Why Your Website Needs Policies and Documentation

Back to Blog

Legal pages are the least interesting part of a website, and usually the last thing anyone thinks about. They are also the part that matters most on the day something goes wrong. In South Africa they are not really optional any more — POPIA changed that — and the good news is they protect you at least as much as they protect your customers.

The Short Version

If your website collects any personal information — a contact form, an email signup, an enquiry, even server logs — South African law expects you to explain what you collect, why, and what you do with it. That explanation is your privacy policy.

Terms and a disclaimer are not legally mandated in the same way, but they define what you have actually promised. Without them, anything on your site can be read as a commitment.

The Three Documents

1. Privacy policy

The one that is genuinely required. Under the Protection of Personal Information Act (POPIA), if you process personal information you must tell people what you collect, why you collect it, who you share it with, how long you keep it, and what rights they have over it.

"Processing" is broader than most people expect. A contact form is processing. So is an email list, a booking system, or analytics that record IP addresses.

2. Terms of service

Sets the rules for using your site and, if you sell or provide services through it, the basis on which you do so. Payment terms, cancellation, what happens if someone misuses the site, who owns the content, and which country's law applies.

3. Disclaimer

Draws a line around what your content actually commits you to. This is the one most businesses skip and most often need.

What POPIA Expects

Why This Protects You

It is easy to read compliance as pure obligation. In practice these pages work in your favour more often than against you.

• They cap expectations. A disclaimer stops indicative timelines and illustrative pricing being treated as promises.
• They settle disputes early. When there is disagreement about what was agreed, written terms resolve it far more cheaply than the alternative.
• They signal legitimacy. Larger clients and procurement processes check for them. Their absence is noticed.
• They are increasingly expected. Payment providers, app platforms and advertising accounts frequently require a published privacy policy before approving you.
• They reduce regulatory exposure. POPIA has real enforcement powers. Having made a genuine effort matters.

Common Mistakes

Copying another company's policy

The most common one, and the most dangerous. A copied policy describes someone else's data practices. If it says you use a CRM you do not have, or omits the analytics you do run, it is inaccurate — which is arguably worse than having nothing, because you have now made a false statement.

Writing it once and forgetting it

Add a booking system, a newsletter or a new analytics tool and your policy is out of date the same day.

Hiding it

Convention is a link in the footer on every page. It costs nothing and it is where people look.

Contradicting yourself

If your policy says you keep enquiries for 12 months and your terms say indefinitely, you have created the ambiguity these documents exist to remove.

How Much Is Enough?

Proportionate to what you actually do. A five-page brochure site with one contact form needs a short, honest privacy policy, basic terms and a disclaimer. A platform handling payments, accounts and customer records needs considerably more — cookie policy, acceptable use, refund terms, and disclosure of any third-party integrations.

The test is not length. It is whether someone reading it would come away with an accurate picture of what happens to their information.

Nobody reads your privacy policy until the moment they have a reason to. That is exactly when it needs to be accurate.

You can see how we apply this to our own site in our privacy policy, terms of service and disclaimer.