South Africa, POPIA and local trade

The Protection of Personal Information Act is shorter and more readable than most people expect. It is also frequently over-complicated by consultants and under-implemented by businesses who assume it is somebody else's problem.

For an online retailer the personal information in scope is usually narrower than expected: customer names, contact details and delivery addresses, staff records, anything identifying a contact person at a business customer, and behavioural data that can be linked to an identifiable person. Your product data is not personal information — descriptions, specifications, part numbers and datasheets fall entirely outside POPIA. That matters, because it means the largest data set in a distribution business is not the compliance problem.

Four steps have the highest ratio of risk reduced to effort spent: appoint and register your information officer, write a privacy notice somebody can actually read, list your sub-processors, and decide in advance who fields a data subject request — which starts a thirty-day clock.

Section 72 restricts transferring personal information outside South Africa, and in practice almost every SaaS product does this. The question is not whether you transfer but whether you have a lawful basis. The practical step is to ask each vendor where they process and get the answer in writing. A vendor who cannot answer that quickly is telling you something useful.