POPIA has been fully enforceable since July 2021, and most South African business owners know it exists. Far fewer have actually done anything about it — particularly on their website, which is usually the single biggest place a business collects personal information from the public.
That's becoming a materially riskier gap to leave open. In its 2025/26 Annual Performance Plan, presented to Parliament in May 2026, the Information Regulator signalled a more structured and proactive enforcement model — moving away from reactive complaint-handling toward targeted oversight and industry-wide assessments, with a new compliance monitoring programme requiring organisations to actively demonstrate compliance through documentation and internal controls, not just claim it.
The maximum administrative fine under POPIA is R10 million, with criminal liability possible in serious cases. The Regulator has already issued enforcement notices against organisations including a national police service, a government department, a major pharmacy chain, and — notably — WhatsApp, for applying weaker privacy protections to South African users than to users elsewhere.
For a website specifically, the common gaps we see are rarely exotic. They're basic:
- No privacy policy, or one buried three clicks deep instead of linked from the footer of every page
- A privacy policy that no longer matches what the site actually does — because a new contact form, marketing tool, or analytics platform was added after the policy was last reviewed
- Cookie consent that doesn't actually block non-essential tracking until a visitor opts in (POPIA's processing-limitation principle functions as an opt-in requirement in practice, even though it's not a prescriptive cookie-banner law like GDPR)
- No documented process for what happens if a data subject requests correction or deletion of their information
- No appointed, contactable Information Officer
None of these are hard to fix. All of them are the kind of thing that's easy to let slide for years — right up until an audit or a complaint forces the question.
Where WebAcumen fits in
POPIA compliance is one of the free digital assessments we run as part of our Consultation service, alongside security and performance audits. We also built a POPIA Policy Generator specifically because "get a lawyer to draft this" is overkill for most small and mid-size businesses when the real gap is usually structural — footer links, cookie behaviour, form disclosures — not legal drafting.