EnterraHost
Every domain registration publishes a record called WHOIS, and it used to contain the registrant's name, address, phone number and email. WHOIS privacy replaces those details with the registrar's, so the domain still has a public record but it no longer identifies you.
The useful thing to know before you buy anything is that a lot of this has already happened without you asking. What is published today varies enormously by extension, and on some it is nothing at all.
What is actually public right now
Rather than describe the general case, it is worth checking your own domain. Look it up in a public WHOIS tool and read the registrant block.
On .co.za, which is most domains registered in South Africa, the answer is not a setting at all. The registry itself withholds the registrant's name, address, phone number and email address from every WHOIS record it publishes. What comes back is the country, the organization name for a company, and a request to contact the registrar's data service for the rest.
It is not optional and there is nothing to turn on or off. It applies to every .co.za domain regardless of which registrar holds it — a check of large unrelated domains on the same extension returns exactly the same redacted shape. There is no privacy service to buy because there is no published detail left to hide.
This is worth stating plainly because the question people ask is "should I pay for WHOIS privacy", and on a .co.za the answer is that the choice was never yours to make. It is handled at the registry and it applies to you automatically.
On .com, .net and .org, the default depends on where the domain is registered and who registered it. Since GDPR, registrars have been obliged to redact personal data for individuals, but a business registration can still publish a name, a phone number and a country.
So the honest answer to "do I need WHOIS privacy" is that it depends on the extension, and on whether your details are already hidden.
What the toolbox shows
The Domains page carries a WHOIS column, and it tells you which of the three situations you are in rather than leaving you to find out.
Private by default means the registry already withholds your contact details and there is nothing to turn on. A .co.za domain shows this, and it is good news rather than a missing feature.
Public / Private as a toggle means the registry supports WHOIS privacy and you are in control of it. Turning it on hides the registrant contact details from the public record.
Not offered means the registry does not provide the service at all. Nothing is wrong with your domain, and there is no setting anywhere that changes it.
Turning it on
Where the toggle is available, click it. The change is sent to the registry and the column updates once the registrar confirms it, so the state you see is the state at the registry rather than a local guess.
There is no charge for this. WHOIS privacy is included rather than sold as an add-on, which is worth knowing if you have been quoted for it elsewhere.
When to leave it alone
There are two situations where hiding your details is the wrong answer rather than the safer one.
The first is a domain you are using for business, where a customer checking that you are real finds only a redaction notice. That is a small trust cost and it is real. Publishing a business address is a normal thing for a company to do, and some businesses deliberately keep their WHOIS open for exactly that reason.
The second is a domain you are about to transfer or resolve a dispute over, where a registry or a dispute body may need to reach the registrant. The details are still available to them through the registrar's data service, but it takes longer, and a straightforward problem can become a slow one.
Neither is an argument against privacy. They are the reasons it is a choice rather than a default you should accept without thinking.
What privacy does not do
It does not hide that the domain exists, who the registrar is, or when it expires. None of that is personal and none of it is covered.
It does not make you anonymous either. The registrar holds your real details, they are disclosed to anyone with a legitimate legal claim, and the whole arrangement is a redaction rather than a secret.
And it does not protect your inbox from spam on its own. If your email address appears on your website and in search results, hiding it in WHOIS removes one source among many. Business email on your own domain is a better answer to that problem, because it gives you an address you can change or retire without moving the domain.