A community platform is a database of people — names, contacts, businesses, histories.
That makes it a POPIA responsibility from day one.
Here's how to run member data properly without strangling the community.
We've written before about the POPIA myths that trip up small businesses. Community platforms deserve their own chapter, because they're a special case hiding in plain sight: a directory or member network is, by definition, a database of personal information — names, contact details, business information, participation histories. If you run one, or you're building one, POPIA isn't a compliance box off to the side. It's a design requirement of the platform itself. The good news: done at design time, it's mostly straightforward. What this guide covers: - Why platforms carry more responsibility than groups - The five design decisions that make or break compliance - Members' rights, and what they mean operationally - The security floor every platform owes its members ## A Platform Is a Responsible Party An informal WhatsApp group scatters data across everyone's phones. A platform concentrates it — one organisation collects, stores, and displays members' information, which makes that organisation the responsible party in POPIA's terms. That's not a reason to avoid building platforms; concentration done properly is far safer than scatter. But it means someone owns the obligations: lawful basis, defined purpose, security, and answering to members about their own information. > The directory that makes your community findable is personal information, organised. Treat it as an asset held in trust — because legally and practically, that's exactly what it is. ## Five Design Decisions That Decide Everything **Consent and purpose at sign-up.** Members should join knowing, in plain language, what information is collected and what it's for: "your profile will be visible in the directory so partners and buyers can find you." Purpose defined, consent recorded, no fine-print archaeology. And the purpose binds you — the member list gathered for the directory isn't a marketing list to rent out later. **Visibility tiers, chosen by the member.** Not everything collected should be displayed. The workable pattern: members control what's public (their listing), while operational details (ID numbers, banking, programme records) stay administrative, visible only to those who need them. A platform that displays everything it collects has confused a directory with a leak. **The minimum-data habit.** Collect what the purpose needs, and nothing speculative. Every extra field is extra obligation — and extra breach surface. If the directory doesn't need dates of birth, don't hold them. **Youth data, handled as what it is.** Community platforms in development ecosystems often include programme participants — young people whose attendance, progress, and circumstances are recorded. That data belongs behind the operational wall, aggregated in any community-facing view, and never displayed at individual level outside genuine operational need. Anyone under 18 triggers stricter rules entirely — get specific advice before holding children's data at all. **Leaving must work.** Members have the right to correct their information and to leave — which means deletion and de-listing processes that actually function, not accounts that linger for years because nobody built the off-switch. Retention after exit should have a reason (legal obligations, programme records) and a limit. ## When Someone Else Runs Your Platform Most communities don't build their platform — they rent software or join a network, which adds a relationship POPIA cares about: the operator. When a provider hosts your member data, they process it on your behalf, and the law expects that relationship to be governed — a written agreement covering what the provider may do with the data, the security they maintain, and what happens on termination (your data returned or destroyed, not retained as their asset). This is the unglamorous paperwork that separates professional platform providers from hobby projects, and asking for it is a legitimacy test in itself: a provider who has never been asked has never served a serious community. The same lens applies to the AI and automation features platforms increasingly bundle: if member data feeds any external service — for matching, curation, or analytics — that flow belongs in the agreement too, named and bounded. "The platform uses AI" is a feature description; where the data goes is a compliance question, and communities are entitled to both answers. ## The Security Floor None of the design matters if the database leaks. The floor for any community platform: access controls with individual logins (no shared admin passwords), admin access limited to the few who need it, encrypted connections as standard, backups that are themselves secured, and a plan for the bad day — POPIA expects notification of breaches, and "we hoped it wouldn't happen" is not a plan. This list is the same basic hygiene we recommend for any small-organisation system; platforms just owe it to more people at once. This guide is general information, not legal advice — for specifi...