A customer completes an online enquiry form. A job applicant uploads a CV. An employee joins the business. A supplier contact is added to an accounts platform.
In each case, personal information is being collected.
The data subject should not have to search through a generic website policy to work out who is collecting the information, why it is needed, whether it must be provided, who may receive it or what rights apply.
Section 18 is about making the processing visible at the point where transparency matters.
Tell people what you are collecting and why. Explain the important consequences, recipients, rights and transfer information that apply to the processing.
Your processing inventory or ROPA identifies what information is collected, from whom, for what purpose and with whom it is shared.
Your lawful-processing assessment explains why the processing is permitted.
Your data-subject rights process supports the access, correction, objection and complaint rights that section 18 may need to communicate.
Building a practical POPIA privacy notice
Section 18 turns transparency into an operational duty
Section 18 applies when personal information is collected.
The responsible party must take reasonably practicable steps to ensure that the data subject is aware of the information listed in section 18(1).
This sits within POPIA's openness condition and links closely to section 13, which requires collection for a specific, explicitly defined and lawful purpose.
What should a section 18 notice cover?
The required content depends partly on the specific circumstances, but section 18 identifies the core information that should be considered.
Timing changes depending on how the information is collected
If the information is collected directly from the data subject, the section 18 steps must generally be taken before the information is collected, unless the person is already aware of the relevant information.
For other collection, the notice must be given before collection or as soon as reasonably practicable after collection.
Indirect collection still needs a transparency assessment
Businesses often focus their privacy notices on forms completed directly by customers, employees or applicants.
But personal information may also arrive from recruiters, clients, public sources, group companies, service providers or other third parties.
Where the information is not collected from the data subject, section 18(1)(a) specifically refers to making the data subject aware of the source from which it is collected.
There are circumstances where repeated or full notification may not be necessary
Section 18 does not require the same notice to be repeated every time the same kind of information is collected for the same purpose if the required steps were previously taken.
Section 18(4) also identifies circumstances in which compliance with section 18(1) is not necessary. These include certain cases involving consent to non-compliance, no prejudice to the data subject's legitimate interests, specified law-enforcement or legal circumstances, prejudice to a lawful collection purpose, impracticability, or certain non-identifiable, historical, statistical or research uses.
A layered notice can make section 18 easier to understand
POPIA does not prescribe one visual format for a privacy notice.
For many SMMEs, a layered approach is practical. The first layer gives the information that matters most at the point of collection, while a longer notice provides the fuller detail.
Where privacy notices often become weak
Privacy notices should move when the processing changes
A notice is only useful while it reflects reality.
Changes to the processing environment should trigger a notice review where they affect what data subjects are told.
The ROPA, change-management process, PIIA process and privacy-notice register should therefore support each other rather than operate as separate compliance exercises.
A business launches a recruitment portal
Applicants now apply online rather than emailing CVs directly to HR.
The new portal collects identity and contact details, employment history, qualifications and supporting documents. The platform is hosted by an external provider.
Would a data subject understand what is happening?
Use these questions as a practical sense-check before approving or publishing a privacy notice.
POPIA privacy notices: practical questions
Does POPIA require a document specifically called a privacy notice?
Section 18 requires the responsible party to take reasonably practicable steps to ensure that the data subject is aware of specified information when personal information is collected. A privacy notice is the common practical mechanism used to provide that information.
Is a website privacy policy enough for every processing activity?
Not necessarily. The notice must reflect the actual collection and the section 18 information relevant to that processing. Employment, recruitment, customer and supplier processing may require different or supplementary notices.
Must notice always be given before collection?
Where information is collected directly from the data subject, section 18(2)(a) generally requires the steps before collection unless the person is already aware of the relevant information. In other cases, section 18(2)(b) allows notification before collection or as soon as reasonably practicable after collection.
Do we need to repeat the notice every time?
Section 18(3) provides that where the required steps were previously taken, they do not need to be repeated for subsequent collection of the same information or information of the same kind if the purpose remains the same.
What if we obtain the information from a third party?
Section 18 still needs to be assessed. The section specifically addresses information not collected from the data subject and refers to disclosure of the source from which the information was collected.
Can a privacy notice be layered?
POPIA does not prescribe one visual format for section 18 notification. A layered approach can be practical if the required information is communicated effectively and the fuller notice remains accessible.
Should the notice state the legal basis for processing?
Section 18 expressly requires disclosure of any particular law authorising or requiring collection. It does not use the GDPR formulation requiring a general lawful-basis statement for every processing purpose. Organisations may still explain their lawful-processing position where useful, but the notice should remain anchored in POPIA's own requirements.
A privacy notice should reduce uncertainty
The strongest notice is not necessarily the longest one.
It is the notice that accurately reflects the processing, reaches the person when it matters and explains the information required by section 18 in language that can be understood.
Make the processing visible. Keep the notice accurate. Give people enough information to understand what happens to their personal information.
Know what you collect. Explain it clearly.
The Provara Group POPIA Compliance Programme helps South African SMMEs connect their processing inventory, lawful-processing decisions, privacy notices, data-subject rights, operator controls and ongoing governance into one practical compliance framework.
This guide has been reviewed for alignment, as at 8 September 2026, with the Protection of Personal Information Act 4 of 2013, particularly sections 13, 17 and 18 concerning purpose specification, documentation and notification to data subjects when collecting personal information.
Section 13 requires personal information to be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. Section 13(2) links that purpose requirement to the section 18 notification duty unless section 18(4) applies.
Section 18(1) requires a responsible party collecting personal information to take reasonably practicable steps to ensure that the data subject is aware of specified information. This includes the information being collected and, for indirect collection, its source; the name and address of the responsible party; the purpose of collection; whether supply is voluntary or mandatory; the consequences of failing to provide the information; any particular law authorising or requiring the collection; and, where applicable, intended transfer to a third country or international organisation and the level of protection afforded there.
Section 18(1)(h) also identifies further information that may be necessary, having regard to the specific circumstances, to enable reasonable processing. This includes recipients or categories of recipients, the nature or category of the information, rights of access and rectification, the right to object to processing under section 11(3), and the right to lodge a complaint with the Information Regulator together with its contact details.
Section 18(2) provides timing rules. Where information is collected directly from the data subject, the required steps must generally be taken before collection unless the data subject is already aware of the information. In other cases, the steps must be taken before collection or as soon as reasonably practicable after collection.
Section 18(3) provides that where the required steps were previously taken, the responsible party complies in relation to subsequent collection from the data subject of the same information or information of the same kind if the purpose remains the same.
Section 18(4) identifies circumstances in which compliance with section 18(1) is not necessary. These include the specific situations and qualifications set out in that subsection. This guide does not treat those exceptions as general exemptions from transparency and recommends that any reliance on them be assessed against the statutory wording and the facts.
POPIA does not prescribe one document title, visual layout or mandatory template called a privacy notice. References in this guide to layered notices, recruitment notices, employee notices, website notices, customer notices, supplier notices and privacy-notice registers describe practical governance approaches for operationalising section 18.
The Information Regulator itself publishes a privacy notice stating that it is provided in accordance with section 18(1) of POPIA. The Regulator's own notice is an example of how a responsible party may operationalise the transparency duty, but it is not presented here as a universal template for every organisation.
Important: This article provides general compliance information and practical governance guidance. It is not legal advice, does not constitute a legal opinion and does not guarantee compliance. The content, timing and format of a privacy notice should reflect the organisation's actual processing activities, collection methods, data subjects, legal obligations, transfers and operating circumstances.