1. Map every place your website collects personal information
Start by listing every form, pop-up and checkout point on your site. That includes contact forms, quote requests, newsletter sign-ups, online bookings, account registrations, chat tools, customer reviews, and any page where you ask for ID numbers, addresses or payment details. If your business serves customers in Cape Town, Johannesburg or a small town in the Karoo, the rule is the same: if you collect personal information online, you need to know exactly where it goes.
Once the collection points are clear, note what is collected, why it is needed, who can see it and how long it is kept. Many businesses miss hidden collection points such as embedded maps, analytics tools, tracking pixels or file upload forms. Those often sit quietly in the background and still carry compliance risk.
- List every form and checkout step on the site.
- Record the type of information collected at each point.
- Note the purpose for collection and the retention period.
- Check third-party tools that may receive data.
2. Check that your notices explain use, sharing and consent
Your privacy notice should explain in plain language what you collect, why you collect it, and who receives it. Visitors should not have to guess whether their details are used for service delivery, marketing, fraud checks, courier delivery or payment processing. POPIA expects transparency, and so do practical customers who want to know what happens to their information.
Make sure the notice is easy to find from the footer, the checkout page and any form where personal information is requested. If you rely on consent for a newsletter or promotional messages, the opt in must be clear and separate from general site use. A pre-ticked box is not a good idea and can cause trouble later.
- Say what information is collected and why.
- Explain whether details are shared with service providers.
- Include a clear opt in for direct marketing where needed.
- Link the notice near each relevant form.
3. Tighten your forms, cookies and tracking settings
Many websites collect more than they need. A contact form that asks for a birth date, ID number and company registration details may be too much for a simple callback request. Keep each form limited to what is necessary for the task. That reduces risk and makes it easier to explain the reason for collection.
Cookie banners and tracking tools also need attention. If your site uses analytics or remarketing tools, tell visitors what is running and give them a real choice where required. This is especially important for ecommerce sites, booking systems and subscription businesses that rely on repeat visits and customer profiles. A basic settings panel is often better than trying to force everyone through one long notice.
- Remove fields you do not truly need.
- Separate essential cookies from optional tracking tools.
- Test consent settings on mobile and desktop.
- Check whether third-party tools store data outside South Africa.
4. Build a secure handling process behind the scenes
POPIA is not only about what appears on the page. It is also about how your team handles the information after it is submitted. Access should be limited to the people who need it. Shared inboxes, open spreadsheets and old exported lists create unnecessary exposure. If someone in Gardens or Bellville can see every client record without a clear reason, the process needs work.
Set simple rules for storage, access and deletion. If you use cloud tools, make sure passwords are strong, two-factor authentication is on, and accounts are removed when staff leave. In South Africa load-shedding can interrupt work, so backups need to be current and stored properly. Keep a record of who has access to what and review it regularly, not once in a blue moon.
- Limit access to active staff only.
- Use strong passwords and two-factor authentication.
- Back up data and test restoration from time to time.
- Delete records that no longer have a lawful business purpose.
5. Prepare your response plan for access requests and complaints
Visitors and customers may ask what information you hold, how it is used, or who received it. You need a simple process to deal with those requests within a reasonable time. That means knowing where records are kept, who answers the query, and how to verify the person making the request. If you run an online store, a booking site or a membership platform, this should be written down before the first request lands.
You should also have a plan for complaints and possible breaches. If a form is misdirected or a staff account is compromised, the response must be quick and orderly. A calm process helps protect the business and the customer at the same time. It also shows you took reasonable steps, which matters when you need to explain your handling later.
- Assign one person to manage website data requests.
- Keep a simple log of queries and outcomes.
- Use a written incident response process.
- Review service provider contracts where they touch customer data.
6. Keep your policy pack and site checks up to date
A POPIA checklist is not a once-off job. Websites change when you add new forms, new plugins, new payment options or new marketing tools. Each change can affect your notices and internal controls. A business in Cape Town CBD may update monthly during peak trading, while a consultant in Paarl may only need quarterly checks, but both need the same discipline.
Review your privacy notice, terms and related documents whenever the site changes in a material way. If you have a subscription product, booking engine or ecommerce checkout, check that your wording still matches the actual customer journey. TsAndCs supports businesses nationwide with policy packs, POPIA alignment, website terms, privacy gap analysis and launch readiness checks, so your documents stay in step with how the site actually works.
- Review documents after major site changes.
- Check that forms, notices and consent wording still match.
- Update staff roles and access rights when the team changes.
- Keep a dated record of each review.
