POPIA Basics for South African Retailers & Service Businesses: WhatsApp Marketing, CCTV & Data Retention
A plain-language Protection of Personal Information Act (POPIA) checklist for South African shops, salons, clinics, and online stores—without expensive legal jargon.
South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) does not apply only to giant banks and telecoms operators. Every boutique, dental practice, estate agency, e-commerce store, or restaurant that collects customer cellphone numbers, delivery addresses, CVs, CCTV footage, or loyalty sign-ups acts as a 'Responsible Party' overseen by the Information Regulator of South Africa.
Fortunately, practical POPIA compliance for an honest small business is mostly disciplined common sense: collect only what you genuinely need, lock it down properly, never buy shady lead lists, and make opting out effortless.
1. Section 69 Rules for SMS, Email, and WhatsApp Direct Marketing
| Scenario | POPIA Section 69 Rule | Compliant SME Practice |
|---|---|---|
| Cold / Purchased Contact Lists | Strictly opt-IN required before sending unsolicited electronic marketing | Never buy '100,000 SA cellphone numbers' spreadsheets; you may approach a non-customer only ONCE to request consent |
| Existing Paying Customers | Permitted ONLY if contact details were collected during a sale AND marketing relates to your own similar products | Include a clear 'Reply STOP to opt out' or 1-click unsubscribe on every single message, including the very first |
| Transactional Receipts / Delivery Updates | Allowed under contract performance (not marketing) | Do not sneak promotional flyers into strictly transactional digital POS receipt SMSes without consent |
2. Five High-Impact POPIA Steps Every SME Can Complete This Week
Register your Information Officer on the Regulator's eServices portal: By default under POPIA, the CEO, Managing Director, or sole proprietor is the Information Officer and should be formally registered on the Information Regulator's online portal.
Put up clear signage if you run in-store CCTV or visitor logbooks: Display a visible notice at your entrance stating that CCTV operates for safety and security. Replace open paper visitor books (where every courier can photograph the previous 30 names and ID/phone numbers!) with individual tear-off slips or a digital tablet.
Sign simple Operator Agreements with IT, payroll & marketing vendors: Ensure your bookkeeper, web host, and CRM provider commit contractually to keeping your customer/staff records confidential and reporting any breach immediately.
Enforce MFA and staff offboarding hygiene: Never share one generic shop password across five staff cellphones; revoke cloud POS and WhatsApp Business Web sessions the same hour an employee leaves.
Publish a concise Privacy Notice & PAIA Manual access route: Tell customers in plain language what data you collect, why, and which email address handles deletion or correction requests.
Want to grow customer foot traffic without risky cold SMS blasts? Use inbound search instead via our Google Business Profile local SEO guide for South African stores.
Practical Retail Scenario: Fixing Loyalty Sign-Ups & WhatsApp Broadcasts
A boutique fitness studio and beauty bar in Cape Town collected 2,400 client names, ID numbers, medical skin-allergy notes, and cellphone numbers on paper clipboard forms stored in an unlocked reception drawer—and added every single walk-in client into a public WhatsApp Group where all 250 members could see each other's phone numbers and profile photos!
Putting 250 strangers into an open WhatsApp Group (instead of an opt-in BCC/Broadcast or CRM channel) exposes every client's cellphone number to every other member without consent, while collecting full SA ID numbers and health notes ('special personal information' under Section 26 of POPIA) without locked encryption creates major liability. Switching to a password-protected tablet booking form that collects ONLY essential contact + allergy consent, locking legacy paper forms away, and sending promotions strictly to opted-in clients with a 'Reply STOP' footer fixed all three risks in one afternoon.
Key Action Takeaways
Never use open WhatsApp Groups for customer announcements: Use WhatsApp Channels, individual opted-in Broadcast lists, or compliant email/SMS tools where recipients never see other customers' phone numbers.
Shred outdated CVs and FICA copies securely: Do not toss unshredded job-applicant CVs or customer ID copies into municipal recycling bins behind your shop.
Frequently Asked Questions (South African Consumer Reference)
Is there a registration fee to register our Information Officer with the Information Regulator?
No! Registering your organisation's Information Officer (and any Deputy Information Officers) on the official Information Regulator of South Africa eServices portal is completely free. Beware consultants charging thousands of rands claiming to pay a 'government POPIA licence fee'.
Can a residential estate, office park, or store take a photo of a visitor's driver's licence and ID?
Under POPIA's 'minimality' principle (Section 10), you may only collect personal information that is adequate, relevant, and not excessive for the specific purpose—and you must secure it against unauthorised access and delete it once no longer needed rather than keeping unencrypted photos on a guard's personal phone.
What must we do if a laptop containing unencrypted customer or payroll spreadsheets is stolen?
First, enable BitLocker (Windows) or FileVault (Mac) full-disk encryption today so a stolen laptop does NOT expose readable data! Where unauthorised parties may reasonably have accessed personal information, Section 22 of POPIA requires notifying both the Information Regulator and affected data subjects as soon as reasonably possible.