The things people ask before they sign up

Yes. Section 51 applies to every private body with no turnover threshold and no exemption by headcount. The exemption that once covered small businesses lapsed at the end of 2021.

You already have one. Under POPIA the head of a private body is automatically the Information Officer — if you run the business, that is you. You can designate deputies, but the duty stays with you and the personal liability comes with it.

You do need to register with the Information Regulator, through their eServices portal. It is free, and we will walk you through it.

The manual and the privacy policy still are — those obligations attach to holding records, not to having a website. The consent banner would not apply to you, and we would say so rather than sell you a component you cannot use.

Usually nothing, until somebody complains, a client audits you, or the Regulator arrives. Then the exposure is an administrative fine of up to R10 million, and for failing to comply with an enforcement notice, up to R2 million or two years — attaching to the Information Officer personally.

The more common consequence is quieter: losing a tender or a corporate client because you could not produce a manual when their procurement asked for one.

It is a different thing. An attorney applies judgement to your circumstances. This applies a reviewed template to your answers. For a business with ordinary record-keeping that is the right tool — and it is enormously better than the nothing most businesses have.

For a dispute, an investigation, or an unusual corporate structure, you want the attorney. We will tell you so.

The questionnaire is about fifteen minutes. Compiling takes under a minute. Most people are finished on the day they sign up, including putting the banner on their site.

Update your answers and regenerate. New premises, a new Information Officer, a new category of information you have started collecting — the documents rebuild against the current answers, as many times as you like.

You control them through your answers rather than by editing the PDF. That is deliberate: a manual that has been hand-edited after generation cannot be regenerated without losing the edit, and we would have no idea what it now says.

If something your business needs will not fit the questionnaire, tell us. That is useful — it usually means the questionnaire is wrong.

The banner is a single small script with no framework behind it. If a page cannot be processed safely it is served exactly as it was — a broken checkout is a worse outcome than an ungated tag, so it fails in the direction that keeps you trading.

There is a diagnostic mode that lists what was blocked on each page, so "is it actually working?" is a question with an answer rather than a hope.

No, and that is the point. It reads the finished page and recognises around forty tracking vendors by name — Google Analytics, Tag Manager, Meta Pixel, Hotjar, Clarity, TikTok, LinkedIn and the rest. Anything it does not recognise is left alone rather than guessed at, and you can add your own patterns.

That is fine. WordPress gets a plugin because it is the common case; everything else takes one line of code before the closing body tag. Shopify, Wix, Squarespace, a hand-built site — all workable.

Section 11(2)(b) gives them that right and the banner honours it properly. A permanent control reopens their choices. If they switch off a category whose tags have already run, the page reloads clean and that category's cookies are expired — rather than the tags carrying on until they close the tab.

An opaque identifier held in their own browser, one-way digests of their address and browser details, the page they were on, what they chose, when, and which policy version was current. No names, no email addresses, and no addresses stored in the clear.

It is exactly the situation POPIA sections 20 and 21 govern: you are the responsible party, we are your operator, and that relationship must be in a written contract before processing begins. You will be asked to accept one at signup, and we keep a record of which version you accepted.

A compliance vendor who does not offer you an operator agreement has just created the problem they were hired to solve.

Export it before you go — it is a spreadsheet and it is yours. It is your evidence of lawful processing, and you may well need it after you stop being a customer, so we would rather you left holding it.

Only about your own account — documents ready, payment failed, your service is about to lapse. No campaigns, no newsletter you did not ask for, and no list you end up on because you once requested a review.

Section 69 prohibits unsolicited electronic direct marketing anyway. Ignoring that while selling POPIA compliance would be difficult to explain.