Beyond registration and tax, a business has obligations to the people it employs, the customers it sells to and the information it holds. Those are the areas where small businesses are least prepared and where the consequences are largest.
This page covers employment, consumer and data protection law — the three that apply to almost every business and that almost every small business underestimates.
Business Requirements at a Glance
The obligations that apply beyond registration and tax.
- Employment law from the first employee — contracts, minimum conditions, fair procedure
- UIF and COIDA registration, both compulsory for employers
- Occupational health and safety duties, including a risk assessment and appointments
- Consumer protection obligations in how you sell, advertise and handle returns
- Data protection under POPIA, including an information officer
- Employment equity obligations, above the thresholds the Act sets
- Skills development levy and the associated obligations, above the payroll threshold
- Sector-specific regulation, where it applies
Registration and Legal Requirements
Every employee needs a written contract setting out the particulars the Basic Conditions of Employment Act 75 of 1997 requires. Minimum conditions on hours, leave, notice and deductions apply regardless of what a contract says, and the national minimum wage applies.
Dismissal must be substantively and procedurally fair under the Labour Relations Act 66 of 1995. Most CCMA cases are lost on procedure rather than on substance — the employer had a good reason and did not follow a fair process. Learning the disciplinary procedure is cheaper than losing a case.
Deductions from wages are restricted. An employer may not deduct for damage, shortages or training without complying with the Act’s requirements, including written agreement in defined circumstances.
Employment equity obligations under the Employment Equity Act 55 of 1998 apply above the thresholds it sets, including a plan and reporting. Confirm whether they apply to you with the Department of Employment and Labour.
Independent contractor is not a label you choose. The law looks at the substance of the relationship, and a person treated as an employee is one regardless of the contract’s wording. Getting this wrong produces back pay, UIF, COIDA and CCMA exposure.
Documents and Ownership Information Required
What a compliant employer keeps.
- A written contract for every employee, with the required particulars
- Payroll records, payslips and records of hours worked
- Leave records and records of any deductions with the required consent
- UIF and COIDA registration and current returns
- A workplace risk assessment and written health and safety appointments
- Training records, including induction and task-specific training
- Disciplinary records, warnings and hearing minutes
- An employment equity plan and reports, where the thresholds apply
- A POPIA compliance framework and a registered information officer
Tax, Licence and Compliance Requirements
The Consumer Protection Act 68 of 2008 applies to how you sell. It deals with fair marketing, plain language, the right to return goods in defined circumstances, an implied warranty of quality on goods, and unfair contract terms. It applies to consumers and to smaller juristic persons within its thresholds.
Know the return position. The Act gives specific rights on defective goods and, in defined circumstances, on cooling off. A blanket “no refunds” sign does not override it, and displaying one is itself a problem.
POPIA applies to every business holding personal information — customers, employees, suppliers. It requires lawful processing, purpose limitation, security safeguards, retention limits and the appointment of an information officer, who is the head of the business by default and must be registered with the Information Regulator.
Direct marketing is restricted under POPIA and the Consumer Protection Act, including consent requirements and the right to opt out. Marketing lists built without consent are a liability.
A data breach must be reported to the Information Regulator and to affected people, in the circumstances POPIA sets out. Having a plan before it happens is what makes that manageable.
Keep records to the periods required — tax records under the Tax Administration Act, employment records under the Basic Conditions of Employment Act, and personal information only as long as POPIA permits.
Process, Deadlines and Ongoing Obligations
Deal with the three in order of exposure: employment first if you have staff, then POPIA, then consumer terms. Each has a small number of documents that do most of the work — a compliant contract, a privacy notice and a set of terms of sale.
Get the documents right once. A properly drafted employment contract, disciplinary code, privacy notice and terms of sale cost far less to obtain than the disputes they prevent.
Free and low-cost help exists. The Department of Employment and Labour publishes the legislation and guidance free, the CCMA publishes its rules and guidelines, the Information Regulator publishes POPIA guidance, and the Small Enterprise Development Agency assists small businesses at no cost.
Take advice before a dismissal rather than after. It is the single point at which a small business most often creates a liability it could have avoided.
- Give every employee a written contract with the required particulars
- Learn the disciplinary procedure — most cases are lost on process
- Do not treat an employee as an independent contractor by label
- Register for UIF and COIDA and keep returns current
- Do a workplace risk assessment and make the required appointments
- Check whether employment equity thresholds apply to you
- Know the Consumer Protection Act position on returns and warranties
- Appoint and register an information officer under POPIA
- Build marketing lists with consent and honour opt-outs
- Take advice before a dismissal, not after
Frequently Asked Questions
What do small businesses most underestimate?
Employment law, and specifically dismissal procedure. Most CCMA cases are lost on process rather than substance — the employer had a good reason and did not follow a fair one.
Can I call someone an independent contractor?
Not by label. The law looks at the substance of the relationship, and a person treated as an employee is one. Getting it wrong produces back pay, UIF, COIDA and CCMA exposure.
Does a no-refunds sign work?
No. The Consumer Protection Act gives specific rights on defective goods and, in defined circumstances, on cooling off, and displaying such a sign is itself a problem.
Does POPIA apply to a small business?
Yes, to any business holding personal information about customers, employees or suppliers. It requires lawful processing, security, retention limits and a registered information officer.
Employment, consumer and data protection obligations are set in the Basic Conditions of Employment Act, the Labour Relations Act, the Employment Equity Act, the Consumer Protection Act and POPIA and administered by the Department of Employment and Labour, the CCMA, the National Consumer Commission and the Information Regulator, and are revised. Confirm current requirements with each.