POPI-Aligned Lead Capture: 7 Things Your Website Must Have in 2026

The Information Regulator fined two South African businesses R10 million each in 2025 for non-compliant lead capture. One was a financial services firm. The other was a healthcare provider. Both had standard-looking "subscribe" and "contact us" forms — and both lost a year of revenue to fines, legal fees and brand damage.

POPIA enforcement is no longer theoretical. Here's the 7-point checklist your website needs in 2026.

What POPIA actually requires

The Protection of Personal Information Act (POPIA) has been in force since 1 July 2021, but enforcement only really started biting in 2024-25. The Act applies to any business in South Africa that collects personal information — and "personal information" includes names, email addresses, mobile numbers, and IP addresses.

That means every lead form, every newsletter signup, every "contact us" field, and every cookie banner on your website is in scope.

The penalties: up to R10 million per breach, or 10 years' imprisonment for the Information Officer (yes, jail). And the Regulator no longer requires a complainant — it can audit you off its own initiative.

The 7-point compliance checklist

1. Explicit, specific consent

A pre-ticked "I agree" checkbox is not consent. A buried link to "by submitting this form you agree to our privacy policy" is not consent.

What works: An unticked checkbox next to each specific use ("Email me with quotes for my enquiry", "Send me monthly marketing tips"). Each use needs its own opt-in. Bundling them together is non-compliant.

2. Plain-language purpose statement

You must tell the user, at the point of collection, exactly what you'll do with their information. "We may use your data for business purposes" is not specific enough.

What works: "We'll use your phone number to send you a booking link via SMS, and to call you about your enquiry. We'll keep your information for 36 months unless you ask us to delete it sooner."

3. Retention policy

You can't hold onto personal information indefinitely. POPIA Section 14 requires you to delete data once the original purpose is fulfilled — unless you have another lawful basis to keep it.

What works: Define a retention period (we use 36 months for prospects, 5 years for customers per SARS requirements), publish it in your privacy policy, and actually delete data when it expires.

4. Opt-out / withdraw consent mechanism

Every marketing communication you send must have an easy way to opt out. Every form you collect data through must offer the user a way to later withdraw consent.

What works: Unsubscribe link in every marketing email. SMS opt-out instruction in every SMS ("Reply STOP"). A dedicated privacy email address (we use [email protected]) that responds within 30 days.

5. Data subject rights — actually implemented

Users have the right to ask what data you hold, correct it, delete it, and lodge complaints. Your privacy policy must explain these rights, and you must actually be able to honour them.

What works: A documented internal process for handling Subject Access Requests within 30 days. A defined point of contact (the Information Officer). A system that can actually retrieve and delete data on request (this is where Wix and Squarespace often fall short — they can't export or delete on demand without engineering work).

6. Information Officer designation

Every business processing personal information must designate an Information Officer and register them with the Information Regulator. For small businesses this is usually the owner or MD. The Officer is personally accountable for compliance.

What works: Register your Information Officer on the Information Regulator website, list them in your privacy policy with contact details, and brief them on their obligations.

7. Breach notification plan

If you suffer a data breach affecting personal information, POPIA requires you to notify the Regulator and affected data subjects "as soon as reasonably possible". You can't make that timeline if you don't have a plan.

What works: A written incident response plan — even one page — that defines: who detects, who decides, who notifies, what gets said, and what timeline. Practice it once a year.

Compliant vs non-compliant form — side by side

Non-compliant ❌:

Name [____] Email [____] Message [____]
☑ I agree to the terms
[Submit]

Problems: pre-ticked consent, no purpose statement, bundled consent, no retention info, no opt-out.

POPIA-compliant ✅:

Name [____] Email [____] Mobile [____] Business [____]
We'll use your details to send you a booking link and quote your enquiry. We keep this information for 36 months.
☐ Yes, also email me occasional NexysWeb tips and articles (optional)
[Submit] · By submitting you agree to our Privacy Policy.

How NexysWeb ships every site POPIA-ready

Every NexysWeb build includes, by default:

• Compliant lead-capture forms with explicit consent
• Plain-language privacy policy customised to your business
• Retention rules wired into your GHL CRM (auto-purge after 36 months)
• Unsubscribe + opt-out automation
• SAR-handling email and process documentation
• Information Officer template registration
• Cookie banner (only first-party cookies by default — no third-party tracking unless you explicitly opt in)

You don't have to think about POPIA. We've already done the work.

Claim a free POPIA audit

Want us to check your existing site against the 7-point checklist? We do free audits — 15 minutes on the phone, written report, no obligation. Claim your audit here →

This article is general guidance only and does not constitute legal advice. Consult an attorney for advice specific to your situation.