Legal Consultation

One of the crucial tasks in ensuring the longevity and success of your business is managing accurate shareholder records. Maintaining clear and up-to-date records of your shareholders not only fulfils legal requirements but also helps with better decision-making and business growth. 

The Companies Act regulates the record keeping of shareholders records, often referred to as a securities register. In addition to the above, the register must include the following detailed information: 

These records are to be kept at the company’s registered office for a period of 7 years from the date on which the record is issued. There is no obligation for this to be registered with a regulator or registrar or any other organisation. Not maintaining an accurate and complete shareholder record results in non-compliance with legal requirements and even potential disputes between the shareholders due to lack of clarity in ownership. This would result in possible discrepancies in voting rights, dividend payments, and damage to investor confidence.

Many companies use spreadsheets for their share register, this method is prone to errors from manual entry and formula mistakes, creates confusion with multiple versions, and requires significant administrative effort. Online share register platforms offer many advantages, including fewer errors, less manual work, better preparation for growth and fundraising, and a more professional image for investors. They also improve investor access to information and facilitate communication, allowing stakeholders to easily update their own details online.

Maintaining a comprehensive and accurate shareholder record in accordance with the Companies Act is essential for legal compliance, transparency, and smooth business operations. Entrepreneurs should regularly update their shareholder registers and seek professional assistance where necessary to ensure accuracy.

Advertising plays a crucial role in brand promotion and consumer engagement. However, ethical advertising practices must be upheld to maintain consumer trust and industry integrity. The Advertising Regulatory Board (ARB) enforces the Code of Advertising Practice, which sets strict guidelines against misleading and deceptive advertising. Understanding these rules is vital for South African entrepreneurs to avoid legal pitfalls and protect their brand reputation. 

South Africa's advertising industry is self-regulated by the independent body known as the ARB.  The ARB plays a vital role in consumer protection by upholding the provisions of the CPA through its administration and enforcement of the Code of Advertising Practice (the Code). The Code provides that advertisements must not contain statements or visuals that are likely to mislead the consumer directly or indirectly or by way of omission, ambiguity, inaccuracies or exaggerated claims, etc. Any individual or entity may be held liable for deceptive advertising practices that contravene applicable South African advertising laws and regulations. This is similarly provided for in the Consumer Protection Act – which states that suppliers may not market goods or services in a manner that is false, misleading or deceptive. 

The Code of Advertising Practice and rulings made by the board binds and applies to multiple industry bodies and their members who have voluntarily agreed to be subjected to it. Most advertisers, advertising agencies and media sources are members of the ARB. The ARB lacks jurisdiction over non-members, therefore its rulings cannot legally bind them, and the Code’s provisions are unenforceable in their case. Consequently, the ARB cannot issue rulings specifically targeting non-member advertising. However, it retains the authority to make rulings that benefit the industry as a whole and its own membership. The Code covers most types of advertising, including traditional radio, television, online and print advertisements, but also “point-of-sale” materials, menus, labels, letterheads, circulars, stickers and product packaging.

Misleading or deceptive advertising occurs when an advertisement provides false, exaggerated, or deceptive claims that can mislead consumers. This includes:

The ARB Code establishes clear principles to prevent deceptive advertising. Key provisions include:

The Code aligns with the South African Constitution by upholding human rights, addressing societal sensitivities, and ensuring democratic freedoms. The ARB promotes responsible advertising that protects consumers, especially vulnerable groups like children.

As things stand, South Africa has no legislation that relates specifically to social media, but the Code has provided Appendix K that entails principles related to social media marketing. 

Any person or entity can be held liable for deceptive advertising if the laws and regulations (including codes) governing advertising in South Africa are not adhered to. Penalties that the regulatory board can impose or instructions it can impose on an advertiser to:

Businesses must adhere to both legislation and self-regulatory codes, in all marketing and advertising activities.  Compliance is crucial to avoid sanctions for misleading practices, particularly when targeting vulnerable groups like children, and within the evolving landscape of social media marketing.

Product liability is a significant concern for entrepreneurs and businesses. The legal framework mandates that companies disclose any defects in their products to protect consumers and avoid liability claims. Failing to comply with these regulations can lead to severe legal and financial consequences. Understanding the disclosure requirements is essential for any entrepreneur looking to build a reputable and legally compliant business.

Product liability is primarily governed by the Consumer Protection Act (CPA), which safeguards consumers' right to safe and good quality goods. 

Under the CPA, a product is considered to be defective if there is a material imperfection making it not reasonably safe, or if it does not meet the quality and performance standards that consumers are entitled to expect, potentially causing harm.

Types of product defects that incur liability in manufacturers and suppliers:

Entrepreneurs must take proactive steps to disclose product defects. The following are essential disclosure requirements:

Under Section 55 and 56 of the CPA, consumers have the right to receive goods that:

Failure to meet these requirements can result in liability claims, making proper disclosure critical for businesses.

Consumers have a right to return unsafe or defective goods within six months by way of: 

The supplier has no right to decide for the consumer. If the products break again after six months, they may be returned again within three months for a refund or a replacement.

Section 61 of the CPA holds a supplier strictly liable for the supply of defective goods and for the harm resulting from inadequate instructions or warnings being given to the consumer whether the supplier was negligent or not. Although, there are exceptions to this strict liability.

But the consequence of non-compliance with the CPA for a supplier attracts a possible fine or imprisonment for a period not exceeding 12 months or both a fine and imprisonment. 

The National Consumer Tribunal may also impose administrative fines for prohibited or required conduct. An administrative fine imposed in terms of the CPA may not exceed the greater of:

Section 60 of the CPA deals with the safety, monitoring and recall of goods that are found to be defective and hazardous. Where the National Consumer Commission (NCC) reasonably believes that goods are unsafe or hazardous and that the supplier fails to take adequate measures to notify consumers of the defect or to recall the goods, the NCC may give written notice to the supplier to conduct an investigation into the nature, causes, extent and degree of risk posed to the public and to carry out a recall programme. A supplier may apply to the Tribunal to have the notice set aside entirely or in part. Voluntary product recall can be initiated by a supplier when it becomes aware of safety issues relating to products supplied. In a voluntary recall, suppliers must notify the NCC when they initiate the recall.

To avoid liability, South African entrepreneurs should adopt the following best practices:

Disclosing product defects is crucial for businesses to avoid liability under the CPA. Transparency builds trust, prevents harm, and avoids hefty penalties. Prioritising product safety and clear communication is also essential for responsible business practice.

The primary legal framework for data protection in South Africa is the Protection of Personal Information Act (POPIA). This act regulates how personal data, including customer contact information, should be collected, stored, and processed. The POPIA aims to protect individuals' privacy by ensuring that personal information is handled responsibly and securely.

Key Principles of POPIA

POPIA establishes eight key principles that must be followed when collecting and processing personal data:

Steps to Lawfully Collect Customer Contact Information

1.  Obtain Explicit Consent

Before collecting any customer contact information, ensure that you obtain explicit, informed consent. This can be done through a clear opt-in process on your website, mobile application, or during face-to-face interactions. You must inform your customers of what information you will collect, how it will be used, and any third parties with whom it may be shared.

For example, when a customer fills out a contact form on your website, provide a checkbox for them to consent to the collection of their personal information. This ensures that they are aware of how their data will be used.

2.  Collect Only Essential Information

POPIA emphasises data minimisation, meaning you should only collect the information necessary for the purpose at hand. If you are simply collecting customer contact details for a newsletter, it may only be necessary to ask for an email address and name. Avoid asking for excessive information unless absolutely required.

3.  Securely Store Customer Contact Information

Once you have collected customer contact information, storing it securely is paramount. Under POPIA, businesses are required to implement measures to prevent unauthorised access, loss, or damage to personal data. Here are a few strategies:

4.  Implement Data Retention Policies

You should establish clear policies regarding how long customer contact information will be retained. POPIA stipulates that personal information should not be kept longer than necessary for the purpose it was collected. For example, if a customer unsubscribes from your email list, their information should be deleted promptly, unless required for legal or accounting purposes.

5.  Provide Customers with Access to Their Information

POPIA grants individuals the right to access their personal information and request corrections if the information is inaccurate. As part of your customer service, ensure that customers can easily request their information, and if necessary, update it.

6.  Educate Your Team on Data Protection

It is essential that all employees involved in handling customer contact information are educated about POPIA and the importance of data protection. Training your team will ensure that everyone is on the same page when it comes to processing and safeguarding customer data.

Conclusion

In the digital age, protecting customer contact information is not just a legal obligation but also a business imperative. By adhering to the principles set out by POPIA and implementing secure practices for data collection, storage, and processing, entrepreneurs can build trust with their customers and avoid costly legal issues. Make sure you stay informed about the latest developments in data protection law to ensure your business remains compliant.

A business must be compliant with the Protection of Personal Information Act (POPIA) by ensuring that it complies with provisions of this law that regulates how personal information is collected, stored, processed, and disclosed. Online stores handle sensitive customer payment data and are just as accountable as regular stores to take the necessary precautions to protect consumers’ payment data by implementing security measures, obtaining informed consent, and being transparent about the purpose of the data usage. 

Personal information is defined in POPIA as any information that can be used to identify a living person or a juristic person, which includes information about a person's identity, history, and preferences.

Customer payment data is any personal or financial information collected from a credit card, debit card or other payment method, which also includes but is not limited to a cardholder's account number, card expiration date, and CVV code.

The definition of personal information includes information relating to the financial history of the person. This therefore means that payment data, such as credit card details, bank account information, and billing address, generally constitutes personal. 

A condition in POPIA for collecting and processing information, is Condition 2: Processing Limitations. Personal information can only be processed by a responsible party with the data subject's consent.

Condition 3: Purpose Specification of POPIA states that data subjects may not grant blanket consent for the processing of their Personal Information. The Responsible Party is obligated to disclose the specific purpose for which the information is being collected, hence consent must be “specific” according to the POPIA definition.

For online stores, this means gathering only the information required to process transactions and fulfil orders. Storing excessive or unnecessary data increases compliance risks and potential exposure to data breaches.

It is important to also note that if records are to be kept for longer than the prescribed period, consent needs to be obtained for that purpose.

Robust security measures designed to protect customer payment data from cyber threats, hacking, and unauthorised access must be implemented, may include:

POPIA allows for personal information to be outsourced to third parties. The responsibility party collecting the data is responsible and must be accountable for the information being passed on to third parties. The responsible party must instruct and ensure the third party (called an “operator”) complies with all POPIA requirements when processing the data by having a contractual agreement which manages the transfer and security of the data. The POPIA compliance accountability and responsibilities cannot be outsourced or transferred.

Failure to comply with POPIA can lead to severe consequences, including:

To enhance security and maintain compliance, online stores should:

Safeguarding customer payment data is not only a regulatory requirement under POPIA but also a fundamental aspect of building customer trust. By prioritising compliance, online stores can mitigate risks, avoid substantial penalties, and reinforce their reputation in the market.

What is a Beneficial Owner?

The “Beneficial Owner” of a company is an individual who directly or indirectly, owns 5% or more of that company, or exercises effective control of that particular company, by:

- holding beneficial interests in securities of that company.

- exercising, or controlling the exercise of, voting rights associated with the securities of the company.

- exercising, or controlling the exercise of, the right to appoint or remove members of the board of directors of the company.

- holding beneficial interest in the securities, or the ability to exercise control, including through a chain of ownership or control of a holding company of that company.

- being able to materially influence the management of that company.

What must you do?

You must identify the Beneficial Owners of your business, collect their information, and record it in a Register to be filed with CIPC. All security requirements applicable to personal information should be adhered to.

For each beneficial owner, you must capture the following information in the register:

- their full name, Identity number or registration number, and date of birth.

- business or residential and postal address.

- email address.

- confirmation of their participation and the extent of the beneficial interest in the business.

The Register must be submitted to CIPC on behalf of your business by no later than October 2023.

Thereafter, the Register must be regularly updated as needed and audited annually. Any changes to beneficial ownership must be captured in the register as soon as possible and no later than within ten business days of the change. Your updated Register can be submitted with your business’ annual returns by yourself or your accountant.

If you are required to complete a Beneficial Ownership Register, not doing so is an offence in terms of the Companies Act which may result in the imposition of an administrative penalty on your business. It is therefore imperative that you ensure compliance with CIPC’s requirements.