The legal picture for Leachie — read once, then act on the last section

Canonical source: biz/legal/LEGAL-PLAN.md — edit the markdown, re-run npm run sync in workspace-site, rebuild, redeploy. The A4 PDF is the client's copy and has the internal notes stripped.

Status: VERIFIED 2026-08-10 against the Acts themselves, the Information Regulator, SARS, the HPCSA ethical rules and the City of Cape Town by-law. Every claim below carries a source in the section's own footer. Still not legal advice — three items genuinely need a professional and are marked 🔴; everything else you can do yourself.

An earlier draft of this file was wrong in five places. The corrections are listed at the end, because two of them change decisions: the VAT thresholds moved on 1 April 2026, and turnover tax is not available to you at all.

You run a one-person web business in South Africa whose clients are mostly healthcare practitioners in private practice. That produces four areas of law that touch the work, a fifth about you personally, and one — the HPCSA — that constrains your own marketing.

---

1. POPIA — other people's information

The written-contract duty is your client's, not yours. POPIA s21(1) says the responsible party "must, in terms of a written contract" ensure the operator maintains s19 security measures. You are the operator. If the agreement is missing, they are in breach, not you. s20, which is the operator's own duty, has no writing requirement at all — just process only with their authorisation, and keep it confidential.

That inverts the sales framing, in your favour: the operator agreement is something you provide so that they comply. That is both accurate and a better line than "the law makes me do this".

Your operator exposure is narrower than it looks. A genuinely static site whose only contact route is a mailto: or WhatsApp link involves no processing by you whatsoever — the message goes browser-to-client and never touches your infrastructure. The operator analysis only really bites on the Supabase-backed editor sites (you hold the client's credentials and content) and the Paystack site. So you need operator paperwork for two or three engagements, not five. This is worth protecting: the temptation to add a contact form that emails you a copy is the one change that would convert a clean position into a real one, and on a psychologist's site that is not a convenience decision.

You are already the Information Officer, and there is nothing to appoint. Information Officers "are, by virtue of their positions, appointed automatically". For a private body that is a natural person, the IO is the person carrying on the trade — you, by operation of law. No Deputy is needed or even possible, because only employees can be designated as one.

Registration is free, and takes one form. The Regulator calls it compulsory (Guidance Note ¶6.6, statutory hook s55(2)) and there is no fee anywhere in the Act, the Regulations or the Guidance Note. Do it at eservices.inforegulator.org.za, and refresh the particulars annually (¶11.1). Worth knowing but not worth arguing about: POPIA creates no offence for failing to register — s107's offence list omits it — so commentators differ on whether the Guidance Note overstates the Act. It costs nothing and takes ten minutes, so the argument is academic.

There is no 72-hour rule. POPIA is not GDPR. s22 requires notification "as soon as reasonably possible after the discovery of the compromise". Delete any 72-hour language from anything you write. And note the split: as operator your duty is s21(2) — tell the client immediately. Telling the Regulator and the data subjects is their duty as responsible party, and they cannot do it if you have not told them.

s19 is an ongoing duty, not a setup task. s19(2)(c) and (d) require you to regularly verify that safeguards are effectively implemented and to continually update them. A one-off configuration does not satisfy it; a recurring calendar slot does.

POPIA does not actually require a published privacy notice — s18 requires that the data subject be made aware of the listed matters, and a published notice is just the practical way to do that. But you need one anyway, by two other routes: ECTA s43(1)(p) expressly requires a privacy policy on a site that sells, and PAIA s51 requires a manual (see §5). So the conclusion holds even though the citation was wrong.

One thing not previously on the list: cross-border transfer. Cloudflare and Supabase put personal information outside South Africa, and POPIA s72 restricts that. The obligation is certain even though I have not read s72's exact grounds; practically it is handled by recording the transfer in the operator agreement and in the s18 notice, and relying on the hosts' own data processing terms. Thirty minutes.

Sources: POPIA ss 1, 18, 19, 20, 21, 22, 55, 72, 107 — gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf, sectioned at popia.co.za. Guidance Note on Information Officers (1 April 2021) — inforegulator.org.za/wp-content/uploads/2025/07/Guidance_Note_on_Information_Officers_.pdf. Registration: eservices.inforegulator.org.za.

---

2. Copyright — who owns the sites you build

Correction to what I told you earlier: you may not own the code. I said you own everything by default. Half of that is right.

The commissioned-work rule genuinely does not cover websites — s21(1)(c) is a closed list: photograph, portrait, gravure, cinematograph film, sound recording. No computer programs, no literary works, no websites. So "the client paid, therefore the client owns" is wrong as a general proposition. (One edge worth knowing: if you commission photography for a client's site, s21(1)(c) means the commissioner owns that photograph — so get right who places the order.)

But a website is a bundle, and computer programs have a special author rule. For a computer program the "author" is "the person who exercised control over the making" of it — not the person who typed it. In Haupt t/a Softcopy v Brewers Marketing Intelligence the SCA held that control is wider than employment and can apply to an independent contractor's work: a commissioning party who instructed and directed the development was the author, and first owner, with no written assignment at all.

So the honest default is: you almost certainly own the design, copy and artistic elements; ownership of the code depends on how hands-on the client was. A client who hands over a brief and waits leaves you as owner. A client who specifies behaviour with you week by week may already own the program. Neither side should rely on the default — which is the whole argument for the clause.

Assignment must be in writing and signed by the assignor — you. s22(3). The client need not sign for the assignment to be effective, though they should sign the contract. And two subsections make a clean job possible:

• s22(5) — you can validly assign copyright in a future work, one you have not built yet. So you sign once, up front, and it takes effect on payment. No separate document at the end.
• s22(4) — a non-exclusive licence can be oral or inferred and is revocable at any time except as a contract provides. So the "you can use it until you pay" understanding is weak unless written.

s20 moral rights (paternity and integrity) are not assignable — you keep them whatever the contract says.

Third-party material is the sharper edge. You cannot transfer rights you never had, and a clause purporting to is a warranty you will breach. REGISTER.md lists two unconfirmed film/photography licences shipping on a live client site and licensed fonts in a replica build. Those are the most concrete legal exposures in the business, ahead of anything statutory, because they involve identifiable rights-holders who enforce.

Watch, but do not act on: the Copyright Amendment Bill would make commissioned-work ownership governed by contract with a default to the commissioner. It is not law — the Constitutional Court's 26 June 2026 judgment read in s19D and declined the rest on procedural grounds. The 1978 Act as amended is the operative law.

Sources: Copyright Act 98 of 1978 ss 20, 21, 22 — gov.za/sites/default/files/gcis_document/201409/act-98-1978.pdf. "Author" of a computer program: Copyright Amendment Act 125 of 1992 s1(d). Haupt t/a Softcopy v Brewers Marketing Intelligence [2006] ZASCA 40 — saflii.org/za/cases/ZASCA/2006/40.html.

---

3. Consumer Protection Act — your contracts with clients

Assume it applies to every client. The R2 million threshold (asset value or turnover) excludes only juristic persons. A natural person is never excluded, at any income — so a psychologist practising in her own name is covered in full, and a small (Pty) Ltd under R2m is too. Maintain one compliant set of terms, not two.

Month-to-month is the right call, for a different reason than I gave you. s14(1) excludes transactions between juristic persons — and you are a natural person, so that exclusion does not help you at all. What actually keeps s14 switched off is that s14(2) applies only "if a consumer agreement is for a fixed term". No fixed term, no s14. That single design choice is doing real work, so resist selling annual plans for cash-flow reasons.

If you ever do sell a fixed term, all of this switches on: a 24-month cap; the consumer's unwaivable right to cancel on 20 business days' written notice; your own right to cancel only 20 business days after notice of a material failure; a 40–80 business day pre-expiry notice window that is easy to miss; automatic month-to-month continuation on expiry; and a cancellation penalty that must be reasonable and referable to what you actually gave — not the balance of the term. Note s14(3)(b)(i) expressly contemplates recovering discounts granted in contemplation of the full term, which is the one place a founding-discount clawback would be plainly authorised.

Three traps that appear in almost every developer's terms:

1. You may not exclude liability for gross negligence. s51(1)(c)(i) prohibits it outright. The near-universal "we accept no liability whatsoever for any loss" clause is void on its face. Cap ordinary negligence instead, and say expressly that nothing limits liability for gross negligence.
2. A cap you did not flag conspicuously does not bind. s49 requires any limitation, assumption of risk, indemnity or acknowledgement of fact to be drawn to the consumer's attention conspicuously, in plain language, before they sign or are required to pay — with a signature or initial for unusual risks. A cap buried in clause 14 of an unopened PDF fails, and s48(2)(d)(ii) independently makes it unfair. This is about presentation, not wording, and it is the cheapest compliance win available.
3. No "no representations were made" clause. s51(1)(g) voids entire-agreement boilerplate that goes that far.

Also: s51(1)(b) voids any waiver of CPA rights; s22 requires plain language throughout (the way care-plan-terms.md is written is closer to compliant than a dense ToS would be); s50(2)(b) requires you to give the client a free copy of a written agreement, and it binds whether or not they sign. And s54 — the right to services of the quality one is generally entitled to expect, with a remedy or partial refund — is what a dissatisfied client actually reaches for, and cannot be excluded.

Sources: CPA 68 of 2008 ss 5, 6, 14, 22, 48, 49, 50, 51, 54 — gov.za/sites/default/files/gcis_document/201409/32186467.pdf. Threshold: GN 294, GG 34181, 1 April 2011. Regulations GNR 293 of 2011 reg 5.

---

4. ECTA — what leachie.com must say now that it takes payment

s43(1) applies, and non-compliance hands every buyer a refund right. If you fail s43(1) or s43(2), the consumer may cancel within 14 days of receiving the service and you refund everything. For a service there is nothing to return, so a non-compliant checkout is an unconditional 14-day refund window on every sale.

The disclosure list is (a)–(r): full name and legal status, physical address and phone, website and email, any accreditation bodies and codes of conduct, a sufficient description, the full all-in price, manner of payment, terms that can be stored and reproduced electronically, delivery timing, how the client can keep a record, return/refund policy, dispute-resolution codes, security procedures and privacy policy (p), the minimum duration for recurring services (q) — for the care plan, "month-to-month, no minimum term" — and the consumer's s44 rights (r).

(f) does not apply to you. It requires a registration number and office bearers "in the case of a legal person". A sole proprietor is not a legal person. This is the provision people wrongly cite as forcing CIPC registration.

s43(2) needs a review-and-confirm step before payment, with a way to correct mistakes and to withdraw. A one-click buy with no review breaches it.

s43(5)–(6): the payment-security liability is yours, not Paystack's. You must use a sufficiently secure payment system, and you are liable for damage a consumer suffers if you don't. Using Paystack's hosted/embedded flow is how you discharge it — so never proxy it, never log card data, never build your own.

The cooling-off exclusion I gave you was the wrong one. s44 gives seven days from conclusion of the agreement for services. The exclusion to rely on is s42(2)(d) — services which began with the consumer's consent before the end of the seven-day period. The made-to-specification exclusion, s42(2)(f), is expressly about goods, so do not lean on it for a bespoke build. The practical consequence is one sentence in the contract: written, dated consent to begin work immediately — and then actually begin. That converts an arguable position into a clear one.

s46(1) is the provision nobody mentions, and it bites on every build. A supplier "must execute the order within 30 days after the day on which the supplier received the order, unless the parties have agreed otherwise" — and if you miss that, s46(2) lets the consumer cancel on seven days' written notice. A website build routinely runs past 30 days, so the fix is simply to agree otherwise: put an expected delivery date in the scope document and have the contract adopt it. service-agreement.md §6 does this from v2.0; v1.0 was silent and therefore exposed.

Keep separate in your head: ECTA s44 (7 days, electronic transactions) is not CPA s16 (5 business days, and only where the sale resulted from direct marketing). If you cold-email to win work, s16 is a separate right and s42(2)(d) does not switch it off.

Sources: ECTA 25 of 2002 ss 42, 43, 44 — gov.za/sites/default/files/gcis_document/201409/a25-02.pdf. CPA s16.

---

5. You, personally — tax, liability, and the paperwork you're missing

Income and provisional tax — as expected. Business profit is taxed in your personal hands at marginal rates. For the 2027 year of assessment the first bracket is 18% up to R245 100, the primary rebate is R17 820 and the tax threshold under 65 is R99 000.

You are a provisional taxpayer from the first rand. The exclusion people reach for is only available to someone who "does not earn any income from carrying on any business" — you carry on a business, so amount is irrelevant. There is no registration process: add provisional tax to eFiling and request the IRP6 yourself. Dates for a February year-end: 31 August (first), last business day of February (second), September (optional top-up). The trap worth respecting: if the second-period return is not in within four months of year-end you are deemed to have estimated nil, which guarantees an under-estimation penalty.

🔴 The VAT figures I gave you were stale — they changed on 1 April 2026. Compulsory registration is now R2.3 million (was R1m); voluntary is R120 000 (was R50k). The rate is 15% — the announced increases to 15.5% and 16% were reversed. Also note s23(1) has a forward-looking limb: registration is triggered where there are reasonable grounds to believe the threshold will be exceeded, classically evidenced by a single large written contract. Stay unregistered until you approach R2.3m.

🔴 Turnover tax is not available to you at all. Not "probably a bad idea" — disqualified by definition. The Sixth Schedule's "professional service" list expressly includes information technology, SARS's own guide defines that to include software design and development, and its worked Example 4 names computer software development directly. For a natural person the 20% cap applies to professional-service income, and essentially 100% of your receipts are that. The R1m micro-business ceiling is irrelevant. Delete it from consideration.

🔴 A solo (Pty) Ltd would probably raise your tax, not lower it. Small Business Corporation relief under s12E carries the same "personal service" disqualification — and the escape hatch requires three or more full-time employees who don't hold an interest in the company. So a one-man web-development company pays 27% flat, plus 20% dividends tax on distribution: about 41.6% on distributed profit, against your current 18–31% marginal until roughly R530 000. There's a further trap: the Fourth Schedule "personal service provider" rules catch a company earning more than 80% of its service income from one client, forcing PAYE withholding on payments to it.

And the liability argument for incorporating is leakier than it sounds — s77 and s218(2) impose personal liability on directors in defined circumstances, and in practice a small company's director signs personal suretyships anyway. For a business whose main risk is professional negligence, insurance separates risk better than incorporation does. Incorporate when a client or tender requires a company, when you hire, when you'd hold client money, or when you want to sell or bring in a co-owner — not on general "companies look professional" grounds.

🔴 You are missing a legal obligation: the PAIA manual. PAIA s51 requires every private body to have one, and "private body" includes a natural person carrying on a trade or profession — a sole proprietor. The Minister's exemptions for small private bodies lapsed on 31 December 2021 and were not renewed, so since 1 January 2022 every private body must have a manual, at its premises and on its website. The Regulator publishes a template, it shares content with the IO registration, and Guidance Note ¶11.2 requires the particulars to match. Do both in one sitting. Enforcement against a one-person business is unlikely, but it is a real obligation and an hour's work.

"t/a Leachie" needs no registration and none exists. The Business Names Act 27 of 1960 was repealed by the Companies Act, and its intended replacement — CPA ss 79–81 — was never brought into operation. So there is currently no business-name registration regime in South Africa. Put "Daniel Slater t/a Leachie" on invoices and contracts anyway: a sole proprietorship is not a legal person, you contract personally, and the counterparty must be able to identify who they are dealing with. Re-check the ss 79–81 status yearly; it changes by proclamation without fanfare.

Professional indemnity insurance is not legally required — what makes it necessary is client procurement terms, and your own unlimited personal liability. Get PI (negligent work) and cyber (breach response, forensics, notification, ransomware) quotes; public liability is near-irrelevant to a desk business. Two cautions: POPIA administrative fines are generally not insurable, so ask the broker to point at the wording rather than accepting "we cover POPIA"; and insurers price better when you have a written contract with a liability cap — so §2 and §3 work pays for itself here. I could not find dated SA-specific 2026 pricing for IT professionals, so get two or three real quotes rather than trusting any figure, including broker-published ones.

No municipal approval is needed. Under the City of Cape Town Municipal Planning By-Law 2015, "home occupation" is an additional use right in residential zonings — a right you have as of right, no consent application. The item 23 conditions (as amended 1 October 2025) that bind you are trivial: stay under 75 m² or 50% of floor space, no goods displayed publicly, at most one un-illuminated sign ≤ 0.2 m², no nuisance. The parking requirement and the 08:00–17:30 trading hours both fall away by their own terms because you have no visiting clients. The Businesses Act 71 of 1991 licences food, health and entertainment premises and hawking — not a web office.

Sources: SARS individual rates (2027 YOA) — sars.gov.za/tax-rates/income-tax/rates-of-tax-for-individuals/. Provisional tax — sars.gov.za/types-of-tax/provisional-tax/. VAT thresholds and rate — sars.gov.za/types-of-tax/value-added-tax/. Tax Guide for Micro Businesses (Issue 3), "professional service", Annexure A, Example 4 — sars.gov.za/wp-content/uploads/Ops/Guides/LAPD-IT-G17-Tax-Guide-for-Micro-Businesses.pdf. s12E / personal service provider — SARS Tax Guide for Small Businesses §§3.2.15, 3.2.18. PAIA 2 of 2000 ss 1, 51, 90; exemption lapse 31 Dec 2021; templates at inforegulator.org.za/paia/. Companies Act 71 of 2008 ss 19, 22, 77, 218. City of Cape Town Municipal Planning By-Law 2015 item 23.

---

6. The HPCSA question — and the answer is better than I thought

A named case study with website performance results is workable. This was the item most likely to block the founding-discount model, and it does not.

Advertising is permitted. The 2009 amendment rewrote Rule 3(1): a practitioner "shall be allowed to advertise" provided the advertisement is not unprofessional, untruthful, deceptive or misleading. The old blanket prohibition is gone.

It is not canvassing. The defined term requires "direct contact with prospective clients" — its examples are letters, pamphlets, circulars, all pushed to identified people. A case study sitting on leachie.com that a reader finds by choice is pull, not push. Rule 3(2)'s canvassing limb is not engaged.

It is not touting. That term targets "offers, guarantees or material benefits" outside the category of professional services — the HPCSA's own example is an air-conditioned waiting room. Page-speed and enquiry counts are none of those.

But Rule 76 does apply, and that is where the real constraint sits. A psychologist who "engages others to create or place a public statement that promotes his or her professional practice ... shall retain professional responsibility for such statements", and Rule 3(1) extends to advertising she merely "permit[s], sanction[s] or acquiesce[s]" in. So the right question is not "may Daniel publish this" — you are not registered and no rule binds you — but "would this be compliant if she had published it herself?" Build to that standard and her registration is safe.

What is dangerous is the framing, not the numbers. Facts about a website are fine. Claims about her practice or her clinical results hit Rule 75(2)(f) — "the clinical or scientific basis for or the results or degree of success of his or her psychological services" — and the canvassing definition's "superior quality of service":

• ✅ "Enquiry-form submissions rose from 4 to 11 per month between March and June 2026 (site analytics). Largest Contentful Paint improved from 4.1s to 0.9s."
• ❌ "Now the busiest practice in the Southern Suburbs." "More people than ever are getting the help they need." "Patients say she's the best."

Also prohibited, regardless of consent: soliciting testimonials from a current client (Rule 76(d)); displaying patient reviews that assert superior qualities (Booklet 16 ¶10.4 gives "the best health practitioner in the country" as the example); any superlative or comparative claim; guarantees, discounts, free consultations or competitions as touting; and publishing any patient information — no names, no quotes, no screenshots of an inbox or booking system with real people in them, and no analytics screenshots showing identifiable data. Fee advertising is permitted if accurate. Use her registered title exactly — clinical, counselling or educational psychologist as registered.

The ten things that make it safe: written consent to the exact final wording, retained on file (her Rule 76 responsibility is unavoidable, so her documented review is the control that discharges it); every metric framed as a website metric with its source and period; no clinical content; no testimonials, reviews or patient information; no superlatives; no fees unless hers to state; her registered title exactly; disclose that she received a reduced fee — the direct analogue of Booklet 16 ¶10.6's disclosure duty, and the cheapest single risk reduction available; keep it on your domain framed as your work product ("what I built for X") rather than as promotional prose about her practice; and give her a standing right to require correction or removal, since Rule 76(e) obliges her to correct misrepresentations and she needs the practical means to comply.

Your exposure is reputational and contractual, not regulatory. Breach would be hers — a Professional Board conduct inquiry under Chapter IV, with outcomes from caution to removal from the register. You'd lose the client, the reference and the case study, and face a claim if you warranted compliance. Which is why the incentive to get it right is yours even though the licence is hers.

🔴 Where it is genuinely untested: there is no HPCSA ruling or published inquiry outcome on a third-party service provider's case study about a practitioner. Rule 76 is plainly the right lens and its text fits closely, but its application to a supplier's portfolio piece rather than an advertisement she commissioned is untested, and there are reasonable arguments both ways. With three founding clients' registrations at stake, de-risk it before the first publication: send a written query to the Professional Board for Psychology describing the proposed case study and asking whether it complies with Rules 3 and 76. It is free, and whatever comes back — including a non-answer — creates a paper trail showing good faith. Publish anonymised versions ("a Cape Town psychology practice") in the meantime; anonymised, none of this is engaged.

Sources: Ethical Rules of Conduct, GN R717 in GG 29079 of 4 August 2006 as amended to BN 510/2023 — Rule 1 definitions of "canvassing" and "touting", Rule 3, Rule 13, and the psychology Annexure Rules 24–34 and 75–78: hpcsa.co.za/Uploads/Legal/ethical_rules/ethical_rules_of_conduct_2019.pdf. Booklet 16, Ethical Guidelines on Social Media (March 2025) ¶¶10.2–10.7. Booklet 5, Confidentiality, §9.1.4. Health Professions Act 56 of 1974, Chapter IV.

---

Do this, in order

This week, and none of it needs a lawyer:

1. Chase the case-study permissions. Three discounts given for rights not on file. The email is drafted, and §6 above says what the copy may and may not claim.
2. Confirm the two image licences on berleinpsych.com — van IJken and the Droppert clip. They are live now. If the rights aren't there, replace the assets rather than wait to be asked.
3. Register as Information Officer at eservices.inforegulator.org.za. Free, one form, ten minutes. Diarise an annual refresh.
4. Write the PAIA manual in the same sitting, from the Regulator's template, with matching particulars. This is the obligation you didn't know you had.
5. Add the ECTA s43 disclosure block to leachie.com, plus a review-and-confirm step before payment. This closes the 14-day cancellation exposure.
6. Publish the privacy notice (it also discharges s43(1)(p)), and add the short one to each client site.
7. Correct the tax figures anywhere they appear: R2.3m / R120 000 / 15%, and turnover tax deleted as unavailable.

This month:

1. Get PI + cyber quotes at R1m and R2m, asking specifically how POPIA fines and breach-response costs are treated. Highest value per rand on this page.
2. Put the service agreement in front of Vicky Talbot — the next engagement, and the first that can be done properly rather than retrofitted.
3. Write the breach playbook, with the two different paths: as operator, tell the client immediately; as responsible party, tell the Regulator and data subjects as soon as reasonably possible. No 72-hour language.
4. Write the s19 measures note — one page, with a recurring review date, because s19(2)(c) and (d) are ongoing duties.
5. Move any client domains onto the client as registrant, and add registrant and handover terms to the contract. .za disputes go to ADR under ECTA s69, and a developer holding a client's domain would very likely lose there, at your cost.

Three things worth paying a professional for, in priority order:

1. 🔴 One hour on the contract template — still the highest-value legal spend available, but narrower than it was. On 10 August 2026 service-agreement.md went to v2.0 with every mechanism checked verbatim against the primary text of all three Acts, so the drafting is done and two questions are left: whether Daniel's signature on an emailed PDF satisfies s22(3) (ECTA s13(1) points at an advanced electronic signature where a statute requires one, and Spring Forest v Wilberry draws the by-law/by-parties line), and the half-up-front deposit against the s44 right where a client declines an immediate start. Take v2.0 to the attorney to mark up rather than asking for a draft.
2. 🔴 A written query to the Professional Board for Psychology (free) on the Rule 76 case-study point, before the first named publication.
3. 🔴 A tax practitioner on incorporation, only when a trigger in §5 actually arrives — and go in knowing s12E relief is likely unavailable to a solo IT company.

And two rules that need no paperwork at all: never route a client's payments through your own bank account, and if you ever subcontract, read LRA s200A and BCEA s83A first — the presumption of employment turns on control, economic dependence and hours, and getting it wrong means back-pay and unfair-dismissal exposure.

---

What the earlier draft of this file got wrong

Kept because knowing how it was wrong is worth more than a clean document.