Plain-English walk through what POPIA actually requires from you when you offer guest WiFi. Short answer: less than you think, but more than doing nothing.

Every few weeks a restaurant owner emails us in a mild panic: “Does offering WiFi make us POPIA-compliant? Do I need a data protection officer? Am I going to get fined?”

Short answer: probably no, no, and no — but only if your WiFi setup is doing the basics right. Here’s what the basics actually are, in plain English, without the consultant-speak.

What POPIA actually is

The Protection of Personal Information Act (POPIA) came into full enforcement in 2021. It’s South Africa’s answer to Europe’s GDPR — the law that says organisations handling personal information have to do so responsibly, transparently, and with consent.

If you collect any personal data — name, email, phone number, ID — from anyone as part of your business operations, you’re a “Responsible Party” under POPIA. Including offering guest WiFi.

The eight conditions (simplified)

POPIA sets out eight conditions for lawful processing. For guest WiFi, the ones that matter most are:

Accountability — you have a policy and you stick to it.
Processing limitation — only collect what you actually need.
Purpose specification — tell the guest what you’re using their data for, before you collect it.
Consent — get explicit permission. A checkbox, not a pre-ticked box.
Security safeguards — keep the data safe, encrypted, access-controlled.

Skip any of those, and if the Information Regulator investigates a complaint, you’re exposed.

What this means for your captive portal

In practice:

✅ Your splash page must have

A clear description of what data you’re collecting (“We collect your email to send you our newsletter and manage your WiFi session”).
An explicit opt-in checkbox. Not pre-ticked. The guest has to tick it.
A link to your privacy notice (a full, written privacy policy on your website).
A way for guests to say “connect me but don’t market to me” — consent is separable.

❌ Your splash page must not

Pre-check the consent box.
Bury the privacy notice in a 10-point grey font.
Require marketing consent as a precondition for WiFi access (that’s not “freely given consent” under POPIA).
Share the data with third parties without separate, specific consent.

The “reasonable purpose” test

You don’t need consent to collect data for a “reasonable purpose” necessary for providing the service. For WiFi, that means connection logs, device identifiers, and basic session data are fine — you need them to run the network.

What you do need consent for is anything beyond that: marketing emails, SMS campaigns, sharing data with partners, using the data for analytics beyond your own operations.

What the Information Regulator actually cares about

Based on the cases they’ve published, the Regulator focuses heavily on:

Breach notifications — if personal data leaks, you have 72 hours to notify them and affected parties.
Consent quality — whether it was freely given, informed, specific.
Data minimisation — did you really need to collect that ID number, or would an email have been enough?
Third-party sharing — who else sees the data, and was that disclosed?

Nobody has been hit with a multi-million-rand fine in South Africa for a casual WiFi misstep. But the legal and reputational risk of an investigation is real, and the fix is cheap if you do it before it becomes a problem.

What Hotwireless does by default

When you deploy our Captive Portal, POPIA compliance is baked in:

Consent checkboxes are unticked by default. Guests must actively opt in.
Marketing consent is separate from “let me on the WiFi” consent.
A plain-language privacy notice is linked from every splash page, customised to your venue.
Only the minimum data needed is collected unless you explicitly turn on more fields.
All data is encrypted in transit and at rest, hosted in compliant regions.
Guests can request data deletion via a simple link we include in every email you send them.
Breach notification is built into our support flow — if anything happens on the platform, we notify you within the regulator’s required window.

You still need your own privacy policy and your own understanding of what data you’re using for what. But the captive portal layer itself is fully compliant out of the box.

The 10-minute checklist

If you run guest WiFi today and you haven’t thought about POPIA in a while, spend 10 minutes on this:

Does your splash page have a visible privacy notice link?
Is the consent checkbox unticked by default?
Can a guest connect to WiFi without consenting to marketing?
Do you have a written privacy policy on your website?
Do you know which staff can access the guest data?
Have you nominated an Information Officer (required by POPIA — usually the business owner)?
Would you know what to do in the first hour of a data breach?

If you’re ticking less than 5 of those, you have some cleanup to do — and honestly, the first three are where 90% of the real exposure sits.

The short version

Collect only what you need.
Tell guests clearly what it’s for.
Get a real opt-in, not a pre-ticked one.
Keep it safe.
Don’t share it without asking again.

Do that, and POPIA is an unobtrusive guardrail, not a landmine.

Not sure if your current WiFi setup is doing it right? We’ll have a look for free.

POPIA and your WiFi: the 2026 compliance guide for SA venues