Almost every business collects personal information, from customer names and contact details to employee records, payment information, website analytics, and marketing preferences. A privacy policy, often called a privacy notice, explains how the business handles that information.
In South Africa, it is not merely a website formality. It is a practical transparency mechanism and an important part of compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).
Privacy Policies at a Glance
| Question | Short answer |
| What is a privacy policy? | A public-facing statement of how an organisation collects, uses, stores, shares, protects and disposes of personal information |
| Is it the same as consent? | No. A policy does not, by itself, make unlawful processing lawful |
| Which section of POPIA is relevant? | Section 18, which requires a responsible party to take reasonably practicable steps to make the data subject aware of specified information |
| Can I copy another company’s policy? | No. It must reflect what your business actually does |
| Who should it name? | The company and its Information Officer contact details |
| When should it be reviewed? | Whenever systems, suppliers, marketing, products or cross-border arrangements change |
What Is a Privacy Policy?
A privacy policy is a public-facing statement that describes how an organisation collects, uses, stores, shares, protects, and disposes of personal information. It should identify:
- The organisation responsible for deciding why and how information is processed.
- The categories of information concerned.
- The purposes for which it is used.
- The rights available to the people to whom the information relates.
A Privacy Policy Is Not the Same as Consent
The policy is not the same as consent and, by itself, does not make unlawful processing lawful. A company must still have an appropriate legal basis for each processing activity and comply with POPIA’s eight conditions for lawful processing:
- Accountability
- Processing limitation
- Purpose specification
- Further processing limitation
- Information quality
- Openness
- Security safeguards
- Data subject participation
The policy’s function is to communicate those practices clearly and honestly. It must therefore reflect what the business actually does, rather than rely on generic wording copied from another organisation.
What Should a Privacy Policy Contain Under POPIA?
Section 18 of POPIA requires a responsible party, when collecting personal information, to take reasonably practicable steps to ensure that the data subject is aware of specified information. A useful privacy policy should accordingly address:
- The company’s identity and contact details, including how to contact its Information Officer.
- What personal information is collected, and whether it is obtained directly, automatically, or from third parties.
- The specific purposes for collection and use, together with the applicable legal basis.
- Whether supplying the information is mandatory or voluntary, and the consequences of not providing it.
- The recipients or categories of recipients, including operators and service providers.
- Any transfer of information outside South Africa and the safeguards applied.
- The period for which information is retained, or the criteria used to determine that period.
- The security measures used to protect information and the company’s approach to security incidents.
- The rights to access, correct or delete information, object to processing, withdraw consent where applicable, and lodge a complaint with the Information Regulator.
- The use of cookies, direct marketing, automated decision-making or profiling, where relevant.
Why Does a Company Need a Privacy Policy?
Legal Compliance and Accountability
POPIA applies to public and private bodies that process personal information in the circumstances contemplated by the Act. Its accountability condition requires the responsible party to ensure compliance with the lawful-processing conditions. A well-drafted policy helps the company meet its transparency duties and show that privacy is part of governance, not an afterthought.
Trust and Informed Choice
Customers, employees, and suppliers are more likely to provide information when they understand why it is required and how it will be protected. Clear explanations reduce uncertainty, help individuals exercise their rights, and support fair, transparent processing.
Risk Management
Preparing the policy forces a business to map its data flows: what it collects, where it is stored, who receives it, and when it is deleted. This exercise can expose:
- Unnecessary collection.
- Excessive retention.
- Weak contracts.
- Uncontrolled access.
Correcting those issues reduces the likelihood and impact of complaints, security compromises, regulatory action, and reputational damage.
Commercial Expectations
Clients, funders, and service providers increasingly request evidence of privacy compliance during procurement and due diligence. A policy cannot replace appropriate security, operator agreements, staff training, or internal procedures, but it gives counterparties a concise view of the company’s privacy posture.
A Privacy Policy Must Be Accurate and Accessible
A privacy policy should be written in plain language, displayed where people are likely to see it, and provided at or before collection where reasonably practicable.
Where Should a Privacy Policy Appear?
- For online businesses, this usually means a prominent website link and appropriately timed notices on forms, portals, or applications.
- Employees and job applicants may require separate notices because the information collected and the purposes differ from those relating to customers.
Keep the Policy Current and Honest
The policy should be reviewed whenever the company changes it.
Material changes should be communicated appropriately. Publishing assurances that are broader than the company’s actual practices may create legal and reputational risk; implementation must match the policy.
A Practical Privacy Policy Checklist for South African Companies
Use this as a starting point when reviewing your own policy:
- Does it name the company and the Information Officer’s contact details?
- Does it describe the information you actually collect, and from where?
- Does it state each purpose and the legal basis for it?
- Does it say whether providing the information is mandatory or voluntary?
- Does it list recipients, including operators and service providers?
- Does it disclose any transfer of information outside South Africa and the safeguards used?
- Does it state how long information is kept, or how that period is decided?
- Does it describe security measures and how incidents are handled?
- Does it explain data-subject rights and the right to complain to the Information Regulator?
- Does it cover cookies, direct marketing, automated decision-making or profiling, where relevant?
- Is it in plain language and easy to find?
- Do separate notices exist for employees and job applicants?
- Has it been reviewed since your last change of systems, suppliers or marketing practices?
- Does what you actually do match what the policy says?
Conclusion: A Privacy Policy Is a Legal Communication and a Governance Tool
A privacy policy is both a legal communication and a practical governance tool. Companies need one to explain their processing activities, support POPIA compliance, build confidence, and identify privacy risks.
The most effective policy is tailored to the business, supported by internal controls, and updated as operations evolve.
For further assistance with your privacy policy and POPIA compliance, contact an expert at SchoemanLaw Inc in Cape Town or Paarl.
