POPIA website requirements: a practical review checklist
A useful website review joins what visitors can see with what your business actually does. Start with the forms, services and tracking tools on your site, then compare the notices and choices with their real behaviour. Installing a privacy page or banner alone cannot demonstrate compliance.
By POPIA Check · Editorial update · General information, not legal advice
Review the journey, not just the footer
| Area | Practical check | Evidence to keep |
|---|---|---|
| Privacy information | Can a visitor understand who collects information, why and how to exercise relevant rights? | Current notice and collection-point screenshots. |
| Forms | Are requested fields needed, and is the collection explanation available at the right point? | Field inventory, destinations and access roles. |
| Tracking and choices | Which services load before a choice, after refusal and after withdrawal? | Manual network test and tool inventory. |
| Marketing | Do campaign eligibility, sender identity and opt-out handling match the reviewed rules? | Permission records and a suppression test. |
| PAIA information | Review applicable manual requirements and whether the published link opens. | Current manual, contact details and link test. |
| Security and suppliers | How are submissions stored, accessed, exported and deleted? | Supplier terms, access review and retention decision. |
Give your legal and web teams different evidence
The legal reviewer needs the purposes, responsibilities and applicable processing grounds. The web team needs the affected page, expected behaviour and a repeatable test. For example, a visitor choosing Essential only should see the behaviour your reviewed notice promises. Keep screenshots and test notes free of real customer data.
What the public website check can show
The free check collects visible privacy, cookie and PAIA information and selected technical signals from public pages. Its report includes evidence and limits. It does not submit forms, complete checkout, audit internal handling or verify every tracking interaction. A signal found in a page is a prompt for review, not legal approval.
A short verification plan
- Use a test visitor and fictional form details on an authorised test environment.
- Open policy links on a phone and desktop. Confirm their identity, dates and contact routes.
- Ask the web team to demonstrate tracking choices and withdrawal, then compare them with the notice.
- Review what happens to a submission in inboxes, CRM tools and backups.
- Give each unresolved finding an owner, due date and evidence of completion.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Gather the evidence. Assign the actions.
Download seven editable registers with examples and step-by-step instructions.
Get the free starter toolkitKnow what to work on next.
Check your public website and keep a free evidence report. No email or account needed.
Check my websiteView a sample report