VAT and POPIA for online sellers in South Africa
Two things worth understanding early, in plain language — not as a substitute for an accountant or a lawyer, but so you know what questions to ask one.
VAT: when it applies to you
Value-Added Tax is charged at 15% in South Africa. Whether you need to charge it depends entirely on your turnover, not on what you sell or how you sell it:
- Below R50,000 turnover in a 12-month period:you can't register for VAT even if you wanted to.
- R50,000 to R1 million: voluntary registration is available. Some sellers register early so they can claim back VAT on business expenses — worth discussing with an accountant, since it also means charging VAT on every sale.
- Above R1 million: registration becomes compulsory.
These thresholds are set by SARS and do get revised over time — confirm the current figures directly on the SARS website or with an accountant before making a decision based on them.
Once registered, you'll need to issue proper VAT invoices (with your VAT number, the VAT amount charged, and the required line items) and file VAT returns on SARS's schedule. ShopFront generates VAT-ready tax invoices automatically once you mark your shop as VAT-registered.
POPIA: what it actually requires
The Protection of Personal Information Act governs how you collect, store, and use customer data — names, addresses, phone numbers, order history, anything that identifies a real person. It applies to every business that processes personal information, including a one-person online shop.
In practice, for a small online shop, that means:
- Having a clear, accessible privacy policy that says what data you collect and why.
- Only collecting the customer information you actually need to fulfil an order and communicate with the buyer.
- Storing that data reasonably securely — not, for example, in a spreadsheet anyone in a shared drive can open.
- Being able to tell a customer what data you hold on them, and delete it, if they ask.
None of this requires a legal team for a small shop — it requires a privacy policy that actually reflects what you do, and habits that match it. If your shop starts collecting more sensitive data (health information, financial details beyond what a payment gateway handles for you) or operating at larger scale, that's the point to get proper legal advice specific to your business.
New to selling online in South Africa?
This is one step in the practical path from taking orders by DM to running a real shop — payments, shipping, and getting found are covered in the full guide.
Read the step-by-step guide →Common questions
Do I need to register for VAT to sell online in South Africa?
Only once your turnover requires or allows it. Compulsory VAT registration currently applies once your turnover exceeds R1 million over any 12-month period. Voluntary registration is available from R50,000. These thresholds do get revised, so confirm the current figures on the SARS website or with an accountant before deciding — don't rely on any single guide, including this one.
What happens if I don't register for VAT when I'm supposed to?
Compulsory registration isn't optional once you cross the threshold — SARS can register you retroactively and apply penalties and interest on VAT that should have been charged. If you're approaching R1 million in annual turnover, it's worth talking to an accountant before you cross it, not after.
Does POPIA apply to a small one-person online shop?
Yes — POPIA applies regardless of the size of the business if you process personal information (which any online shop does: names, addresses, contact details, order history). The obligations scale with what you actually do with that data, but a small shop isn't exempt just because it's small.
What's the minimum I need to do for POPIA as a small seller?
At minimum: a clear, accessible privacy policy explaining what customer data you collect and why, collecting only the data you actually need to fulfil an order, storing it securely, and being able to delete or export a customer's data if they ask. It's not a substitute for proper legal advice if your business handles more sensitive data or larger volumes.
Do I need a registered company to charge VAT or comply with POPIA?
No — VAT registration and POPIA compliance apply to how you handle tax and customer data, not your business structure. Sole proprietors can register for VAT and must comply with POPIA the same as a registered company.
General information, not tax or legal advice — confirm anything VAT- or POPIA-specific to your business with SARS, the Information Regulator, or a qualified professional.
Stop taking orders by DM. Start running a real shop.
Start for free →