Most privacy problems on South African business websites are implementation gaps rather than complicated legal questions: a policy that does not match the site, forms asking for more than they need, consent wording nobody can find, and tracking nobody documented. We review what is visible on your website and explain it in plain English.
This is a website review, not legal advice, a legal opinion or POPIA certification.
AI AgentReady reviews websites. This check looks at the privacy and POPIA-related signals that are visible on your public site: whether privacy information exists and can be found, what your forms ask for, how consent is worded, and what the site discloses about cookies and tracking.
It is not legal advice, a legal opinion, or any form of POPIA certification, and it cannot tell you whether your organisation is compliant. Compliance involves internal matters we cannot see from a website — how information is stored and secured, who has access, retention periods, supplier arrangements, staff processes and your information officer's responsibilities.
What the review is genuinely useful for is closing the obvious gaps on the website itself, which is often where the most visible problems sit, and knowing which questions to take to a legal adviser rather than paying to discover them.
Whether a privacy policy exists, is reachable from every page, is readable, and describes something recognisably like your business.
What each form asks for, whether every field is necessary for the stated purpose, and what the visitor is told at the point of submission.
Whether consent language is specific and understandable rather than buried, pre-ticked or bundled with unrelated permissions.
Whether the site explains the tracking it actually uses, and whether any banner or preference tool reflects reality.
Whether agreeing to be contacted about an enquiry is kept distinct from agreeing to receive marketing.
Whether a visitor can tell who is behind the website and how to reach a real organisation with a privacy question.
Whether pages that collect personal information are served securely, without certificate warnings or insecure resources.
Which external services appear to receive visitor information, so your disclosures can at least be accurate.
Copied policies are common, and they frequently mention services, jurisdictions or data practices that have nothing to do with the site they sit on.
A policy that does not describe what your website actually does is arguably worse than a short, honest one, because it creates an expectation you are not meeting.
We regularly see quote and enquiry forms asking for identity numbers, dates of birth, physical addresses or company registration details before any conversation has taken place.
Collecting less information means less to protect and less to account for. It usually also increases the number of people who finish the form.
A pre-ticked box, a line of grey six-pixel text, or a single tick that covers an enquiry, a newsletter and sharing with partners all at once.
Clear, separated, plainly worded consent is easier to rely on and, in our experience, does not reduce genuine enquiries.
Many banners are informational overlays that set no preference and change no behaviour, while analytics and advertising scripts load regardless of what the visitor clicks.
Whether that matters legally is a question for an adviser. What we can tell you is whether the banner on your site appears to do anything at all.
Sites accumulate analytics, remarketing pixels, chat tools and embedded content over the years, often added for a campaign and never removed.
Listing what is actually running is a prerequisite for describing it honestly, and it frequently turns up tools nobody uses any more.
If a visitor wants to know what you hold about them, or ask you to delete it, there should be a straightforward route to a real person.
A contact address that reaches someone who understands the request is a small implementation detail that makes a noticeable difference.
Tell us the website address and what you would like us to look at — the privacy policy, specific forms, cookie handling, or the personal information the site collects.
You tell us the website address and what you would like reviewed about privacy, forms, cookies or personal information.
We review the visible privacy signals on the public site, including forms, consent wording, policy access and third-party tracking.
You receive a plain-English summary of what appears clear, what appears missing, and which items are worth raising with a legal adviser.
If you would like help implementing website changes — policy pages, consent wording, form adjustments, cookie handling — we can quote for that separately.
Privacy is an area where businesses are often sold anxiety. We would rather be useful than alarming.
In practice, most of what we find is straightforward: a policy that needs to reflect reality, a form asking for more than it needs, consent wording that could be clearer, and an honest description of the tracking already in place.
None of that requires panic. It requires someone to look at the website properly and write down what they see.
Our review focuses on your website. If you are also working through the wider organisational side of POPIA, a structured checklist can be a helpful starting point for framing internal questions.
An external South African resource covering POPIA topics beyond the website itself. It is not affiliated with this review, and it is not a substitute for advice from a qualified adviser about your specific obligations.
A broader review across visibility, trust and technical health.
WordPress Security CheckVisible security signals on the pages that collect information.
Website Not Getting EnquiriesTrust and form friction affect enquiries as well as privacy.
Not sure which one fits? Browse all website checks.
Submit your website for a calm, practical review of its visible privacy signals — what is clear, what is missing, and what belongs in a conversation with a legal adviser.