POPIA and collecting leads: what South African small businesses need to know

This is general information to help you ask the right questions, not legal advice. For advice on your own business, speak to a lawyer or see the Information Regulator's guidance.

If you run a small business in South Africa, you almost certainly collect personal information: the name and number of someone who enquired on your website, the email of a client who booked, the details on a business card someone handed you at an expo. The Protection of Personal Information Act, POPIA, applies to all of it, whether you are a large company or a one-person business.

The good news is that POPIA is mostly common sense written down. Here is what it means for the everyday business of collecting leads.

What counts as personal information

Under POPIA, personal information is anything that identifies a living person, and in South Africa also an existing company or other juristic person. For lead capture, that means names, phone numbers, email addresses, what someone asked you about, and notes you make about them.

The principles, in plain language

POPIA sets out conditions for processing personal information lawfully. For a small business collecting leads, they come down to a handful of habits.

Collect only what you need, for a reason

Ask for what you need to answer the enquiry, and no more. An enquiry form needs a name, a way to reply and a message. It probably does not need a date of birth or an ID number.

Tell people what you are doing with it

When you collect someone's details, they should know who you are, why you want their details, and what you will do with them. On a form, a short line near the button does this: "We'll use your details to reply to your enquiry." Link to a privacy notice if you have one.

Use it for what you said

If someone gave you their number to get a quote, use it to send the quote and follow up on it. Using it for something unrelated, such as adding them to a promotional list, is a different purpose, and the rules for direct marketing below apply.

Keep it safe

Store leads somewhere protected by a password, not on an open spreadsheet or a shared phone. Limit who can see them. If personal information is lost or accessed by someone who should not have it, POPIA requires you to notify the Information Regulator and the people affected.

Do not keep it forever

Keep leads for as long as you need them, then delete them. An enquiry from three years ago that went nowhere is a risk, not an asset.

Let people see, correct and delete it

People have the right to ask what information you hold about them, and to ask you to correct or delete it. Know where your leads are stored so you can answer.

The rule most small businesses get wrong: direct marketing

POPIA has a specific rule for marketing sent by email, SMS or WhatsApp (electronic communication). In broad terms, you may only send it if:

• the person has consented, or
• they are your existing customer, you got their details in the context of a sale, you are marketing your own similar products or services, and you gave them a chance to opt out when you collected their details and in every message.

You may ask someone for consent once, if they have not already refused. And every marketing message must say who it is from and give an easy way to opt out.

In practice:

• Someone who enquired can be sent a reply to their enquiry, and reasonable follow-up about it. Adding them to your newsletter needs their consent.
• Someone who handed you a business card at an event gave you their details to stay in touch about that conversation. A personal follow-up is normal. Putting them on a mailing list without asking is not.
• A tick box for marketing should be unticked by default. A box that is already ticked is not consent.

Two admin tasks

• Register your Information Officer. By default this is the head of the business, often the owner. Registration is done with the Information Regulator online.
• Write a short privacy notice. A page that says what you collect, why, how long you keep it, who you share it with, and how people can contact you about it.

Where your tools store data matters

If you use software to collect leads, find out where it stores them, whether you can export them, and whether you can delete them. POPIA also has rules on sending personal information outside South Africa: broadly, the other country or the provider must protect it to a standard similar to POPIA.

Where Newbi fits

Every Newbi card's enquiry form tells visitors who their details go to and links to a privacy notice. It also has an optional "send me news and offers" box, which starts unticked. When someone ticks it, the date is recorded, and your leads inbox, your spreadsheet export and any CRM connection all show who agreed to marketing and who did not. If someone asks you to delete their details, you can delete their lead permanently from your dashboard.

Leads are stored in a European Union data centre, in Frankfurt, under EU data protection law, and you can export them to a spreadsheet at any time.

The rules above are yours to follow, whichever tool you use: tell people why you are collecting their details, and only send marketing to people who have agreed to it.

Quick answers

Does POPIA apply to small businesses and sole traders? Yes. POPIA applies to anyone who processes personal information for business purposes, whatever their size.

Can I WhatsApp a lead who filled in my form? You can reply to their enquiry. Sending them marketing messages afterwards needs their consent, unless they have become a customer and the existing-customer rules above apply.

What are the penalties for breaking POPIA? The most serious offences can lead to fines of up to R10 million or imprisonment, and the Information Regulator can issue enforcement notices. For most small businesses, the bigger risk is losing the trust of customers.