POPIA basics for WhatsApp leads and website forms

POPIA is built around conditions for lawful processing, including accountability, processing limitation, purpose, openness, information quality, and security safeguards. For a small business, the simple version is this: collect the information you actually need, explain why you need it, and avoid keeping it longer than necessary.

If a customer is asking for a quote, you may need their name, contact number, location, and details about the job. You probably do not need extra personal information that has no purpose. The less unnecessary data you hold, the less risk you carry.

The Information Regulator has guidance on direct marketing under POPIA. Owners should be especially careful with SMS, email, push notifications, automated calls, and WhatsApp-style marketing messages. A customer enquiry is not an open-ended invitation to send promotions forever.

Build consent into your process. If you want to send specials, reminders, or newsletters, make the permission clear and keep a record. Also make it easy for people to opt out.

Customer information should not live forever in screenshots, staff phones, personal notebooks, and unprotected spreadsheets. Decide where lead details are stored, who can access them, how passwords are handled, and what happens when a staff member leaves.

The Information Regulator's security compromise guidance is a reminder that businesses must respond when personal information is lost, accessed without permission, or shared incorrectly. A small business may not have a large IT department, but it can still use basic safeguards: strong passwords, limited access, backups, locked devices, and clear staff rules.