If you sell online in South Africa, four areas of law shape your day-to-day: the Electronic Communications and Transactions Act (ECTA), the Consumer Protection Act (CPA), the Protection of Personal Information Act (POPIA) and tax. In practice that means showing customers the right information before they pay, giving them a fair way to change their minds, handling their personal details with care, and registering your business and tax affairs properly. This guide walks through each area using a realistic shop, so you can see why the rules exist and what decisions they leave to you.
Key Takeaways
- The National Consumer Commission names ECTA and the CPA as the main laws for online consumer protection, with POPIA covering customer data.
- Your website must show specific business details and let customers review, correct and cancel an order before it is final.
- Collecting customer details for a marketing list needs a deliberate yes from the customer, not a pre-ticked box.
- Your structure (sole proprietor, company and so on) decides your registrations, and VAT registration depends on your turnover.
- Legal readiness is easier when the pieces are in one place and in the right order.
Table of Contents
- Meet Thandi: a small online shop with big questions
- Start with the business behind the shop
- What your website must tell customers
- Customer data and marketing: where POPIA comes in
- Tax: registrations and VAT
- The agreements behind a growing shop
- Putting it together: a simple order of work
- A practical way to build your legal foundations
- FAQ
- Sources
Meet Thandi: a small online shop with big questions
Thandi makes hand-poured candles in Durban. She has a social media following, a simple online shop and her first corporate gift orders. Then the questions arrive. Does she need a company? What must the website say? Can she email last month’s buyers about a new scent? Does she charge VAT?
These are not exotic questions. Every online seller meets them, usually in this order: structure, website, customers, tax. We follow that order below.
Start with the business behind the shop
Customers, payment providers and the tax authority all want to know who they are dealing with. That starts with how you are set up.
According to SARS, companies, close corporations, cooperatives and other listed legal entities must register with CIPC and as corporate income tax taxpayers. Sole proprietors are taxed on their profits in their own name, and partnerships are taxed through the partners.
That gives Thandi a real choice:
- Trade as a sole proprietor. It is the simplest route. The business and Thandi are legally one and the same, so her personal finances sit alongside her trading.
- Register a company. The business becomes a separate legal entity, which suits an owner who plans to bring in a partner, hire staff or sign larger supplier deals.
There is no universally right answer. The useful questions are: Will anyone else own part of this? Will I employ people? Do my customers, such as corporate buyers, expect to deal with a registered entity? If you decide on a company, our guides on business registration in South Africa, the documents you need to register a company and the CIPC registration fee cover the practical steps.
Once registered, a company or close corporation also has ongoing duties. All of them must submit an annual return to CIPC, so it helps to diarise this from the start rather than discover it later.
What your website must tell customers
A shop window shows the owner’s name over the door. An online shop has no door, so the law asks you to do the same job on screen.
Section 43 of ECTA requires an online seller to make certain information available on the site. This includes:
- your business name and legal status;
- your registration number, if you are a legal entity;
- your physical address and contact details;
- a description of what you sell;
- the full price, including taxes and transport costs;
- your security and privacy policies.
The reasoning is trust. A buyer who cannot see where you are, or what the total cost will be, cannot judge whether to proceed. For Thandi, this is a footer and an “About us” page, a clear delivery fee at checkout and a privacy policy that matches what she really does with data.
The order process: review, correct, cancel
The same section expects your checkout to let customers review the whole transaction, correct mistakes and withdraw before they place the order. A basket page with an editable summary and a final “confirm order” step does this naturally. A checkout that jumps straight from “add to cart” to “paid” does not.
This matters beyond compliance. Fewer wrong sizes, wrong addresses and accidental orders means fewer refund conversations for a one-person team.
Cooling-off and returns
Online buyers cannot handle the product before paying, so the law gives them a short window to change their mind. The NCC’s guidance describes ECTA section 44 as the right to cancel an online purchase within seven working days without penalty. The CPA applies to transactions unless they are explicitly excluded, and ECTA adds e-commerce-specific protection on top.
The practical decision for Thandi is how to describe this in her returns policy: who pays for return courier costs, how long refunds take and how a customer starts a return. Write it in plain words and link it from the footer and the checkout. Our guide to what the law requires in a returns policy goes through the thinking in more detail.
Terms of use
Your website terms are the house rules: who may use the site, what you promise about product information, how orders are accepted and what happens to content on the site. They also tie together the pieces above. See our overview of what to include in website terms of use.
Customer data and marketing: where POPIA comes in
The moment Thandi takes a name, address and phone number for a delivery, she is processing personal information. The NCC lists the POPIA conditions that matter for online sellers, including limits on processing, collecting for a specific purpose and security safeguards, along with notifying people about security compromises.
Translated into shop terms:
- Collect only what you need. A candle delivery needs an address. It does not need an ID number or a date of birth.
- Say why you are collecting it. “To deliver your order and send you receipts” is a clear purpose. Using the same details later for an unrelated list is a different purpose.
- Protect what you hold. That includes a strong password on your shop platform, limited staff access and care over spreadsheets of customer orders saved on a laptop.
- Know what you would do if something went wrong. Having a simple internal plan beforehand makes you calmer and quicker.
Marketing to past customers
This is where small shops most often get tripped up by habit. Two South African marketing professionals writing in The Media Online stress that, for direct marketing under POPIA, an opt-out is not the same as consent: the customer must take an affirmative step to agree.
So a newsletter box that is ticked by default is a weak foundation. An unticked box with a plain sentence beside it (“Yes, send me news and offers”) is stronger, and it gives you a list of people who actually want to hear from you, which usually converts better anyway.
The CPA and ECTA add two points on direct marketing. Under CPA section 11, consumers may register a pre-emptive block against unwanted marketing, and ECTA section 45 requires the source of personal information to be disclosed when unsolicited communications are sent. Build an unsubscribe link into every message and keep a record of when and how each person said yes.
For a step-by-step view, see our POPIA compliance checklist for small business and the wider guide to POPIA compliance for small businesses. If you want to think about protecting the data you hold, our page on data security and breaches is a good next read.
Tax: registrations and VAT
SARS expects a business to register for the tax types that fit its structure and activities, submit returns and pay on time. Which taxes apply depends on the set-up:
| Situation | What it generally means |
|---|---|
| Company | Registers with CIPC and receives corporate income tax registration |
| Sole proprietor or partner | Declares business income through personal income tax |
| You employ people | PAYE applies |
| Company or relevant self-employed person | Provisional tax generally applies |
Do you need to charge VAT?
This is the question online sellers ask most. From 1 April 2026, compulsory VAT registration applies when taxable supplies exceed R2.3 million a year, and voluntary registration is available once they exceed R120 000 a year, subject to certain exceptions.
For Thandi, still well below the compulsory level, the decision is about whether voluntary registration makes sense. Registering lets you claim back VAT on business costs, but it also means charging VAT to customers and filing returns. Many founders talk this through with an accountant before deciding.
There is also a simpler option for very small businesses. Turnover Tax is a simplified regime for qualifying micro-businesses with annual turnover of R2.3 million or less. It generally replaces income tax, VAT, provisional tax, capital gains tax and dividends tax, though a qualifying business may elect to stay in the VAT system. Check the SARS pages for the current thresholds and rules before you choose.
Whichever route you take, the price shown on your site should be the full price, because ECTA expects taxes and transport to be part of what the customer sees.
The agreements behind a growing shop
Legal readiness is not only about the website. As the shop grows, relationships get more valuable and more complicated, and each one deserves a clear understanding in writing.
- A co-founder or business partner. Thandi’s sister wants to join. Who owns what, who decides what and what happens if one of them wants out? Answering these questions early is far easier than later.
- Your first employee. A packer for the festive season brings employment terms, working hours and a record of what was agreed.
- Suppliers and contractors. The wax supplier, the photographer and the courier all work with you. Clear terms on price, delivery and who owns the photos avoid awkward guesses.
- Confidential information and your brand. Your scent recipes and designs are what make you distinctive. Protecting them is a decision to make deliberately, not by accident.
- Customers. Corporate gift orders usually need clearer commercial terms than a one-off retail sale.
None of this needs to be daunting. It needs a sensible order and an understanding of why each document exists. The aim is to make the decisions yourself, with eyes open, and to know when a question is big enough to take to an attorney.
Putting it together: a simple order of work
- Decide your structure and register if you choose a company.
- Sort your tax registrations and diarise your annual returns.
- Update your website with the section 43 details, an editable checkout, a returns policy and terms of use.
- Write your privacy approach: what you collect, why, who can see it and how you protect it.
- Clean up your marketing consent so every address on your list opted in deliberately.
- Put your key relationships in writing as they arrive: partners, staff, suppliers and customers.
The RMI compliance manual puts the underlying principle simply: businesses must comply with relevant laws and regulations at all times. No checklist guarantees compliance, and your situation may raise points that need an attorney or accountant. A clear plan simply puts you well ahead.
A practical way to build your legal foundations
If you would rather not piece this together from scattered pages, PocketAdvisor Legal Toolkits™ gather the essentials in one digital box: expert-led videos, practical workbooks, professionally drafted South African legal agreements and compliance resources.
The Legal Toolkit™ for Start-Ups and Solopreneurs (R1 495, one-off) is built around legal foundations, which suits a shop in its early days. The Legal Toolkit™ for SMEs (R2 495, one-off) focuses on governance and commercial arrangements for a growing business. Both are designed to help you understand the reasoning behind the rules and make informed decisions. Explore PocketAdvisor Legal Toolkits™ and understand the legal foundations your business needs.
FAQ
Do I have to register a company to sell online in South Africa?
Not necessarily. SARS describes sole proprietors as taxed on their profits in their own name, while companies and close corporations must register with CIPC. A company suits owners who want a separate legal entity, but the choice depends on your plans for partners, staff and growth.
What must my online store show customers?
ECTA section 43 expects your business name, legal status, registration number if you are a legal entity, physical address, contact details, product descriptions, full pricing including taxes and transport, and your security and privacy policies. Customers must also be able to review, correct and withdraw from an order before it is final.
Can I email my past customers about new products?
Only if they have agreed to it. An opt-out is not the same as consent under POPIA, so use an unticked box, keep a record of the agreement and include an unsubscribe link in every message.
When do I need to register for VAT?
From 1 April 2026, registration is compulsory when taxable supplies exceed R2.3 million a year, and voluntary from R120 000. Qualifying micro-businesses may also consider Turnover Tax. Confirm your position with SARS or an accountant.
Sources
- Consumer Protection in e-Commerce, National Consumer Commission
- Electronic Communications and Transactions Act, section 43
- Starting a business and tax, SARS
- Small business leaflet, SARS
- Budget 2026 Frequently Asked Questions, SARS
- Turnover Tax, SARS
- POPIA regulations get a makeover, The Media Online
- Regulatory Compliance Manual, RMI
Recommended
This article is for educational and informational purposes only. It is not a substitute for professional advice.
