Your Website Is a Legal Document — Whether You Treat It That Way or Not
Every time a visitor lands on your website, a legal relationship begins.
They may share their name and email to download a resource. They may purchase a product. They may submit a query through your contact form. They may simply browse — and your cookies may track them.
In each of these moments, data is being collected, obligations are being created, and South African law applies.
The question is not whether your website has legal obligations. It does. The question is whether you have documented them — with compliant Website Terms and Conditions and a POPIA-aligned Privacy Policy.
Most South African small business websites have not. And that is an exposure that is entirely fixable.
Why Website T&Cs and a Privacy Policy Are Not Optional
Website Terms and Conditions (“Website T&Cs”) protect your business from disputes about content, liability, intellectual property, and how your website is used. Without them, a visitor who misinterprets something on your site, or misuses your content, faces no documented consequences — and you have no documented protection.
A Privacy Policy is not optional if your website collects personal data. Under the Protection of Personal Information Act (POPIA) — South Africa’s primary data protection legislation, fully operational since 2021 — any business that processes personal data about South African residents must comply.
Processing personal data includes:
- Collecting names, email addresses, or phone numbers through a contact or enquiry form
- Running an e-commerce store that captures payment and delivery information
- Installing cookies or analytics tools that track user behaviour
- Sending marketing or newsletter emails
- Operating a chatbot that gathers visitor information
If your website does any of these — and virtually every business website does at least one — POPIA applies, and a compliant Privacy Policy is a legal requirement.
Penalties under POPIA for non-compliance can reach R10 million. Criminal liability can follow for intentional violations. More practically, a privacy complaint to the Information Regulator — and it is actively receiving complaints — creates reputational and legal headaches that cost far more to resolve than prevention would have.
What Must Website Terms and Conditions Include?
Website T&Cs are your legal agreement with everyone who visits and uses your website. They should cover:
1. Acceptance of Terms
An explanation of how visitors accept the terms — typically by using the website — and confirmation that continued use constitutes acceptance. For e-commerce and professional service websites, an explicit acceptance mechanism (a checkbox at checkout or registration) is stronger.
2. Intellectual Property
Who owns the content on your website — articles, images, branding, product descriptions, tools? Your Website T&Cs should assert that copyright and other intellectual property rights are owned by your business, and set out what visitors may and may not do with that content.
3. Acceptable Use
What are visitors permitted and not permitted to do on your website? This includes prohibitions on scraping content, uploading harmful material, attempting to gain unauthorised access, and using the site for illegal purposes.
4. Disclaimers and Limitation of Liability
Websites that provide information — particularly in legal, medical, financial, or technical fields — need a disclaimer making clear that the information is general in nature and does not constitute professional advice. Your T&Cs should also limit your liability for website downtime, errors, or third-party links.
5. E-Commerce Terms (for online stores)
If you sell products or services online, your Website T&Cs must address pricing, order confirmation, delivery timelines, returns and refunds, and dispute resolution. South Africa’s Consumer Protection Act 68 of 2008 (CPA) gives consumers the right to return goods within a specified period and provides protection against unfair terms. Your e-commerce terms must comply with the CPA. The Electronic Communications and Transactions Act 25 of 2002 (ECTA) also applies: section 43 requires specific information to be displayed on the website, and section 44 gives the consumer a seven-day cooling-off period to cancel an electronic transaction — a right that is separate from, and broader than, the CPA’s direct-marketing cooling-off period.
6. Third-Party Links and External Content
If your website links to external sites, a clause confirming that you take no responsibility for the content of those sites protects you from liability for what they contain.
7. Changes to the Terms
A reservation of the right to update your Website T&Cs from time to time, and confirmation that continued use after changes constitutes acceptance of the new terms.
8. Governing Law and Jurisdiction
Your Website T&Cs should specify that they are governed by South African law and that disputes will be resolved in South African courts.
What Must a Privacy Policy Include Under POPIA?
POPIA requires that any business processing personal data makes specific information available to data subjects. Your Privacy Policy is where that information lives. A compliant POPIA privacy policy must address:
1. Who Is Collecting the Data
The full name and contact details of the responsible party — the business that is collecting and processing the personal data. If you have a designated Information Officer (required under POPIA for most businesses), their contact details should be included. Separately, under the Promotion of Access to Information Act 2 of 2000 (PAIA), private bodies must prepare and make available a PAIA manual, which is commonly published alongside the privacy policy.
2. What Data Is Being Collected
A clear description of the categories of personal data collected — names, email addresses, phone numbers, payment information, location data, browsing behaviour, device identifiers, and any special personal information (health data, ID numbers).
3. Why It Is Being Collected
The specific, lawful purpose for which each category of data is collected. POPIA requires that data is collected for a defined purpose and not processed for any other purpose without consent.
4. How Long It Is Retained
Data must not be kept for longer than is necessary for the purpose for which it was collected. Your privacy policy should specify retention periods, or at minimum explain the criteria used to determine them.
5. Who It Is Shared With
If personal data is shared with third parties — payment processors, email marketing platforms, analytics providers, cloud storage services, or any other operators — this must be disclosed. Each third party should have appropriate data processing agreements in place.
6. User Rights Under POPIA
Data subjects have the right to:
- Know whether you hold information about them
- Request access to their personal data
- Request correction of inaccurate data
- Object to the processing of their data
- Request deletion of their data in certain circumstances
- Complain to the Information Regulator
Your privacy policy must explain these rights and provide a clear process for exercising them.
7. Cookies and Tracking Technologies
If your website uses cookies — and most do, including Google Analytics — your privacy policy must explain what cookies are used, what they collect, and how visitors can manage or opt out of them. A separate cookie notice or banner is recommended for sites with significant tracking.
8. Security Measures
A description of the technical and organisational measures in place to protect personal data from unauthorised access, loss, or destruction. This does not require disclosing your security architecture — but it does require demonstrating that you take data security seriously.
9. Data Breach Notification
Under POPIA, if a data breach is reasonably likely to harm the data subject, you must notify both the Information Regulator and the affected individuals. Your privacy policy should confirm your commitment to doing this.
10. Consent Mechanism
How and when do visitors consent to their data being collected? This includes any marketing opt-in processes, newsletter subscriptions, and the basis on which you process data from contact form submissions.
POPIA, GDPR, and International Visitors
If your website is accessible to visitors outside South Africa — and most websites are — you may also need to consider the EU’s General Data Protection Regulation (GDPR) if you actively serve EU residents.
GDPR and POPIA are broadly aligned in their principles, but GDPR imposes stricter requirements in some areas — particularly around consent, the right to erasure, and data portability. A privacy policy that fully complies with POPIA will cover the core GDPR principles, but if you actively market to or serve EU customers, a GDPR review is advisable.
The Consumer Protection Act and Your E-Commerce Website
If your website sells goods or services to consumers — individuals buying in a personal, non-business capacity — the Consumer Protection Act applies, and it has specific requirements:
- Direct-marketing cooling-off: For goods or services obtained through direct marketing , consumers may cancel the agreement and return the goods within five business days, without penalty
- Returns and refunds: Consumers have the right to return defective goods for repair, replacement, or refund within six months of purchase
- Fair contract terms: Certain terms that are unfair or that restrict consumer rights in an oppressive way are unenforceable under the CPA
Your Website T&Cs and returns policy must be drafted with the CPA in mind. A clause that purports to exclude your CPA obligations is not enforceable.
Beyond the CPA, the Electronic Communications and Transactions Act 25 of 2002 (ECTA) imposes its own obligations on e-commerce websites.
Get Professionally Drafted Website T&Cs and Privacy Policy Today
Our Website Terms and Conditions and Privacy Policy template is drafted by SchoemanLaw Inc. — a South African commercial law firm with more than 20 years’ experience in commercial, digital, and data protection law. It:
- Complies with POPIA, the Consumer Protection Act, and current South African law
- Covers cookies, data subject rights, and third-party sharing
- Is written in plain, accessible language — not impenetrable legal text
- Is updated in real time as legislation and best practice evolve
- Takes minutes to download, personalise, and publish on your site
Download your Website T&Cs and Privacy Policy →
Not sure whether your current website documents are compliant? Take our free business risk assessment for personalised guidance or schedule a 30-minute free consultation with our law firm partner SchoemanLaw Inc.
Frequently Asked Questions
Does every South African website need a Privacy Policy? Yes, if the website collects any personal data — including email addresses through a contact form, or website analytics data. POPIA applies to any business that processes personal data about South African residents, regardless of the size of the business or the volume of data collected.
What is the difference between Website Terms and Conditions and a Privacy Policy? Website Terms and Conditions govern the relationship between your website and its visitors — covering intellectual property, acceptable use, liability, and (for e-commerce sites) purchase terms. A Privacy Policy explains what personal data you collect, why, how you protect it, and what rights visitors have over their data. Both are legally important, but for different reasons.
Can I use a free Privacy Policy generator? You can, but the risk is significant. Generic generators do not account for South African-specific requirements under POPIA — particularly the Information Officer requirement, the specific POPIA data subject rights, and the South African Information Regulator’s enforcement approach. A template drafted by SA attorneys provides far stronger protection.
What happens if I don’t have a Privacy Policy on my South African website? You are in breach of POPIA. Data subjects can complain to the Information Regulator, who can investigate and issue enforcement notices. Penalties can reach R10 million, and criminal liability applies in cases of intentional non-compliance. More practically, operating without a privacy policy undermines trust with customers who are increasingly aware of their data rights.
Does the Consumer Protection Act affect my website’s terms? Yes, if you sell goods or services to consumers online. The CPA creates mandatory rights that cannot be contracted out of — including rights to return goods, cooling-off periods, and protection against unfair contract terms. Your Website T&Cs must comply with the CPA.
How often should I update my Website T&Cs and Privacy Policy? At minimum, whenever South African data protection law changes, whenever you introduce new data collection practices (a new analytics tool, a new contact form, a new payment processor), or whenever the Information Regulator issues new guidance. All Contracts4Biz templates are updated in real time as legislation changes.
