Every Shopify store collects personal information: names, addresses, emails and phone numbers. In South Africa, the Protection of Personal Information Act (POPIA) sets rules for how you collect, use and protect that information.
This is a practical overview, not legal advice. If your business handles sensitive data or you're unsure, speak to a legal professional.
Why POPIA matters for online stores
Your store processes personal information every time someone places an order, joins your mailing list or contacts you. POPIA requires you to handle that information responsibly, collect only what you need, and be open about how you use it.
Your POPIA checklist
1. Publish a clear privacy policy
Explain what information you collect, why, how it's stored, who it's shared with (for example couriers and payment providers) and how customers can contact you about their data. Shopify offers a policy template as a starting point. Edit it to reflect your actual business.
2. Only collect what you need
If you don't need a customer's date of birth or ID number, don't ask for it.
3. Get consent for marketing
Don't add customers to your marketing emails automatically. Use an unticked checkbox at checkout and sign-up forms that clearly say what people are signing up for.
4. Make it easy to unsubscribe
Every marketing email must include a simple way to opt out, and opt-outs must be respected.
5. Handle cookies transparently
If you use analytics or advertising pixels, let visitors know and, where appropriate, give them a choice. Shopify includes customer privacy settings you can configure.
6. Know who you share data with
Couriers, payment gateways, email tools and apps may all receive customer data. Check what each app accesses before installing, and remove apps you no longer use.
7. Keep access secure
Use strong passwords and two-step verification on your Shopify account. Give staff accounts only the permissions they need.
8. Respond to customer requests
Customers can ask what information you hold about them, or ask you to correct or delete it. Have a simple process to handle these requests.
9. Know your Information Officer
Under POPIA, every business has an Information Officer, by default the head of the business. Make sure that person knows their responsibilities.
The bottom line
POPIA compliance for a typical online store comes down to transparency, consent and care: a clear privacy policy, opt-in marketing, sensible data collection and secure access.
Questions about setting this up on Shopify? Ask us for free advice.