Legal Protection in Business Communication
- 21 October 2026
Every time a client engages your business, visits your website, or shares their personal details, a legal relationship is created. The question is not whether that relationship is governed by law, because it always is. The question is whether you have defined its terms, or whether a dispute will define them for you.
Terms and Conditions
T&Cs are a contract between your business and anyone who uses your website or services. In South Africa, they are governed by the Consumer Protection Act 68 of 2008 (CPA) and the Electronic Communications and Transactions Act 25 of 2002 (ECT Act). Section 43 of the ECT Act requires any website offering goods or services to disclose the business’s legal name and status, a description of the goods or services, the full price, cancellation and return procedures, and the manner of payment, before a transaction is concluded.
The CPA adds a further layer: terms that are unfair, unreasonable, or unjust may be voided by a court under sections 48–52. Where T&Cs are absent entirely, the CPA’s default protections apply in the consumer’s favour, meaning the business carries the risk of its own omission.
MINIMUM CONTENT FOR LEGALLY SOUND T&CS
- How and when the user accepts the terms.
- Scope of service: what is included and what is not.
- Payment terms, billing cycle, and late payment consequences.
- Intellectual property ownership.
- Liability limitation (must comply with CPA fairness standards).
- Cancellation and refund policy.
- Dispute resolution process and governing law.
Client engagement letters
Where T&Cs provide the general terms, an engagement letter should define the specific terms of a particular service offering. This is the document that protects both parties when scope questions arise, a fee is disputed, or a relationship needs to end. Without one, a service provider may be unable to enforce payment, resist an expanded scope claim, or terminate a client relationship without exposure to a breach of contract claim.
WHAT EVERY ENGAGEMENT LETTER MUST ADDRESS
- Full legal names and registration numbers of both parties.
- Precisely defined scope and what falls outside it.
- Deliverables, timelines, and fees (including deposit terms where applicable).
- Intellectual property: who owns the resulting product, and when.
- Confidentiality obligations on both sides.
- Termination clause: notice period and what is owed on exit.
- Limitation of liability, capped at the fee for the specific engagement.
Privacy Policy and POPIA
If your business collects any personal information – a name, an email, a phone number, a payment record – you are a responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA), and a Privacy Policy is a statutory disclosure obligation, not just a formality.
POPIA regulates personal information processing through lawful processing conditions: accountability, purpose specification, processing limitation, information quality, openness, security safeguards, further processing limitation, and data subject participation. Your Privacy Policy must reflect all of them and must disclose who collects personal information, why, how long it is retained, who it is shared with, and how a data subject can exercise their rights.
Security compromise notification: Section 22 of POPIA requires you to notify both the Information Regulator and affected individuals if personal information is accessed without authorisation. As of 1 April 2025, notifications must be submitted via the Information Regulator’s eServices Portal at inforegulator.org.za. Failure to notify is itself a POPIA contravention, as confirmed in enforcement actions against the Department of Basic Education and Central Johannesburg TVET College in 2024 and 2026 respectively.
The Information Officer
POPIA requires every business to have an Information Officer. By default, the CEO or equivalent. The role is assigned automatically by the Act and cannot be avoided. Critically, section 55(2) of POPIA requires that the Information Officer be registered with the Information Regulator before taking up their duties. Registration is done via the Regulator’s online portal. The Information Regulator has confirmed that, in the absence of a registered Information Officer, the head of the organisation is personally liable for all POPIA-related matters. Source: inforegulator.org.za.
Action item: If your Information Officer is not yet registered, this is a priority. Registration is free, online, and a prerequisite for POPIA compliance. Do it before your Privacy Policy is published or any personal data is collected.
International privacy policies
If your business serves clients abroad, uses platforms hosted outside South Africa, or transfers client data across borders, additional regulations may apply. POPIA’s section 72 limits cross-border transfers to countries offering equivalent data protection. The main international policies to be aware of:
| Policy | Jurisdiction | Applies to SA businesses when… | Max penalty |
|---|---|---|---|
| GDPR | EU / EEA | You process personal data of EU residents | €20m or 4% of global turnover |
| UK GDPR | United Kingdom | You offer services to or monitor UK residents | £17.5m or 4% of global turnover |
| CCPA / CPRA | USA (California) | You collect data from California residents and meet revenue thresholds | USD 7,500 per intentional violation |
| LGPD | Brazil | You process data of individuals located in Brazil | 2% of SA revenue, capped at R$50m per infraction |
The risks of not having these documents
The consequences fall into three categories. First, legal liability: without T&Cs or an engagement letter, disputes default to the common law or the CPA’s consumer-protective defaults, both of which tend to favour the client over the business. Second, regulatory enforcement: the Information Regulator issued an Enforcement Notice against the Department of Basic Education, resulting in a R5 million fine, the first POPIA fine in South Africa, after the DBE failed to comply with its Enforcement Notice. In 2026 alone, Enforcement Notices were issued against a TVET college, Sibanye Stillwater, and the Gauteng Department of Health. Third, reputational damage: clients increasingly expect documented, professional, compliant legal frameworks and their absence signals risk.
POPIA PENALTIES: SECTIONS 107 AND 109
- Administrative fine: up to R10 million per contravention (section 109).
- Criminal penalty: up to 10 years’ imprisonment for serious offences, including failure to comply with an Enforcement Notice (section 107).
- Civil claims: data subjects may separately claim compensation for damages caused by a POPIA contravention.
The Regulator does not require a complaint to act. It may investigate on its own initiative under sections 40 and 89 of POPIA. A business that has not registered its Information Officer, published a compliant Privacy Policy, or notified the Regulator of a security compromise is simultaneously in breach of multiple POPIA provisions. Source: POPIA sections 40, 89, 95, 107, 109.
Does your business have the legal documents it needs?
Cream Legal drafts Terms and Conditions, Privacy Policies, and client engagement letters tailored to your industry and fully compliant with POPIA, South African and international policies.
This article is for general informational purposes only and does not constitute legal advice. Legislation cited is as in force in October 2026. Sources: Protection of Personal Information Act 4 of 2013 · Consumer Protection Act 68 of 2008 · ECT Act 25 of 2002 · Information Regulator South Africa (inforegulator.org.za) · EU GDPR 2016/679 · CCPA/CPRA · Brazil LGPD · UK Data Protection Act 2018.
