Examining factors influencing business perceptions of online privacy and security risk in Central South Africa

Abstract

The rapid expansion of e-commerce in central South Africa has increased the importance of privacy and security issues for medium-sized enterprises. However, there remains a dearth of information on how business managers perceive and react to such matters. The purpose of this study is to examine the factors that influence how small and medium-sized enterprises (SMEs) in Central South Africa perceive online privacy and security risks. The purpose of the study is to pinpoint and examine the major factors that influence these perceptions, including organizational culture, managerial awareness, technology preparedness and regulatory environment. By doing this, the study seeks to improve knowledge of how SMEs perceive and react to online privacy and security issues, offering insights that can guide better approaches to controlling and reducing digital risks in the area. The study was underpinned by the Theory of Planned Behavior (TPB), Protection Motivation Theory (PMT) and the Technology Acceptance Model (TAM). These frameworks collectively guided the understanding of behavioural intentions, motivational processes and technology adoption in the study context. Thirteen managers and business owners from a variety of industries, including IT, retail, manufacturing, construction and consulting participated in semi-structured interviews to gather data. This study sought to examine how risk management practices are influenced by peer networks, infrastructure dependencies and adaptive learning. The results show that depending on cloud services from outside sources typically carries extremely high legal and geopolitical risks, which causes jurisdictional anxiety among medium-sized enterprises. Cybersecurity knowledge in central South Africa is primarily acquired through experience and anecdote-based word of mouth, rather than through formal education. This has resulted in skilled but technically limited responses. Medium sized enterprises in central South Africa demonstrate a high level of awareness of reputational risk and apply data minimisation practices to maintain client trust. This indicates self-regulation in situations of weak local regulation. The study highlights the interplay between infrastructural constraints, cultural issues and the availability of cybersecurity knowledge in influencing the responses of enterprises to privacy and security risks. It recommends that policymakers, local government authorities and development agencies implement targeted education and policy interventions to enhance resilience among SMEs in semi-urban economies, while also recognising the value of grassroots learning and adaptive governance in the local context.