POPIA — the Protection of Personal Information Act — is South Africa’s data protection law, and it applies to your online store whether you’ve thought about it or not. The moment you collect a customer’s name, email, delivery address or payment details, you’re processing personal information, and POPIA governs how you’re allowed to do that. It’s been fully enforceable since 2021, and the body that oversees it (the Information Regulator) has real teeth, including the power to impose significant fines.

The good news: for a normal online store, compliance is mostly common-sense good practice plus a few specific documents and habits. This is a plain-English walkthrough of what POPIA actually requires of an SA store. Note up front: this is general information to help you understand your obligations, not legal advice — for your specific situation, consult a professional. With that said, here’s the practical picture.

What POPIA is, in one paragraph

POPIA exists to protect people’s personal information and give them control over how businesses use it. It sets out conditions for lawfully processing personal information — collecting it for a clear purpose, with consent or another lawful basis, keeping it secure, using it only for what you said, and respecting the person’s rights over their own data. For an online store, “personal information” is everything you hold about a customer: name, email, phone, address, order history, and so on. If you handle that — and you do — you’re a “responsible party” under the Act and you have obligations.

The core obligations for an online store

Stripped to what matters for a typical SA store:

• Collect only what you need, for a stated purpose. Don’t hoard data “just in case.” Collect what’s needed to fulfil the order and serve the customer, and be clear about why.
• Get consent for marketing. You can process order data to fulfil a purchase, but sending marketing (newsletters, promotions) requires consent — a genuine opt-in, not a pre-ticked box. This is the one that trips stores up most.
• Have a privacy policy. A clear, accessible policy telling customers what data you collect, why, how you use it, who you share it with, and their rights. This is non-negotiable for an online store.
• Keep data secure. Take reasonable steps to protect personal information — secure your store (SSL, strong passwords, access control), and use reputable, secure payment and email providers.
• Let customers exercise their rights. People can ask what data you hold, correct it, or request deletion. You need a way to handle those requests.
• Don’t keep data forever. Retain personal information only as long as you have a legitimate need; don’t sit on old customer data indefinitely.
• Report breaches. If personal information is compromised, POPIA requires you to notify the Information Regulator and affected people.

The privacy policy: your foundation document

Every compliant SA online store needs a proper privacy policy, accessible from the footer and at points where you collect data (checkout, signup). It should, in plain language, cover: what personal information you collect, why you collect it, how you use it, who you share it with (payment processors, couriers, email tools), how long you keep it, how you keep it secure, and how customers can exercise their rights or contact you about their data. This isn’t box-ticking — a clear privacy policy also builds the trust that, as we cover in the conversion guide, directly affects whether cautious SA shoppers buy from you.

The marketing consent trap

This is where well-meaning stores most often slip up. There’s a difference between processing someone’s data to fulfil their order (which you can do as part of the transaction) and using their details to market to them (which needs consent). Adding every customer to your newsletter list automatically, or pre-ticking a “subscribe” box, isn’t compliant. The fix is straightforward: use a genuine opt-in — an unticked box, or a separate sign-up — so the people on your marketing list actually chose to be there. As a bonus, this also makes your email marketing more effective, because an opted-in list engages far better than a scraped one.

An Information Officer

POPIA requires every responsible party to have an Information Officer — the person responsible for compliance. For a small business, this defaults to the owner (the head of the business) unless someone else is designated. The Information Officer is meant to be registered with the Information Regulator, and is the point of accountability for how the business handles personal information. For a small store this is usually just you, wearing another hat — but it’s worth knowing the role exists and that registration is expected.

A practical compliance checklist

Why it’s worth getting right

Beyond avoiding penalties, POPIA compliance is simply good business. It builds customer trust at exactly the moment trust matters — when someone’s deciding whether to hand over their details and card. A store that visibly respects privacy converts better with cautious SA shoppers. And the habits POPIA encourages (collect less, secure it, get real consent) make you a leaner, more trusted operation. It’s one of those rare obligations that, done properly, helps your business rather than just protecting it.

Frequently asked questions

The bottom line

POPIA isn’t something only big companies worry about — it applies to every SA online store that handles customer data, which is all of them. The practical requirements are manageable: a clear privacy policy, genuine marketing consent, sensible data security, respecting customer rights over their data, and good retention habits, with the owner usually acting as Information Officer. Done properly it’s not just legal protection — it builds the customer trust that helps you sell. Treat it as part of running a legitimate, trusted store rather than a box to tick.

This is general information, not legal advice — for your specific obligations, speak to a professional. If you’d like help making sure your store is set up correctly — privacy policy in place, consent handled properly, data collected securely — that’s part of building a store the right way, which is what we do. See how to start an online store in SA for the wider setup.