South Africa
ECTA compliance, made simple
12 yes/no questions on the Electronic Communications and Transactions Act: what your website must tell customers, the seven-day cooling-off right, unsolicited messages, electronic contracts and signatures, and keeping records. You get a score for each area and a list of gaps with what to do about each one.
ComplianceDesk gives you 12 pre-built ECTA controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving ECTA compliance stops being a spreadsheet exercise.
Take the free self-assessment: a score for each area and a list of gaps to close.
What is ECTA?
12 yes/no questions on the Electronic Communications and Transactions Act: what your website must tell customers, the seven-day cooling-off right, unsolicited messages, electronic contracts and signatures, and keeping records. You get a score for each area and a list of gaps with what to do about each one.
- Official name
- ECTA Self-Assessment (Online Selling and Contracts)
- Status
- In force. Shown as in force as we understand it. Check the current text with the regulator or an attorney, since provisions can be amended or commence at different times.
Who it applies to
- Whether it applies to you depends on your size, activities and licences. Use the free "Which laws apply to me?" checker, or read the first section of the self-assessment.
- These apply if you sell goods or services to consumers through a website, app or other electronic means. Answer Not applicable if you do not sell online.
What you have to do
What your website must say
A business should be able to show that it can answer yes to these: Does your website show your full name, legal status, physical address, phone number, email, registration number and, where applicable, VAT number and membership of any professional body? Do you describe the goods or services, the full price including all costs and taxes, delivery costs, the payment methods and the delivery time before the consumer orders? Do you publish your terms and conditions, return and refund policy, and the security and privacy practices you follow, in a place the consumer can store or print? Does the consumer get a chance to review the order, correct mistakes and confirm it before they pay, and do you give an acknowledgement afterwards?
Cooling-off and cancellation
A business should be able to show that it can answer yes to these: Do you let consumers cancel an electronic transaction within seven days without giving a reason, and refund them? Do you apply the exceptions only where the Act allows, for example for goods made to the consumer's specification, perishable goods or services already started with the consumer's consent? Do you understand how the ECTA cooling-off differs from the Consumer Protection Act cooling-off for direct marketing, and apply the right one?
Messages, contracts and records
A business should be able to show that it can answer yes to these: Do you avoid sending unsolicited commercial messages, give a clear opt-out in every message, and honour opt-outs? Do you accept that a contract can be made electronically, and keep a record of the offer, acceptance and terms for each online sale? Where a law requires a signature, do you use a method that the Act accepts, and an advanced electronic signature where the law specifically requires one? Do you treat personal information collected online fairly and only as the customer agreed, in line with POPIA? Do you keep your website's terms, notices and records so you can show a regulator or the National Consumer Commission what a customer saw?
How to comply, step by step
- What your website must say. Add a clear 'About us' or footer section with every item, and keep it up to date. Show the price, any delivery fee and the expected delivery date at checkout, before payment. Publish the terms, returns policy and privacy notice, and let the consumer save a copy before they commit. Add an order review step and send a confirmation email with the order details.
- Cooling-off and cancellation. State the seven-day right in your terms and returns page, and refund promptly after cancellation. Answer Not applicable if you sell only to businesses. Check each exception in the Act before you list it in your terms, and keep the wording within it. See the Consumer Protection Act assessment. If the ECTA applies to a sale, the CPA direct-marketing cooling-off does not.
- Messages, contracts and records. Keep a suppression list, add an unsubscribe link, and see the POPIA assessment for direct-marketing consent. Log the terms version, date and time accepted for each order. Check which documents need an advanced electronic signature. A simple typed name may not be enough for those. See the POPIA assessment. Collect only what you need and say why. Version your terms and keep a dated copy each time you change them.
Sources and review status
Compiled from the public sources below. It is not legal advice and has not been reviewed by a lawyer. Last researched 2026-11-01. This is general information, not legal advice. Laws change, so check the current text and the regulator's notices before relying on it.
Every ECTA control, organised for you
The real control library ComplianceDesk seeds the moment you activate ECTA — 12 controls across 5 categories.
Electronic Transactions Validity
- ECTA-1.1 Electronic contracts and data messages treated as legally valid
- ECTA-1.2 Time and place of dispatch/receipt of data messages determined correctly
- ECTA-1.3 Advanced electronic signatures used where legally required
Consumer Protection in E-Commerce
- ECTA-2.1 Mandatory pre-transaction information disclosed to consumers
- ECTA-2.2 Cooling-off right for electronic transactions honoured
- ECTA-2.3 Unsolicited commercial communications (spam) rules followed
Data & Cybersecurity Provisions
- ECTA-3.1 Cybersecurity safeguards for critical data implemented
- ECTA-3.2 Critical database registration and protection (where designated)
- ECTA-3.3 Cybercrime offences under the Act mitigated
E-Government Services
- ECTA-4.1 Electronic filing and retention accepted per Chapter IV requirements
Domain Name (.za) Administration
- ECTA-5.1 .za domain names registered and administered per ZADNA rules
- ECTA-5.2 Domain name dispute resolution process understood and accessible
Frequently asked questions
How can I check where my business stands on ECTA Self-Assessment (Online Selling and Contracts)?
Take the free self-assessment. It scores each area, lists your gaps with what to do about each one, and does not say you are compliant. You can save the result to ComplianceDesk to turn each gap into a task with an owner and a due date.
Is this guide written by a lawyer?
No. It was assembled from the public sources listed below and has not been reviewed by a lawyer. Treat it as a starting point and check the current law before relying on it.
How many controls does ComplianceDesk track for ECTA?
12, organised into 5 categories, ready to assign to an owner as soon as you activate the framework.
Can I track ECTA alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up ECTA in ComplianceDesk?
Activating ECTA instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Other South Africa frameworks
See your full compliance picture
193 frameworks, one system of record.