E-Commerce Business Registration in South Africa 2026 - Complete Guide

Selling online in South Africa is a regulated activity. Alongside the usual business registration formalities, e-commerce traders must comply with three major pieces of legislation: the Electronic Communications and Transactions Act (ECTA) 25 of 2002, the Consumer Protection Act (CPA) 68 of 2008, and the Protection of Personal Information Act (POPIA) 4 of 2013. Failing to meet these requirements exposes you to fines, customer disputes, and payment gateway rejection.

This guide walks through the complete registration and compliance checklist for launching a legally compliant South African online store in 2026.

Step 1: Choose Your Business Structure and Register with CIPC

Before you can open a payment gateway or a business bank account, you need a legal entity.

Most Common Structures for E-Commerce

Structure	Notes
Sole Trader	Cheapest to set up. Personal liability for all debts. Not a separate legal entity.
Private Company (Pty) Ltd	Separate legal entity. Limited liability. Required by most payment gateways.
Close Corporation	No new CCs since 2011, but existing CCs may continue to trade.

Most serious e-commerce businesses register a (Pty) Ltd with CIPC. The cost is R175 for name reservation + R125 for registration (or R125 combined for a standard name assignment).

CIPC Registration Documents Required

• Complete CoR14.1 (Memorandum of Incorporation for standard private company) or use the standard MOI
• Certified ID copies of all directors (SA ID or passport)
• Proof of address for each director
• Company address (registered address, can be your home address)

Step 2: Comply with ECTA - Mandatory Website Disclosures

The Electronic Communications and Transactions Act 25 of 2002 requires all South African e-commerce websites to display the following on their website (typically on an "About Us," "Contact," or "Legal" page):

Required ECTA Disclosures:

• Full legal name of the entity or natural person operating the website
• Registration number (company reg no. if a company, or SA ID number if a sole trader)
• Physical address (not just a PO Box)
• Telephone number and email address
• VAT registration number (if registered for VAT)
• Your website's terms and conditions of use
• A description of the main characteristics of the goods or services
• The full price of goods or services including all taxes and charges
• Accepted payment methods
• Your returns, refunds, and complaints policy

ECTA also gives consumers the right to cancel electronic transactions within 7 business days of delivery (cooling-off right), with certain exceptions (custom-made goods, perishables, software unsealed after delivery).

Step 3: Consumer Protection Act Compliance

The CPA 68 of 2008 applies to all consumer transactions in SA, including online sales, unless you sell exclusively in a B2B context where both parties have an annual turnover or asset value exceeding R2 million.

Key CPA Requirements for Online Stores

• Plain language: All contracts, terms, and product descriptions must be in plain, understandable language
• Prohibited clauses: You cannot contract out of CPA consumer protections
• Product liability: You are jointly and severally liable with the manufacturer and supplier for unsafe goods
• Right to cancel advance bookings: Consumers can cancel bookings with reasonable notice and your cancellation fee cannot be a penalty — it must reflect actual reasonable costs
• Honest advertising: No misleading price promotions, no "bait advertising," no false reviews

Failure to comply can result in complaints to the National Consumer Commission (NCC) or the Consumer Goods and Services Ombud.

Step 4: POPIA Compliance - Handling Customer Data

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's primary data protection law. It applies to any business that collects, stores, or processes personal information of South African data subjects.

POPIA Obligations for E-Commerce

1. Appoint an Information Officer and register them with the Information Regulator (free, done online at inforegulator.org.za)
2. Publish a privacy policy on your website disclosing what data you collect, why, how long you keep it, and with whom you share it
3. Obtain consent for marketing communications (email newsletters, WhatsApp broadcasts)
4. Secure your data: Implement reasonable technical and organisational measures to prevent data breaches
5. Report breaches: Notify the Information Regulator and affected data subjects as soon as reasonably possible after discovering a breach
6. Data retention: Don't keep personal information longer than necessary for the purpose it was collected

The Information Regulator can impose fines of up to R10 million or 10 years' imprisonment for serious non-compliance.

Step 5: VAT Registration

You must register for VAT with SARS if your taxable turnover exceeds R1 million in any consecutive 12-month period. You may voluntarily register if your turnover exceeds R50,000 per year.

For e-commerce sellers:

• If you sell digital services to South African consumers and you are based outside SA, you may be required to register under the digital services VAT rules
• Selling physical goods shipped from abroad to SA consumers may trigger customs VAT and import duties at SARS Customs

Registering for VAT requires submitting VAT101 to SARS along with supporting documents. You can do this via eFiling.

Step 6: Payment Gateway Requirements

South African payment gateways (PayFast, Peach Payments, Ozow, PayGate, Yoco) generally require:

• Company registration documents (COR14.3 certificate of incorporation and COR15.1A / MOI)
• Proof of banking in the company name
• CIPC-confirmed director details
• A live, functional website with ECTA-compliant disclosures visible
• A clear return and refund policy visible on the website
• FICA documents: certified ID and proof of address for all directors/beneficial owners

Without a (Pty) Ltd and a business bank account, most gateways will decline your application.

Step 7: Ongoing Compliance Obligations

After launch, you need to maintain:

• CIPC annual returns: Due every year between your incorporation anniversary month and month +2 (cost R450/year for small companies)
• PAYE registration if you hire employees (even one)
• SDL registration if your annual payroll exceeds R500,000 (Skills Development Levy)
• UIF registration and contributions: Mandatory for all employers from the first employee
• Financial statements: All companies must prepare annual financial statements (audited only if required by the Act or your MOI)

Related Guidance

• Blog hub
• Free CIPC fee calculator: CIPC Calculator

Official References

• CIPC - www.cipc.co.za
• ECTA 25 of 2002 - www.gov.za
• Information Regulator (POPIA) - www.inforegulator.org.za
• National Consumer Commission (CPA) - www.thencc.gov.za

Last Reviewed

Last reviewed: 2026-03-03. This article is informational only - verify current requirements with CIPC, SARS, and the Information Regulator before acting.