POPIA-compliant privacy notice for customers, explaining what personal information is collected and why, as required by s.18 of the Protection of Personal Information Act.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY POLICY / PRIVACY NOTICE (Section 18, Protection of Personal Information Act 4 of 2013)
Responsible party (business) name Responsible party address Effective date: Effective date
This notice explains how Responsible party (business) name (the "Responsible Party") collects and processes your personal information, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").
1. INFORMATION OFFICER 1.1. Information Officer: Information Officer, contactable at Information Officer contact.
2. WHAT WE COLLECT 2.1. Categories of data collected
3. WHY WE COLLECT IT 3.1. Purposes of processing
4. LEGAL BASIS FOR PROCESSING 4.1. We rely on the following ground under POPIA for the processing described above: Legal basis for processing. Where we rely on consent, that consent is voluntary, specific, and informed, and may be withdrawn at any time.
5. WHO WE SHARE IT WITH 5.1. Recipients & cross-border transfer
6. HOW LONG WE KEEP IT 6.1. Retention period
7. YOUR RIGHTS 7.1. Data subject rights 7.2. You have the right to access, correct, and request deletion of your personal information, to object to processing, and to lodge a complaint with the Information Regulator (inforegulator.org.za) if you believe your information has been mishandled.
8. COOKIES AND ONLINE TRACKING 8.1. Cookies / website analytics
9. SPECIAL PERSONAL INFORMATION 9.1. Special personal information note 9.2. Information relating to children, and "special personal information" such as health data (relevant, for example, to salon patch-test and consultation records), is subject to the additional safeguards in sections 26–35 of POPIA and is processed only where a specific exception applies.
⚠️ The Information Regulator may impose fines of up to R10 million, and certain contraventions of POPIA carry criminal liability. A personal information breach must be reported to the Information Regulator, and to affected data subjects, as soon as reasonably possible (s.22 POPIA).
CONTACT For any privacy query or to exercise your rights, contact Information Officer at Information Officer contact.
— — — ⚠️ This is a boilerplate template, not legal advice. Employment, consumer-protection, data protection, and food-safety law in South Africa is detailed and fact-specific (BCEA, LRA, POPIA, PAIA, CPA, ECTA, R638) — have this document reviewed and adapted by a labour/commercial lawyer, and where relevant checked against current CCMA and Information Regulator guidance, before use.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
Access, correction, deletion, objection, complaint to the Information Regulator
e.g. children's data, health data (salons)
0 of 13 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.