personal information through their website, a clear privacy notice or privacy-policy page is a sensible and often important part of meeting their transparency responsibilities. But the page itself is not a POPIA compliance certificate. The real issue is whether your business understands what it collects, why it collects it, how the information is used and shared, and what people are told at the point of collection.

This guide explains the practical website side of that question. It is general information for South African small-business owners, not legal advice.

Privacy policy or privacy notice: what is the difference?

On websites, the terms privacy policy and privacy notice are often used loosely. POPIA’s section 18 focuses on notifying a data subject when personal information is collected. The Information Regulator itself uses the term “Privacy Notice” for its public explanation of how it processes personal information.

For a small-business website, the label matters less than the substance. The document should accurately explain the business’s real information-handling practices in language an ordinary visitor can understand. Calling a page “Privacy Policy” does not make it useful if it is copied from another business, describes tools you do not use, or omits important collection that actually happens.

When does a website start collecting personal information?

The obvious examples are forms. If a visitor enters identifying or contact details and sends them to your business, personal information is being collected. Common website situations include:

· contact and general enquiry forms;

· quote or booking request forms;

· account registration and customer login areas;

· newsletter or marketing subscriptions;

· online purchases and order information;

· job application or document-upload forms;

· support messages, chat or other customer-service submissions; and

· analytics, tracking or technical services where online identifiers or other identifiable information are processed.

Not every tool collects the same information, and not every analytics setup creates the same privacy impact. The important owner-level step is to stop guessing. Find out what the website and its connected services actually collect.

If your website has a contact page, start by listing every field a visitor can complete and every route they can use to send information. Our guide to

What Should Be on a Small-Business Contact Page? A Practical Checklist can help you review the contact-page structure without turning the privacy exercise into a redesign project.

What should a small-business website privacy policy normally explain?

The exact wording depends on the business and the information it processes. At owner level, however, a useful privacy document will usually need to cover the areas below in a way that matches reality:

· Who is responsible for the information. Identify the business clearly and provide appropriate contact details.

· What information is collected. Describe the main categories rather than hiding them behind vague wording such as “certain information”.

· Why it is collected and used. Explain the purposes in practical terms: responding to enquiries, processing orders, managing accounts, sending requested communications and so on.

· Whether information is shared or processed by others. This may include hosting, email, booking, payment, analytics or other service providers where relevant.

· Cross-border processing where applicable. If relevant services process information outside South Africa, this should be understood and addressed appropriately.

· Retention. Explain the approach to keeping and deleting information without promising periods the business cannot actually follow.

· People’s rights and complaint routes. Section 18 includes awareness of rights such as access and rectification, and the right to lodge a complaint with the Information Regulator where applicable.

· How to contact the business about privacy. Visitors should not have to hunt for the person or channel responsible for privacy questions.

The business should also understand the lawful justification it relies on for its processing. POPIA does not make consent the only possible justification, so adding a consent checkbox to every form is not a substitute for understanding why the processing is lawful.

Where should the privacy policy be accessible?

A privacy document is only useful if people can find it. For many small-business websites, the footer is a practical home for a persistent Privacy Policy or Privacy Notice link because the footer appears across multiple pages. If you are reviewing that area of your site, see

What Should Go in a Small-Business Website Footer? A Practical Checklist.

A footer link does not always solve the whole notification problem. Where a form collects personal information, a short, clear notice or nearby link can help the visitor understand the collection before submitting. Account registration, checkout and newsletter sign-up areas may also need appropriate privacy information close to the point where data is requested.

Keep the detailed cookie-consent question separate unless it is necessary for the tools you use. The first task for this article is simpler: make the business’s actual collection visible and understandable.

A privacy-policy page does not make a business POPIA compliant

This is the most important distinction in the article.

A website can have a polished privacy-policy page and still handle personal information badly. POPIA also deals with accountability, lawful and reasonable processing, minimality, purpose, retention, openness, security safeguards and other obligations. If a service provider processes information for your business, POPIA also contains requirements dealing with operators and security arrangements.

The public page should therefore match the operational reality behind it. If the policy says enquiry information is used only to answer an enquiry, but the business automatically adds every enquirer to a marketing list, the document and the actual practice are no longer aligned.

Newsletter subscriptions and other direct marketing deserve particular care because POPIA contains specific rules for unsolicited electronic direct marketing. This article does not turn that topic into a full marketing-law guide; the practical point is that collecting an email address for an enquiry and using it for future marketing are not automatically the same purpose.

Similarly, testing whether a contact form successfully sends an email is a different job from explaining how the submitted information is handled. If you need to test the technical enquiry path, use

How to Test Your Website Contact Form Before It Costs You Leads for that separate check.

When should you get professional legal guidance?

A straightforward local service-business website with a basic enquiry form may be easier to map than a platform handling sensitive or high-volume information. Professional legal or privacy guidance becomes more important when the business deals with circumstances such as:

· special personal information, health information, biometrics or children’s information;

· large customer databases or complex profiling;

· regulated professional or financial information;

· significant direct-marketing activity;

· multiple third-party processors or complex advertising and analytics tools;

· international data transfers that are difficult to assess;

· customer accounts, portals or document uploads containing sensitive information; or

· uncertainty about the correct lawful basis, notices, contracts, retention rules or regulatory obligations.

A website designer can help place approved privacy information where visitors can find it and make sure the page fits the site structure. That is different from giving legal advice about what the business must say or whether its wider processing is compliant.

A practical pre-publishing checklist

Before you publish or update a website privacy policy, ask:

· Have we listed every website form and data-collection tool?

· Do we know what information each one collects?

· Can we explain why each item is needed?

· Do we know which systems and service providers receive the information?

· Have we considered storage location, cross-border processing and retention?

· Does the wording describe our real practice rather than a generic template?

· Can a visitor find the privacy information easily, including near important collection points?

· Do we have a working contact route for privacy questions or requests?

· Have we separated enquiry handling from newsletter or other direct-marketing activity?

· Do any higher-risk or uncertain areas need qualified legal advice before publication?

The useful question is not just “Do we have a privacy policy?”

A better question is: can we clearly explain what our website collects and what happens to that information?

If the answer is yes, preparing an accurate privacy notice or privacy-policy page becomes much easier. If the answer is no, the first job is not writing. It is understanding the data flow.

For South African small businesses, that approach is more useful than treating privacy as a footer formality. Make the collection clear. Keep the information relevant to the purpose. Make the privacy explanation easy to find. And when the legal position is not straightforward, get appropriate professional guidance.

WebWise Management can help with the website side of the process, including page structure, form placement and making approved privacy information easy for visitors to find. WebWise Management does not provide legal advice, so legal wording or complex POPIA questions should be confirmed with a suitably qualified professional.

Contact

Reach out anytime for personalized support.

Email:

Phone:

info@webwisemanagement.co.za

+27 72 709 7557

© 2026. All rights reserved.

Services

Home

Portfolio

Contact