POPIA for small businesses: where to start
A small business can make a practical start by mapping one customer workflow, checking who can access the information and assigning each gap to a person. Business size alone does not determine POPIA's application or provide a general exemption.
By POPIA Check · Editorial update · General information, not legal advice
Follow one enquiry from start to finish
Consider a small professional services business receiving a website enquiry. The form reaches a shared inbox, a staff member copies it to a CRM, a cloud provider stores it and an adviser sends a quote. Each step raises questions about purpose, lawful processing, transparency, access and retention.
| Step | Question to ask | Evidence |
|---|---|---|
| Website enquiry | Which fields are necessary, and what is the person told? | Form fields and collection notice |
| Shared inbox | Who has access and when is it removed? | Access list and leaver process |
| CRM and cloud | Which suppliers handle the information, and on what terms? | Supplier register and contracts |
| Follow-up marketing | What separate rules and permissions apply? | Marketing process and opt-out records |
| Closure | How long is the record kept and why? | Retention schedule and disposal records |
Make the work manageable
- Create a short processing register using the systems you already run.
- Confirm Information Officer responsibilities and the relevant registration evidence.
- Give notices and rights requests a clear owner.
- Review supplier access, passwords, backups and the process for suspected compromise.
- Keep an action list with the gap, owner, evidence needed and review date.
Avoid the template trap
Buying a privacy template does not show that your staff, suppliers and systems follow it. Use documents that describe your actual operations, then test the process. For example, confirm that an access request reaches an owner and that a departing staff member's access is removed.
When to involve a legal partner
Ask for a targeted review when the lawful ground is uncertain, the business handles special personal information or children's information, information crosses borders, marketing practices are unclear or a suspected compromise has occurred. The general assessment cannot settle these questions. An active incident should not wait for a routine questionnaire or ordinary referral response.
Prepare for a focused discussion
A POPIA Check report gives your team and chosen adviser a shared starting point. Gather your notices, register, supplier terms, retention rules and unanswered questions alongside the report. A referral starts a conversation; the partner agrees any professional scope and fees with you.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Know what to work on next.
Get a free PDF gap report, then decide whether to discuss it with Lawbella.
Start free assessmentView a sample report