What is POPIA?
The Protection of Personal Information Act (POPIA), Act 4 of 2013, is South Africa's primary data privacy law. It came into full effect on 1 July 2021 and governs how organisations collect, process, store, and share the personal information of South African residents.
In plain terms: if your business touches any customer data — names, email addresses, phone numbers, purchase history — you must comply with POPIA. Failure to do so can result in fines of up to R10 million or imprisonment.
Moonlit is POPIA Compliant: Moonlit Marketing (Pty) Ltd is a registered South African company. We collect only the data necessary for platform operation, obtain explicit consent from all users, and never sell personal data to third parties.
How POPIA Affects Affiliate Marketing Specifically
1. Consent for Data Collection
If your affiliate program requires customers to fill in a form (name, email, phone number) as part of a lead generation campaign, you must obtain explicit, informed consent before collecting that data. Pre-ticked boxes or vague "agree to our terms" language is not sufficient under POPIA.
2. Data Sharing Between Brands and Affiliates
In traditional affiliate networks, customer data can flow freely between the network, the advertiser, and the publisher. Under POPIA, this sharing must be governed by formal data processing agreements. If an affiliate (your Star) receives customer personal information, they are considered an "operator" under POPIA and must handle data accordingly.
Moonlit's approach: Our Stars do not receive raw customer personal information. They receive only commission confirmation and payment data. All customer personal data remains with the Seller and is governed by the Seller's own POPIA policies.
3. Tracking Cookies and Digital Consent
Affiliate tracking relies on cookies dropped on a user's browser. POPIA (in alignment with international standards) requires that users be informed about cookies and given the ability to opt out. If your website uses affiliate tracking cookies, your cookie consent banner must be clearly visible and functional.
4. Data Retention and the Right to Erasure
POPIA gives data subjects the right to request that their personal information be deleted. Your affiliate program must have a clear process for honouring these requests — including informing any affiliate partners who may have processed that customer's data.
A POPIA Compliance Checklist for SA Affiliate Marketers
- ✅ Display a clear, accessible Privacy Policy on your website
- ✅ Obtain explicit, informed consent before collecting any personal data
- ✅ Use POPIA-compliant cookie consent banners
- ✅ Have signed data processing agreements with all affiliate partners
- ✅ Store personal data securely and limit access to those who need it
- ✅ Have a documented process for handling data access or erasure requests
- ✅ Appoint an Information Officer if you process large volumes of personal data
Why Working with a Managed Network Reduces POPIA Risk
In an open affiliate network, you have no control over how hundreds of anonymous affiliates handle your customers' data. A single rogue affiliate who mishandles customer data can expose your brand to POPIA liability.
In a managed network like Moonlit, every Star operates under a formal agreement with clear data handling obligations. This creates a clear chain of accountability and dramatically reduces the risk of third-party data breaches.
Run a Compliant, Managed Affiliate Program
Moonlit's managed network keeps your customer data protected while scaling your performance marketing. Every Star operates under a formal agreement aligned with POPIA requirements.