POPIA website check: what a scan can and cannot tell you
An automated POPIA website check can collect visible evidence, such as HTTPS and links to privacy information. It cannot certify that a website or business complies with POPIA. A trustworthy result separates what was observed from what could not be tested.
By POPIA Check · Editorial update · General information, not legal advice
What POPIA Check inspects
The scanner retrieves a public homepage and up to three linked public pages. It starts with ordinary HTML and can use Firecrawl rendering for an otherwise unreadable or JavaScript-only homepage when configured and within the rendering allowance. It records page URLs, observation time and the collection method.
| Signal | What an observation means | What it does not establish |
|---|---|---|
| HTTPS | The retrieved page used HTTPS. | A complete TLS audit, vulnerability test or secure form destination. |
| Privacy notice | A linked document was found and could be inspected. | That its wording is accurate, complete or legally sufficient. |
| PAIA information | Linked PAIA material was found in the inspected pages. | That the organisation has met its applicable PAIA obligations. |
| Cookie controls | A visible cookie-related signal may need review. | That trackers wait for permission or that withdrawal works. |
| Forms | A visible collection or consent-related signal may need review. | That the lawful ground, notice and actual processing are appropriate. |
| Opt-out | A preference-related signal may be visible. | That an email unsubscribe or marketing objection is actioned correctly. |
What still needs a person
- Inspect network activity before and after cookie choices and test withdrawal where relevant.
- Review the purpose, lawful ground and notice for each collection form.
- Compare the privacy notice with suppliers, systems and actual information flows.
- Test rights requests and applicable marketing preference routes.
- Check access controls, retention, backups and incident response behind the website.
How to read incomplete results
Signal found means an observation was recorded, not a legal approval. Needs review means the evidence requires interpretation or was incomplete. Issue observed describes a specific technical observation. Not tested means the check could not be completed. A blocked, unavailable or unreadable page must not become an automatic pass.
Use the scan as an entry point
Run the website check for visible evidence, then complete the business self-assessment for the processes behind it. Keep the scan evidence and your report for a legal discussion. Do not use a scan result as a compliance badge or certificate.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Know what to work on next.
Get a free PDF gap report, then decide whether to discuss it with Lawbella.
Start free assessmentView a sample report