POPIA checklist for vibe-coded apps

The Protection of Personal Information Act (POPIA, Act 4 of 2013) applies to any South African business that collects, stores or uses personal information, and the compliance deadline passed on 1 July 2021. If your vibe-coded app stores a client's name, phone number, email address, ID number or even a photo of their house, POPIA applies to it.

AI app builders don't think about POPIA unless you ask them to. This checklist covers what to check before you go live. It is practical guidance, not legal advice; for anything sensitive, speak to a lawyer or a POPIA specialist.

1. Know what personal information your app holds

List every field that relates to an identifiable person: names, phone numbers, emails, addresses, ID numbers, photos, signatures, location, notes about them. Then ask of each one: do we actually need it? POPIA's minimality principle means you should collect only what is adequate, relevant and not excessive for your purpose. A booking app rarely needs an ID number.

Be especially careful with special personal information (such as health, religion, race, biometrics or criminal behaviour) and with children's information. POPIA restricts both, with stricter rules for processing them.

2. Be clear about why you collect it

POPIA requires a specific, lawful purpose. Write it down: "We collect the client's phone number to send updates about their own job." Tell people the purpose when you collect their information, usually in a short privacy notice on the form or app, and don't quietly use it for something else later.

3. Lock down who can see what

This is where vibe-coded apps most often fall short. Unless you say otherwise, a tool may build a screen that shows every record to every user.

• Give each role only the access it needs. A technician sees their own jobs; a client sees only their own records.
• Enforce it in the database, not just by hiding buttons. On Supabase this means row-level security policies on every table that holds personal information.
• Remove access promptly when staff leave.

4. Apply reasonable security safeguards

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures to protect personal information. For a small business app that usually means:

• Strong passwords and two-factor sign-in for admin accounts.
• No passwords, API keys or database credentials in your code, prompts or shared documents; keep them in each tool's secure settings.
• HTTPS on your domain (most hosts provide it free).
• Regular backups, and knowing how to restore one.
• Keeping your tools and dependencies up to date.

5. Check your operators and where data is stored

Your app builder, database host, email and SMS providers process personal information on your behalf. POPIA calls them operators, and you need a written agreement (usually their data processing terms) that requires them to keep it secure.

Many tools store data outside South Africa. Section 72 of POPIA allows transfers abroad only under certain conditions, for example where the recipient is bound by laws or binding agreements that give adequate protection, or with the person's consent. Check where each provider stores data and what protections they offer, and choose a data region close to your users where you can.

6. Get consent for marketing messages

Service messages about a client's own booking or job are part of providing the service. Marketing is different. Under section 69, direct marketing by electronic communication (email, SMS, WhatsApp) generally needs the person's consent, unless they are an existing customer who bought something similar from you and was given the chance to opt out. Every marketing message must offer an easy way to opt out. Build an opt-in field and an opt-out link into the app from the start. For WhatsApp in particular, see WhatsApp automation for small businesses.

7. Plan for people's rights

People may ask what information you hold about them, ask you to correct it, or ask you to delete it when you no longer need it. Make sure someone can find a person's records, export them and delete them without a developer's help. Decide how long you keep records, and delete or anonymise old ones.

8. Know what to do if something goes wrong

If you suspect personal information has been accessed by someone unauthorised, section 22 requires you to notify the Information Regulator and the affected people as soon as reasonably possible. Write down who decides, who notifies, and how. A one-page plan made now is far better than improvising during a breach.

9. Register your information officer

Every business has an information officer, by default the head of the business, and they must be registered with the Information Regulator. If yours isn't registered yet, do it; it is done online on the Regulator's website.

The short version

• Collect only what you need, and say why.
• Restrict access by role, enforced in the database.
• Keep credentials out of code and prompts.
• Check your providers' data terms and storage regions.
• Get consent for marketing, and offer opt-out.
• Be able to find, correct, export and delete a person's records.
• Have a breach plan and a registered information officer.

Non-compliance can bring fines of up to R10 million from the Regulator, and in serious cases criminal penalties, but the bigger cost for most small businesses is lost trust. Getting the basics right from day one is easier than fixing them later.