This is an operational guide, not legal advice. It describes what small businesses normally have to do day to day. It is not a substitute for an attorney, and it should not be used to settle a specific dispute. If anything is contested, if a complaint has been made, or if you are unsure whether a particular process requires something specific, get an attorney involved before you act.
For a small business, POPIA comes down to four everyday duties: be honest about what you collect and why, collect only what you need, keep it safe, and let any person see what you hold about them and correct it. There is a fifth habit underneath those four, which is keeping information only as long as you need it. Nothing else in the law asks a small business to do anything a competent owner cannot handle in an afternoon of setup.
What actually counts as personal information?
Personal information is any record about an identifiable person. Almost everything a service business holds qualifies, including the things that feel harmless because they are only used to get the job done.
| You hold this | Why it is personal information | Where it usually lives |
|---|---|---|
| Full name, first name, nickname | Identifies a person | Job card, invoice, WhatsApp thread |
| Cell number and email address | Identifies a person | Contact list, account on your system |
| ID number or passport number | Identifies a person, and is sensitive | On-site paperwork, credit application, copied "just in case" |
| Physical and work address, including site address | Identifies a person or their premises | Delivery note, invoice |
| Vehicle registration details, licence or route number | Links to a person | Job sheet, fuel record |
| Photographs of a person, their property, their vehicle or their ID | Identifies a person, and cannot be un-said | Staff phone, WhatsApp, site photos |
| WhatsApp messages, voice notes and call logs | The content is about an identifiable person | Personal phone, shared phone, cloud backup |
| Bank details, and account holder names | Identifies a person | Payment records |
| Complaints, disputes and anything a customer told you in confidence | Identifies a person and is often sensitive | Notebook, WhatsApp, email |
| Staff records: address, bank details, ID number, health or disciplinary notes | Identifies a person | Files, WhatsApp, spreadsheets |
Two things surprise people most often. A photo of a customer's house number and a vehicle is personal information even without a name next to it, and a WhatsApp message is a record, not a conversation that evaporates.
The most common small-business exposure is not a database leak. It is a phone full of everybody's details, covered in the companion guide on customer data in WhatsApp.
What are the four duties that apply every day?
| The duty | What it means in plain terms | What it looks like on a Tuesday |
|---|---|---|
| Be honest about what you collect and why | Tell a person, before or at the point you collect it, what you are collecting and what you will use it for | A line on your quote or booking form, and a notice on your website |
| Collect only what you need | Every field you ask for must have a purpose you could explain | Not asking for an ID number "in case" |
| Keep it safe | Restrict who can see it, keep it in one place, and lock it | Staff do not share one login; the office door is locked |
| Let people see and correct what you hold | A person can ask what you hold about them, get it corrected, and ask you to delete it where you can | A named person handles the request and answers in writing |
Those four, done consistently, are what an inspector or a complainant is actually looking for. Not a policy document — the behaviour.
Do you need a written privacy notice?
You need to be able to tell people what you hold and why. The quickest honest version is a one-page notice, in plain language, on your website and printed at reception or in the office, plus a short version on any form that collects details.
A notice does not need to be long. It needs four things and nothing else:
- Who you are, with a physical address and a way to reach a person.
- What you collect, in ordinary words, not categories of data.
- Why you collect it and who you share it with, including any supplier who handles it for you.
- How a person can see it, correct it or ask you to delete it, with a name and number to call.
The templates file has a skeleton you can fill in an afternoon. The single most common mistake is writing it in legal language, so nobody can understand it, which defeats the point of having one.
How long should you keep information?
Retention is where small businesses accumulate the most risk for no benefit. Nothing in law requires you to keep a customer's details because you might need them one day. Keeping data you have no purpose for is the part of compliance that most often goes wrong, and it is entirely avoidable.
Write down a period for each type of record, then delete or anonymise when the period ends. A reasonable starting shape:
| Record | Why you hold it | When to delete it |
|---|---|---|
| Quotation, once declined | Nothing — the job will not happen | After a short period set by you, if the person is not a customer |
| Job card and delivery note, completed job | Disputes, warranty, tax record | After the dispute and warranty window has closed |
| Invoice and payment record | Tax and accounting obligations | On the schedule your accountant confirms — do not guess it |
| Customer contact details for an active customer | Serving them, reminders | When they stop being a customer and no period requires otherwise |
| Quotes on a van, or a spreadsheet of leads that never converted | Nothing | Immediately |
| Site photographs with a visible house number, vehicle or person's face | Nothing once the job is invoiced and settled | Immediately, unless there is a dispute |
| Staff records | Employment, tax | On the schedule your accountant and your contracts require |
| Complaints | Possibly a legal claim | After the period in which a claim could be brought, then decide with an attorney if unclear |
Two rules that make retention work without a lawyer:
- Delete from the backups too, or accept that you have not deleted it. A spreadsheet deleted on the desktop but present in three cloud backups is not deleted.
- When you delete a WhatsApp chat, check that nobody's phone is a second copy.
What do you do when someone asks to see or delete what you hold?
Treat it as a normal request with a deadline, not as an accusation. Most small businesses find that handling one of these properly is uneventful, because the answer is simply yes.
- Log it. Date, who asked, what they asked for, who is handling it, and when you will answer.
- Confirm who they are before you send anything. Ask for the number on the account, or an ID, if you are releasing information.
- Find it everywhere. Quotes, invoices, WhatsApp threads, job cards, staff phones, accounting package, cloud drive, email. Use the data inventory in the templates file as the search list, because you cannot find what you have not listed.
- Answer in writing, with what you hold, where it came from, and what you use it for. A clear, plain answer is the goal.
- Correct anything wrong and say you have done so.
- Delete what you are able to, and be specific about what you are not deleting and why. Records you are required to keep for accounting or tax purposes are the usual example, and saying so plainly is a complete answer.
- Tell them if their information was used to make a decision about them, such as a quote being declined or a staff complaint.
The requests you will actually get are almost always reasonable. The businesses that turn a routine request into a dispute are the ones that had no idea what they were holding.
What does staff actually need to know?
One hour, once, with the owner present. Staff do not need the law. They need to know what not to do on their own phone, because that is where the exposure is.
| Minutes | What to cover |
|---|---|
| 0 to 10 | What personal information is, in ordinary words, and that a customer's details in a WhatsApp chat count |
| 10 to 20 | What we collect and why, shown on your own forms |
| 20 to 30 | The four rules: only collect what the job needs, keep it in the business system, never forward to a personal account, never send a whole thread to a personal number |
| 30 to 45 | The phone rules: work account only, screen locked, no shared logins, nothing left on a shared device |
| 45 to 55 | What to do if a phone is lost, a wrong person is sent a thread, or somebody asks to see our records — who to tell, immediately |
| 55 to 60 | Three questions back to them |
Run the last five minutes as questions rather than a summary. Ask what they would do if a customer's number was phoned by a stranger asking about a job, and what they would do with a photo of a customer's ID that came in on WhatsApp. If nobody can answer, that is the part to cover again.
What actually attracts the attention of the Information Regulator?
The Information Regulator is a real, functioning body. It receives complaints from members of the public, it investigates, and it does issue enforcement notices. It does not only look at large companies, and it does not need a catastrophe to become interested.
What tends to draw it:
- A complaint from an identifiable person. This is by far the most common route, and it is usually one customer who is angry about something else.
- Personal information being lost, or sent to the wrong person, where it can realistically cause harm.
- Information being sold, or passed to another party for a purpose you did not tell the person about.
- Data being kept long after the purpose ended, with no answer when asked about it.
- Not answering a person's request at all.
- A pattern rather than an incident: the same mistake, on purpose or by neglect, continuing after you knew about it.
What tends not to draw it, even though owners often fear these:
- A small mistake you found yourself, told the person affected, and fixed.
- A complaint about price, quality or service that has nothing to do with information.
- A record you hold in a locked cabinet because you have always held it that way.
- No complaint, no harm, and a straightforward answer when someone asks.
What is not worth an owner's anxiety?
A great deal. Most small-business breaches are accidental and fixable, not catastrophic. A lost phone with a customer list on it is serious and fixable. A form that asked for an ID number it did not need is fixable. A thread forwarded to the wrong person, found the same day, is fixable.
What is not fixable afterwards is a pattern: the same thing happened three times, each time was quietly dealt with, and each time it got slightly worse. The measure of risk is not the mistake, it is the response to the mistake.
Spend the time on the four duties and the retention rule. That is where the actual protection is.
What do you do first?
- List every place personal information sits, including every staff phone. The data inventory in the templates file is the starting point.
- Write the one-page notice in plain language and put it where people will see it.
- Write a retention period next to each record type, and delete one category of data you have been keeping "just in case".
- Decide who handles a request from a person, and put that name and number on the notice.
- Run the one-hour session with your staff this month.
The companion checklist turns this into a two-week audit you can run yourself. The templates include a plain-language privacy notice skeleton, a data inventory table you can fill in a morning, a retention schedule, and a request-handling log with a reply you can copy.
Not sure where to start? Book a free 30-minute strategy session and we will name the one gap worth fixing first: https://agentcy.co.za/#book-audit