The ECTA section 43 checklist
ECTA section 43 obliges every SA website operator transacting electronically to make the following information available on the website itself, accessible to consumers before they commit to a transaction. Failure is a criminal offence under section 43(5).
- Full legal name + legal status (Pty Ltd, CC, sole prop) + registration number
- Physical address + contact details + email address for service
- Website URL + secondary information channels
- Description of goods and services + the full price (including taxes and delivery)
- Payment terms + accepted payment methods + security procedures
- Return, exchange and refund policy
- Membership of relevant codes of conduct or industry bodies (where applicable)
- Procedure for handling complaints
Six mistakes SA websites make in their T&Cs
- Using a US or UK terms-of-service template wholesale. The CPA plain-language requirement, ECTA s 43 disclosures, and POPIA terminology are SA-specific.
- Treating T&Cs and privacy policy as the same document. They have different legal purposes — T&Cs govern your commercial relationship with the user; the privacy policy explains POPIA-compliant data processing.
- Including a one-sided arbitration clause designating a foreign jurisdiction. Unenforceable against SA consumers under the CPA; produces friction with B2B counterparties.
- Auto-renewal clauses without complying with section 14 of the CPA, which caps consumer fixed-term agreements at 24 months and requires 40–80 business-day advance notice of expiry.
- Reserving the right to "modify these terms at any time without notice". Unenforceable unfair-term under section 48 of the CPA.
- Forgetting to address electronic-signature acceptance under ECTA s 13. A click-wrap "I agree" needs to be intentional, informed, and recorded.
Frequently asked
Does every SA website legally need terms and conditions?
Functionally yes. ECTA section 43 imposes mandatory disclosure obligations on any website "for the purpose of electronic transactions" — even informational sites that capture leads or schedule consultations typically fall within scope. Failing to publish required disclosures is a criminal offence under section 43(5) and exposes the operator to consumer-led contract avoidance. Beyond ECTA, courts have repeatedly enforced website T&Cs as binding contracts under ECTA section 22, so failing to publish them leaves your business with weaker legal positions than your users.
How are website T&Cs different from a privacy policy?
T&Cs govern the commercial relationship between the website operator and the user — what services are offered, what payment is required, what each party can and cannot do, how disputes are resolved. The privacy policy is a POPIA-mandated transparency notice explaining what personal information is collected, why, how long it is kept, who it is shared with, and how data subjects can exercise their rights. Most websites need both, and they should reference each other but remain separate documents.
Are click-wrap "I agree" terms enforceable in South Africa?
Yes — under section 13 (electronic signatures) and section 22 (electronic agreement formation) of ECTA. The requirements are: the user must have meaningful opportunity to read the terms; the act of acceptance (clicking, checkbox) must be unambiguous and intentional; the system must record the act of acceptance with timestamp and version. Browse-wrap terms (where mere continued use implies acceptance) are weaker and may be challenged for lack of intentional consent.
How often should website T&Cs be updated?
Review annually at minimum. Trigger an immediate review when: legislation changes (POPIA amendments, Cybercrimes Act updates, CPA threshold changes); your business model changes (new services, pricing structures, payment methods); you enter a new market or jurisdiction; a regulator or consumer complaint highlights an issue. Material changes should be communicated to existing users with adequate notice and continued use treated as acceptance — not silently substituted.
What does the Website Legal Package cover?
Our fixed-fee Website Legal Package (R12,500 excl VAT) covers: website Terms of Use, a POPIA-aligned Privacy Policy, and Cookie Policy guidance. It is suited to most SA online businesses — e-commerce, SaaS, professional services, marketplaces, content platforms. For more complex sites (regulated industries, multi-jurisdiction operations, custom workflows), bespoke drafting is needed.
Are website T&Cs the same for B2B and B2C sites?
No. B2C T&Cs must comply with the CPA — plain-language requirement (section 22), unfair-terms protections (section 48), cooling-off rights (ECTA section 44 for electronic transactions, section 16 CPA for direct marketing), and the 24-month fixed-term cap (section 14). B2B T&Cs have more flexibility on these dimensions but must still satisfy ECTA disclosure requirements and POPIA processing terms. Many SA sites need both — a B2C path and a B2B path with different T&Cs.