In this article
Imagine this – an invented business, not a real one.
A courier business in Bloemfontein has grown from two bakkies to nine in three years. Customer details live in the owner's phone, a booking form on the website and a busy WhatsApp group. Drivers log deliveries on a shared spreadsheet; the accounting system knows about invoices, but not about late drops or damaged parcels. Then a customer emails to ask what personal information the business holds about her – and to have it deleted. Nobody is quite sure where to look.
The business runs on data. It just never decided how.
Not just for big companies
Small businesses aren't short of ambition with data and technology; they're short of time, money and know-how. In Xero's 2024 small business report, the top barriers to adopting new tech were cost (66%), a skills gap (65%) and not knowing how to get started (41%).1 A year later, 35% of businesses in Xero's 2025 survey said they had struggled to integrate new technology into their existing systems, and 38% cited a lack of resources to embrace new technology.2
That's exactly why a small business needs a data strategy: not a 40-page document, but a few clear choices that stop every new app from becoming another island of data.
Without those choices, data piles up by accident. A new booking tool here, a loyalty app there, a spreadsheet a manager built over a long weekend. Each one seemed like a good idea at the time. Together they create duplicate customer lists, numbers that never quite match and personal information scattered across devices nobody is keeping track of.
POPIA has made data everyone's business
The stakes are rising. The Information Regulator received 2 374 security compromise notifications in the 2024/25 financial year, a 37% increase on the year before.3 Under POPIA, the Regulator can impose administrative fines of up to R10 million.4 Owners have noticed: 45% of South African SMBs in Sage's 2024 research named data and privacy risks as a concern when it comes to AI.5
Good data strategy and good privacy practice turn out to be the same habit: know what you hold, keep only what you need, and know who can see it. (This is general information, not legal advice.)
In practice, that means a few unglamorous questions. Why are we collecting this? Do customers know? Where is it stored, and who has the password? How long do we keep it? What happens if a phone with the customer list on it is left in a taxi? Writing the answers down is the start of a strategy, and it should make the next request from a customer, or from the Regulator, easier to handle. On its own, it doesn't make a business POPIA-compliant.
Your one-page data strategy
Take a single sheet of paper and fill in four boxes.
Questions: what do we need to know?
List the three to five decisions you want data to help with – which customers are most profitable, which routes run late, when to hire. If data doesn't serve a question, think twice before collecting it.
Sources: where does it live?
Make a simple inventory: accounting system (Xero, Sage, QuickBooks or Excel), point-of-sale, booking form, spreadsheets, WhatsApp groups, staff phones. For each, note what personal information it holds. Most owners are surprised by how long the list is.
Rules: who owns it?
Give each source an owner and agree on one “source of truth” for customers, products and prices. Decide who can see what, and remove access when people leave. By default the business owner or CEO is your Information Officer under POPIA, and they need to be registered with the Information Regulator. Check with a qualified adviser what else applies to you.
Roadmap: what comes first?
Pick one quick win for the next 90 days – connecting the booking form to the accounting system, say, or moving customer details off personal phones. Then the next. Small, finished steps beat a grand plan that never starts.
Small, finished steps beat a grand plan that never starts.
Start where you are
A data strategy doesn't need new software, a consultant on retainer or a data warehouse. It needs an owner who decides, on purpose, what the business will know and how it will look after what it holds.
Back in Bloemfontein, our imaginary courier owner now has one customer list instead of three, and a single page on the office wall explaining where everything lives. When the next customer asks what's held about her, the answer takes five minutes.