What must a law firm's website privacy notice include under POPIA?
Under POPIA section 18(1), a law firm that collects personal information through its website must take reasonably practicable steps to make visitors aware of seven matters, and of further information where that is needed to make the processing reasonable. A privacy notice linked from every page and from each form is the usual way to do it. The notice should tell visitors:
- What information the firm collects, and the source, where it is not collected from the visitor (section 18(1)(a)).
- The firm's name and address (section 18(1)(b)).
- The purpose for which the information is collected (section 18(1)(c)).
- Whether supplying the information is voluntary or mandatory (section 18(1)(d)).
- The consequences of not supplying it (section 18(1)(e)).
- Any particular law that authorises or requires the collection (section 18(1)(f)).
- Any intended transfer to a third country or an international organisation, where applicable, and the level of protection the information will have there (section 18(1)(g)).
- Further information, where it is needed to make the processing reasonable (section 18(1)(h)): who receives the information, or the categories of recipients; the nature or category of the information; the right of access to the information and the right to rectify it; the right to object to processing under section 11(3); and the right to lodge a complaint with the Information Regulator, with the Regulator's contact details.
When visitors must be made aware
Section 18(2) sets the timing. Where the firm collects information directly from the visitor, as an enquiry form does, the steps come before the information is collected, unless the visitor is already aware of these matters. In any other case, they come before collection or as soon as reasonably practicable after it.
Under section 18(3), steps already taken cover later collection from the same person of the same information, or information of the same kind, if the purpose stays the same. Section 18(4) lists when the steps aren't needed, for example where the person has consented to them not being taken, or where taking them is not reasonably practicable in the circumstances of the particular case.
Where the notice belongs on a law firm website
- In the footer, so it is reachable from every page.
- Beside every form, as a short notice or a link above the submit button. This is where the site collects information directly.
- Covering analytics and advertising tools. POPIA section 1 counts an "online identifier" as personal information where it relates to an identifiable person, and these tools set or read one on the visitor's device. See cookie banners and POPIA for how to test what they do.
- Covering newsletter and marketing sign-ups, which section 69 also governs: electronic direct marketing needs the person's consent, or must meet the customer conditions in section 69(3).
What section 18 does not ask for
Many template notices carry more than section 18(1) lists. That can be good practice, but it is not a section 18 item:
- The Information Officer's name. Section 18 doesn't require it. A privacy contact still helps, because people need somewhere to send requests. The firm's PAIA manual must give the head of the body's contact details (PAIA section 51(1)(a)(i)), and under POPIA a private body's Information Officer is its head.
- The lawful ground for processing. Section 11(1) sets out the grounds. Section 18(1) doesn't list them among the matters to make people aware of.
- Retention periods. Section 14 governs how long records are kept. Section 18(1) doesn't list retention periods.
- A consent checkbox. Section 18 asks the firm to make people aware; it doesn't ask for their consent. Consent is one of the grounds in section 11(1), and where the firm relies on it, the firm bears the burden of proving it (section 11(2)(a)).
The privacy notice and the PAIA manual are different documents
PAIA section 51 asks the head of a private body to make a manual available, on the body's website if it has one (section 51(3)(a)). Since 30 June 2021 the manual must also describe, for POPIA purposes, the purpose of processing, the categories of data subjects and their information, the recipients, planned transborder flows, and the security measures in general terms (section 51(1)(c)). The Minister can exempt bodies under section 51(4). Some of this overlaps with the privacy notice, but the two rest on different provisions, so keep both current.
Check your firm's privacy notice in 15 minutes
- Open your site in a private window. Find the privacy notice link in the footer, and check it opens from the home, contact and practice pages.
- Open every form. Look for a short notice or a link to the privacy notice before the submit button.
- Read the notice against the eight items. Tick each matter in section 18(1)(a) to (h), with the subsection beside it.
- Check the name and address. They should be the firm's current name and address (section 18(1)(b)).
- List who receives a form submission. Your host, form tool, email provider and any CRM. Where any of them processes information outside South Africa, ask whether the notice should mention it under section 18(1)(g), and whether section 72 applies.
- Check the Regulator's details. Copy the Information Regulator's contact details from its own website, inforegulator.org.za, rather than from a template.
- Date the notice. Show when it was last updated, and review it when the site, its forms or its providers change.
- Ask your Information Officer to sign it off. The site shows what the notice says. Only the firm knows whether it matches what the firm does.
The notice is one item on our law firm website checklist, which also covers the PAIA manual, tracking, HTTPS, requests and retention. For handling the requests a notice invites, see data subject requests.
Frequently asked questions
What must a law firm's website privacy notice include under POPIA?
Under POPIA section 18(1), a law firm's website privacy notice should make visitors aware of: what information the firm collects, and its source if not the visitor; the firm's name and address; the purpose of collection; whether supplying the information is voluntary or mandatory; the consequences of not supplying it; any law that authorises or requires the collection; any intended transfer to a third country or international organisation, and the protection there; and, where needed to make the processing reasonable, the recipients, the nature of the information, the rights of access, rectification and objection, and the right to complain to the Information Regulator, with its contact details.
Does POPIA require a privacy policy on a law firm's website?
POPIA does not use the words privacy policy or privacy notice. Section 18 asks a firm to take reasonably practicable steps to make people aware of specific matters when it collects their personal information, before collection where it collects directly, as a website form does. On a website, a published notice is the usual way to take those steps.
Must a POPIA privacy notice name the Information Officer?
Section 18 does not require it. Giving a privacy contact is still good practice, because people need somewhere to send access, correction and objection requests. The firm's PAIA manual must give the head of the body's contact details under PAIA section 51(1)(a)(i).
Does a POPIA privacy notice need a consent checkbox?
Section 18 asks for awareness, not consent. Consent is one of the grounds for processing in section 11(1); an enquiry can often rest on another, such as steps to conclude a contract or the firm's legitimate interests. Where a firm relies on consent, it bears the burden of proving it (section 11(2)(a)).
Is a privacy notice the same as a PAIA manual?
No. The privacy notice makes people aware of the matters in POPIA section 18(1) when their information is collected. The PAIA manual, under PAIA section 51, explains how to request the firm's records and describes its processing of personal information. They overlap in places, but rest on different provisions.
How we check a privacy notice
Our law firm assessment reads a firm's privacy notice for each matter in section 18(1), and reports a gap as a question for the firm, not a finding of breach: the firm may make visitors aware another way, or an exception may apply. See a sample report. For a free website basics scan, which checks that the privacy notice and PAIA manual are linked, email hello@getohdit.co.za. Nothing here is legal advice.