POPIA and Accessibility on a South African Corporate Website

Last updated: October 2026. Your public website collects names, ID numbers, employment histories, financial preferences, and location data — often before a human speaks to the visitor. Under the Protection of Personal Information Act (POPIA), that collection is processing. If nobody can name the responsible party, lawful basis, and retention period for each form, the site is a compliance asset and a liability at the same time.

Accessibility is parallel risk, not a separate charity project. A corporate site that keyboard users cannot navigate, or that relies on colour alone for errors, excludes customers and employees and invites complaints under equality law and procurement standards. Large buyers and government-adjacent entities increasingly ask for WCAG evidence in tenders. Marketing owns the experience; IT owns the platform; legal owns the interpretation — but the board answers when a regulator or client asks what you did about it.

Mid-sized South African companies — roughly 50 to 500 staff, often with a group structure or regulated parent — cannot treat POPIA and accessibility as “launch tasks” copied from a template bought in London. The Information Regulator expects accountability in South African context: purpose specification, consent where required, security safeguards, and data subject participation. Your website is where many of those duties become visible to the public.

If you are replatforming, align compliance with rebuild scope — see when a mid-sized company should rebuild its website — rather than bolting a banner onto broken forms after go-live.

Every corporate form should answer four questions a data subject — and an auditor — can understand without ringing your switchboard:

• Who is responsible? Name the responsible party (usually the company legal entity) and provide contact details for information officer queries.
• Why are you collecting this? Purpose limitation in plain language — “to respond to your enquiry”, not “to improve our services” as a blanket excuse for marketing reuse.
• What is the lawful basis? Consent for optional marketing; contract or legitimate interest for core enquiries where legal has signed off — documented, not guessed by the agency.
• How long do you keep it? Link to retention schedules; do not imply indefinite storage because CRM defaults say so.

Fields must be proportionate. A “contact us” form on a professional services firm site should not demand ID numbers unless there is a statutory reason. A careers form may need more — but still needs a recruitment privacy notice, not a recycled consumer paragraph.

Technical implementation matters. Server-side validation, encryption in transit, CRM field mapping reviewed by IT, and logging that shows who exported data for campaigns. Marketing automation integrations are where POPIA breaks: a checkbox tick on the site must gate the list in HubSpot or Salesforce, not only hide an email field visually.

A financial services group we advise runs separate forms for advice requests, complaints, and recruiter outreach — each with distinct purposes and retention. They rejected a single mega-form because legal could not map one consent block to three processing purposes. That discipline slows launch by a week and saves months of remediation when the compliance committee asks for evidence.

Cookie banners copied from EU templates often fail South African scrutiny: they bundle analytics with advertising, pre-tick categories, or load tags before consent. POPIA requires meaningful consent for non-essential processing where consent is your basis — and a clear record of what the user accepted.

• Inventory tags — Document every script: analytics, heatmaps, chat, advertising pixels, social embeds. Remove orphans from old agencies.
• Classify by purpose — Strictly necessary (session, security) versus analytics versus marketing; legal signs classification, not only IT.
• Consent before fire — Use consent mode or tag-manager blocking so non-essential cookies do not load on first paint.
• Granular choice — Accept, reject, and customise where you use optional marketing tags; do not hide reject behind five clicks.
• Records — CMP or server logs that prove consent version and timestamp for disputes.
• Policy alignment — Privacy policy lists categories and third parties; update when MarTech changes.

Multi-brand retail groups often run separate ad accounts per banner but one corporate privacy policy. Consent copy must reflect which entity processes data when the visitor submits on a brand microsite — especially after acquisitions where the trading name differs from the POPIA registration.

Marketing wants data; legal wants minimisation. The workable compromise is essential analytics with anonymisation where possible, and gated marketing tags until opt-in — documented in your record of processing activities. Skipping the inventory because “we only use Google” fails the moment someone adds LinkedIn Insight or a webinar embed.

Coordinate with SEO and performance work: consent UX should not trap keyboard users — another reason accessibility and POPIA belong in one steering meeting, not two siloed audits.

Record the consent text version in your change log whenever marketing rewords a banner. Regulators and enterprise clients increasingly ask what the user saw on the date of submission — not what the policy says today after three rebrands.

Full WCAG 2.2 AA certification on every PDF legacy asset is a multi-quarter programme. Your new template system can still meet practical AA expectations on pages you control: navigation, forms, key journeys, and campaign landers. Use the WCAG 2.2 quick reference as the shared language between agency, IT, and legal — not vague “accessible design” in a slide deck.

• Perceivable — Text alternatives for informative images; sufficient contrast on buttons and error states; captions for hero video with sound.
• Operable — Full keyboard path through nav, modals, and multi-step forms; visible focus; no keyboard traps in cookie or chat widgets.
• Understandable — Clear labels linked to inputs; errors described in text, not colour alone; consistent navigation across divisions.
• Robust — Semantic HTML; ARIA only where needed; components tested with screen readers on Chrome and Safari mobile.

Accessibility overlaps POPIA: forms that screen-reader users cannot complete are both an exclusion failure and a barrier to lawful consent capture. PDF-only brochures on critical journeys fail twice — inaccessible for many users and harder to log consent for downloads.

Budget for remediation sprints after automated scans (axe, Lighthouse accessibility). Automated tools catch roughly a third of issues; manual testing on real templates catches focus order bugs in mega-menus common on corporate sites. A professional services firm reduced complaint volume and call-centre “I could not submit” tickets by fixing three form templates — measurable ROI beyond compliance.

Specify WCAG targets in vendor briefs — our clients often reference AA on new components while grandfathering legacy PDFs with a published remediation roadmap. Honesty beats a false “100% compliant” badge on the footer.

Train content authors on headings and link text — not only developers on code. Corporate blogs break accessibility when every post uses “click here” and skipped heading levels; governance beats one-off training slides that nobody opens after induction.

Mobile parity matters for South African users on mid-range Android devices: touch targets, zoom, and modal consent on small screens are where WCAG failures show up in user testing, not on the desktop review in the boardroom.

When marketing hires a web agency, POPIA roles still sit with the company as responsible party. The agency may act as operator processing data on your instructions — but only if contracts say so. Default terms that leave analytics ownership with the vendor or grant the agency rights to reuse form data are red flags.

• Operator agreement — Processing scope, security measures, sub-processors (hosting, email, CRM), breach notification timelines.
• Acceptance tests — Forms, consent, and accessibility criteria in the statement of work — not “best efforts”.
• Exit and portability — Export of consent records, form configs, and accessibility test reports at handover.
• Change control — New tags, chat tools, or A/B scripts require security and privacy review — see care plans in SLA discussions.
• Indemnities balanced with evidence — You cannot outsource fines if you never reviewed the privacy notice the agency drafted.

Procurement should involve legal before award, not after design approval. A mid-market RFP that scores POPIA and WCAG alongside integration and cost reduces the agency that wins on cheap templates alone. Use structure from how to write a website RFP in South Africa and weight compliance like uptime.

IT must list sub-processors: CDN, form SaaS, US-hosted marketing tools. Cross-border transfer mechanisms and vendor DPAs belong in the data map — marketing cannot answer regulator questions with “the agency handles hosting”.

When two brands share one CMS, contracts should clarify which entity’s privacy policy applies per site section and who approves template changes that add fields. Group marketing often publishes; group legal must recognise each change as processing activity updates.

You do not need a six-month programme to find glaring gaps. Assign owners and run this sequence:

1. Week 1 — Form and notice inventory — List every live form, linked privacy notice, CRM destination, and retention rule. Flag fields without purpose text.
2. Week 2 — Tag and cookie audit — Crawl production with consent disabled and enabled; compare network calls. Remove unused tags.
3. Week 3 — Template accessibility sample — Test homepage, primary contact journey, careers, and one campaign lander with keyboard and screen reader; log blockers.
4. Week 4 — Governance pack — Responsible party statement on site, information officer contact, record of processing update, vendor DPA gaps, remediation backlog with dates.

A multi-branch retailer discovered marketing pixels still firing on store pages after a rebrand because the old GTM container was embedded in a shared footer include. Legal had approved a new policy; technology had not caught the container ID drift. The audit found it in week two — before a regulator enquiry, not after.

Document findings for the board as risk-rated items: critical (personal data leak or consent bypass), high (keyboard block on contact), medium (contrast on secondary buttons). Tie spend to fixes — template hours, CMP licence, CRM rule changes — so compliance competes fairly against campaign requests.

Re-run the tag audit after every major release. POPIA and accessibility regressions usually arrive as “quick” plugin installs, chat widgets, and embedded third-party calculators — not as grand redesigns.

Share the week-four governance pack with your audit committee or risk forum if one exists — website processing is often absent from enterprise risk registers until a client questionnaire exposes gaps. Closing that loop turns marketing’s audit into group-level visibility.

If you operate across the group with two trading names, run the inventory twice. Shared GTM and a single privacy URL that names only one entity is a common Johannesburg group failure. Procurement questionnaires from banks and insurers now ask which legal entity collects the data — an answer that does not match the form footer will stall a deal longer than a slow homepage.

Name the accountable owners this week. Start the form inventory and tag crawl before the next campaign pushes traffic to non-compliant landers.

Replatforming is the cheapest moment to embed lawful forms, consent, and accessible components. Book a call with Dsignr Digital or get a quote for corporate web design with POPIA-aware templates and WCAG-tested patterns — and read how to choose a web design company with compliance weighted in the scorecard.