Add to Preferred Sources
Ecommerce website requirements in South Africa are defined by three separate Acts — the Electronic Communications and Transactions Act (ECT Act), the Protection of Personal Information Act (POPIA), and the Consumer Protection Act (CPA) — plus technical standards that most build guides skip entirely. If you are planning or auditing a store on Shopify in South Africa, this post maps every legal obligation to the specific page, feature, or setting it creates on your site. The ecommerce legal requirements South Africa imposes are not optional: non-compliance gives your customers a right to cancel and, in some cases, exposes you to regulatory action.
South Africa's online retail market is forecast to reach R159 billion in 2026 — roughly 10% of total retail — according to World Wide Worx. More stores are entering every month, and regulators are paying attention.
Setting up the compliance framework at build time is far less disruptive than retrofitting it after launch. More practically, it removes one of the most common reasons browsers don't convert: distrust in an unfamiliar store.
Quick Answer
South African ecommerce website requirements fall into two layers: legal (mandatory disclosures under ECT Act Section 43, a 7-day cooling-off mechanism under Section 44, a POPIA-compliant privacy policy, and CPA-aligned returns terms) and technical (HTTPS/SSL, mobile-responsive design, a secure payment system, and a pre-purchase order-review screen). VAT registration becomes compulsory once your taxable supplies exceed R2.3 million in any 12-month period. Missing any legal element gives customers a right to cancel; missing technical elements costs you conversions.
Jump to a section
What South African law requires on your ecommerce site
Technical requirements every SA ecommerce site must meet
Payment gateway requirements for SA stores
Not sure if your current site covers everything?
Send us your store URL and we'll identify the legal and technical gaps before they cost you customers or compliance headaches.
Request a Free Store ReviewWhat South African Law Requires on Your Ecommerce Site
The legal layer of SA ecommerce website requirements draws from three separate pieces of legislation, each covering different ground. Understanding the ecommerce requirements South Africa draws from each Act is the starting point for any build brief. The table below maps each obligation to the specific item it creates on your site — use it when briefing a developer or auditing a live store.
| Act & Section | Legal Obligation | What you must build |
|---|---|---|
| ECT Act, s43(1) | Mandatory supplier disclosures | Display full name, legal status, registration number, physical address, phone, email, pricing with all taxes and fees, payment terms, delivery timeframe, complaints procedure, returns policy, security and privacy statement |
| ECT Act, s43(2) | Order review before purchase | A checkout screen that lets buyers review the full order, correct mistakes, and withdraw before confirming — standard in most platforms but must be intact |
| ECT Act, s43(5) | Secure payment system | A payment gateway that meets accepted technological security standards (SSL, PCI DSS-certified gateway) |
| ECT Act, s44 | 7-day cooling-off right | A clear cancellation/returns process; the 7-day window cannot be waived in your terms — "no refunds" is unenforceable for cooling-off claims |
| ECT Act, s46 | 30-day delivery obligation | An order-execution process and, where needed, a customer notification system if you cannot deliver on time |
| POPIA | Lawful data processing | Published privacy policy, cookie consent mechanism, data-subject request form (access, correction, deletion), data-processing agreements with third-party tools |
| CPA, s56 | 6-month warranty on defective goods | A returns/exchange process for defective items; cannot be excluded in terms and conditions |
ECT Act Section 43: The Mandatory Disclosure List
Section 43(1) of the ECT Act is the most detailed single requirement SA online stores face. According to Lawtons Africa's analysis of SA ecommerce consumer protection law, the supplier must make all of the following available on the website before a transaction takes place:
- Full name and legal status (e.g. "(Pty) Ltd"), registration number, names of office bearers, and place of registration
- Physical address (not just a PO box) and telephone number
- Website address and email address
- Physical address for receiving legal service of documents
- Membership details in any self-regulatory or accreditation body and the code of conduct subscribed to
- A sufficient description of the goods or services being offered
- The full price, including transport costs, all taxes, and any other fees
- Payment method and terms
- Terms of the agreement, any guarantees, and how the consumer accesses them electronically
- Delivery timeframe
- How transaction records are stored and how the consumer can access them
- Return, exchange, and refund procedures
- Alternative dispute resolution code details
- Security procedures for the payment and privacy protection of personal information
- Where applicable, the minimum contract duration
- The consumer's rights under Section 44, where applicable
If any item from this list is missing, the consumer gains a right to cancel within 14 days of receiving the goods or services — a cancellation window beyond the standard 7-day cooling-off right. Build the disclosure list into your footer, your checkout, or a dedicated legal-information page. Most platforms have fields for this; the risk is leaving them incomplete at launch.
The 14-day enforcement window is separate from the 7-day cooling-off. Section 44's 7-day right applies to all qualifying transactions; the 14-day cancellation right under Section 43 is a penalty for non-disclosure — it stacks on top. A store that has incomplete disclosures AND a valid transaction gives the consumer both windows. Fix the disclosures at launch, not when a dispute arrives.
Technical Ecommerce Website Requirements Every SA Store Must Meet
The technical ecommerce website requirements for SA stores are shaped partly by legislation (Section 43(5) mandates a secure payment system) and partly by the practical realities of the local internet environment — high mobile usage, variable connectivity, and no Shopify Payments gateway.
HTTPS and SSL
Every page of your ecommerce site must run on HTTPS — an SSL certificate encrypts the connection between your customer's browser and your server. This is a baseline requirement of ECT Act Section 43(5), and without it most modern browsers display a "Not secure" warning that kills conversions before you get the chance to sell anything. Most SA hosting providers include SSL; the risk is misconfiguration (mixed content warnings, expired certificates) rather than absence.
Mobile-responsive design
Google indexes the mobile version of your site first. If your mobile experience is broken — tiny text, horizontal scrolling, tap targets too small to hit — your rankings and your conversions both suffer. The majority of SA internet traffic reaches sites on a smartphone, and with mobile data costs still higher than desktop broadband, your pages need to load fast on a throttled connection, not just on a home fibre line.
Page speed and image optimisation
A page that takes more than three seconds to load on a mobile connection loses a significant share of visitors before they see your product. Compress images to WebP format, lazy-load anything below the fold, and confirm your hosting configuration does not introduce a slow time-to-first-byte. SA stores on default shared hosting frequently underperform on speed; the most common cause is an uncompressed hero image. Fast pages also signal to search engines that your store delivers a good user experience.
Payment Gateway Requirements for SA Online Stores
South African payment gateway requirements are shaped by one hard constraint: Shopify Payments is not available in South Africa (as of mid-2026), which means every Shopify store in the country must connect a third-party gateway and pay both the gateway's fee and Shopify's additional transaction fee. When researching SA ecommerce requirements, this is the Shopify-specific constraint most founders miss until they reach the payment setup step.
The three most common options for SA Shopify stores are:
| Gateway | Card rate (2026) | Shopify transaction fee | Best for |
|---|---|---|---|
| PayFast | 3.5% + R2.00 | 2% (Basic) / 1% (Grow) / 0.6% (Advanced) | Most SA stores — widest local payment method support (EFT, Mobicred, SnapScan) |
| Peach Payments | ~3.2% | Same Shopify fee applies | Higher-volume stores needing faster settlement and recurring billing |
| Ozow | Instant EFT focused | Same Shopify fee applies | Stores where bank-to-bank transfers are the primary method |
Understanding the ecommerce legal requirements South Africa imposes on payment handling — specifically ECT Act Section 43(5) on payment security — means choosing a gateway that handles the security layer, not just the cheapest rate. One SA-specific feature to confirm with your gateway: 3D Secure (3DS) authentication. All major SA gateways support it, and it significantly reduces card fraud chargebacks. Confirm it is enabled on your gateway configuration, not just available in the plan.
Unsure which gateway fits your store's size and payment mix?
Tell us your expected monthly volume and the payment methods your customers prefer — we'll map the right gateway and plan combination for your Shopify build.
Get a Free Setup AssessmentMandatory Pages Your Ecommerce Site Must Have
These four pages form the core of your ecommerce website requirements under SA law — each one addresses obligations from at least one of the three Acts, and each has specific content that the law demands, not just a placeholder. Meeting these ecommerce site requirements correctly at launch is significantly simpler than updating them under pressure from a consumer complaint.
Privacy Policy
Your privacy policy must explain: what personal information you collect and its source; the lawful basis for processing it; how long you retain each category of data; which third parties receive it (your payment gateway, email platform, analytics tool); and how customers can submit access, correction, or deletion requests. A generic template from a US service does not satisfy POPIA — it must reflect your actual data flows, including South African recipients and the Information Regulator as the relevant authority.
Terms and Conditions
Your terms must cover the Section 43(1) disclosures (the full list above), the Section 44 cooling-off right, your payment and delivery terms, your complaints procedure, the CPA Section 56 six-month warranty, and your dispute resolution process. Customers must actively accept the terms before completing a purchase — a footer link is insufficient; a checkbox at checkout is the standard implementation.
Returns and Refund Policy
This page must confirm the 7-day ECT Act cooling-off right, state the 30-day refund timeline, explain who bears the cost of return shipping for cooling-off cancellations (the customer), and explain the CPA's separate 6-month warranty for defective goods. Your policy cannot exclude the cooling-off right or the warranty — those terms are void as a matter of law.
Contact Page with Physical Address
ECT Act Section 43(1) explicitly requires a physical address — not a PO box, not a general area description. The contact page must also include an email address and telephone number. Failure to display a physical address is one of the most common Section 43 gaps auditors find on SA ecommerce sites, because many founders launch without a registered business address and use a home address they'd prefer not to publish.
The physical address requirement is non-negotiable. Section 43 specifically requires a physical address for both general contact and for receiving legal service of documents. If your business operates from home, consider registering a registered-office service address. Displaying only a contact form fails the statutory requirement.
VAT: The Financial Layer of Your SA Online Store
VAT registration is compulsory once your taxable supplies exceed R2.3 million in any consecutive 12-month period — the threshold in force from 1 April 2026, up from R1 million. Voluntary registration is available from R120,000. The SARS Budget 2026 FAQ confirms these thresholds.
SARS applies a rolling 12-month test — at any point in the year, you assess whether the preceding 12 months have crossed R2.3 million. You have 21 days from the date you exceeded the threshold to apply. Once registered, all prices on your site must display VAT at 15%: VAT-inclusive pricing is the most common approach for B2C stores.
Why South African Businesses Choose Growth Pulse Media
Growth Pulse Media is run by Dirk van Greuning, who built and scaled a large South African ecommerce business before founding the agency. That background is the difference between an agency that reads an ecommerce website requirements checklist and one that has navigated the payment gateway options, dealt with POPIA data requests, and felt the cost of a poorly configured checkout on real revenue.
As a registered Shopify Partner and Shopify Marketing Agency, we build SA stores that are configured for the local environment from day one: SA payment gateways set up correctly, Section 43 disclosures baked into the theme, mobile performance tested on real SA connection speeds, and POPIA compliance built into the contact forms, cookie consent, and privacy policy — not retrofitted after launch. We work with a limited client load so every build gets senior attention, and all work is executed in-house.
We also hold Omnisend Certified Partner status, which means the email automation that drives repeat purchase from your store — abandoned cart, post-purchase, win-back — is built by the same team that sets up your ecommerce website requirements, not handed off to a separate vendor.
Who This Is NOT For
Ready to audit your current site against SA requirements?
We'll review your store's legal disclosures, technical setup, and payment configuration and give you a prioritised fix list — no obligation.
Book Your Free Ecommerce AuditFrequently Asked Questions
What is the 7-day cooling-off right for South African online buyers?
Section 44 of the ECT Act gives online buyers 7 days from receipt of goods (or conclusion of the agreement for services) to cancel without reason or penalty. The right cannot be waived or excluded in your terms. Exceptions apply to perishables, personalised items, and unsealed digital media. If a customer exercises this right, a refund must be made within 30 days, and the customer bears the direct cost of returning goods.
Does a South African ecommerce site need a physical address displayed?
Yes. ECT Act Section 43(1) specifically requires a physical address — not a PO box or a suburb name — for both general contact purposes and for receiving legal service of documents. Displaying only a contact form or a general location fails the statutory requirement. If your business operates from home, a registered-office service address is a practical solution.
When does a South African ecommerce store need to register for VAT?
VAT registration is compulsory once your taxable supplies exceed R2.3 million in any consecutive 12-month period — the threshold that applies from 1 April 2026. You have 21 days from crossing the threshold to apply. Voluntary registration is available from R120,000. Once registered, prices must reflect VAT at 15%.
Is Shopify Payments available to South African online stores?
No. Shopify Payments is not available in South Africa as of mid-2026. SA Shopify merchants must use an approved third-party gateway — PayFast, Peach Payments, Yoco, or Ozow are the most widely used — which means Shopify also charges an additional transaction fee (2% on Basic, 1% on Grow, 0.6% on Advanced) on top of whatever your gateway charges.
What must a POPIA-compliant privacy policy cover for an SA ecommerce site?
A POPIA-compliant privacy policy — one of the core ecommerce website requirements under SA law — must explain what personal information you collect and its source, the lawful basis for processing it, how long you retain each category, which third parties receive it, and how customers can exercise their rights (access, correction, deletion). It must reflect your actual data flows — including your payment gateway, email platform, and analytics tool — and reference the Information Regulator as the relevant SA authority.
What happens if an SA ecommerce site fails to provide the mandatory Section 43 disclosures?
Missing disclosures under ECT Act Section 43 give the consumer a right to cancel the agreement within 14 days of receiving the goods or services — on top of the standard 7-day cooling-off right under Section 44. This is a statutory right that cannot be contracted out of. Full disclosure is one of the non-negotiable ecommerce website requirements in SA; complete it at launch, not after a dispute arises.
Build Your SA Ecommerce Site on the Right Foundation
Growth Pulse Media is a registered Shopify Partner and Omnisend Certified Partner based in Johannesburg. We configure SA Shopify stores with the right payment gateway setup, POPIA-compliant legal pages, and technical performance built for local connection speeds — not retrofitted after launch. All work is executed in-house by a senior team with limited client load.
No obligation — we will get back to you within 24 hours.
Get a Free Ecommerce Consultation