For years, direct marketers in South Africa have organised their compliance, in conjunction with other compliance, around the Protection of Personal Information Act 4 of 2013 (POPIA).
The prescripts under POPIA are, on the face of it, quite straightforward. In that, before sending direct electronic marketing, a business needs either the data subject’s consent or, where the recipient is an existing customer, a business enjoys the limited benefit of the section 69(3) exception under POPIA, together with a standing right for the recipient to opt-out of such marketing at any time. To a certain extent, that is still the position. But there has, indeed, been a significant turn of events in this area as will be addressed later below.
From a general standpoint, section 69(1) of POPIA prohibits the processing of personal information for purposes of direct marketing by means of unsolicited electronic communications unless:
- the data subject has consented; or
- is an existing customer marketed to under section 69(3)
- has not objected to such marketing under section 69(3) or section 69(4) of POPIA.
What has now changed?
This status quo, as alluded to above, has recently been indirectly altered (in terms of its effect) by relatively new regulations in the consumer protection space.
The Consumer Protection Act Amendment Regulations of 2026 (Regulations) have, by its enactment, given further effect to section 11(3) of the Consumer Protection Act 68 of 2008 (CPA).
As a result, direct marketers now confront a more cumulative compliance regime. One overseen by a separate regulator, the National Consumer Commission (NCC). This is over and above the Information Regulator under POPIA (that may oversee such aspects from a POPIA standpoint- to the extent applicable). The NCC on the other hand carrying its own registration, fee and “database-cleansing” obligations.
Section 11(3) of the CPA provides the NCC with the right to establish, or recognise as an authoritative body, a registry in which any person may register a pre-emptive block, either generally or for specific purposes, against any communication that is primarily for the purpose of direct marketing.
What does this mean?
A pre-emptive block means that a consumer may electronically register a block (as a preventative measure) on the opt-out registry, the effect of which is that direct marketers are prohibited from sending that individual any further communications (including marketing material) until the block is removed. These Regulations therefore establishes a central, NCC administered Opt-Out Registry (Registry) which, undoubtedly, attach compliance obligations to it.
The previously “dormant” section 11(3) provision under the CPA now, accordingly, has teeth.
What do the Regulations require in terms of compliance?
The Regulations set out a compact framework of new concepts and duties that every direct marketer must now build into its compliance programme, namely:
- compliance with a central Registry through which any person may lodge a pre-emptive block against unwanted electronic direct-marketing communications, recording identifying details and the medium, time or channel to which the block applies;
- defined concepts of a “direct marketer” (any person who engages in direct marketing), an “electronic communication recipient” (a consumer who has registered a block), a “pre-emptive block”, and “cleansing” (the removal of blocked consumers from a marketer’s database);
- a requirement for every direct marketer to register with the NCC in the prescribed form and to renew that registration annually;
- a continuous obligation to cleanse marketing databases against the Registry at least monthly, and before each campaign, at a prescribed fee (currently R 0.12 per record requiring action);
- a requirement that the marketer be identifiable in every communication by name, electronic address, physical address and contact number; and
- an outright prohibition on marketing to any consumer who has registered a relevant pre-emptive block.
Two features of this scheme deserve particular attention
First, registration and cleansing are triggered by the activity of direct marketing, not by the marketer’s country of incorporation. A foreign-domiciled business marketing into South Africa online, with no local office, is not “outside the net” and should therefore take cognisance of the Regulations.
Second, the obligation to cleanse is not satisfied by having obtained Opt-In consent under POPIA at some earlier point. The Regulations require ongoing, periodic cleansing of the marketing database against the Registry, at least monthly and before each campaign, followed by suppression or restriction of every flagged record.
What happens to POPIA?
In short, nothing should change. As noted above, section 69(1) of POPIA prohibits the processing of personal information for the purposes of direct marketing. POPIA further sets out the conditions for lawful processing of personal information more broadly. Any processing of a data subject’s personal information for direct marketing must satisfy the eight conditions for lawful processing. POPIA has therefore generally been treated as the minimum, baseline standard that every responsible party must meet to ensure that it lawfully processes the personal information of its data subjects, with certain conditions also being passed on to operators.
The Registry governs a separate and more specific question, whether that particular consumer has exercised a statutory right to block that marketing, irrespective of any lawful basis the marketer may hold under POPIA.
These are therefore not competing regimes but complementary ones that regulate a distinct set of occurrences. It should therefore be noted that a lawful basis to market under POPIA does not dispense with the obligation to respect a pre-emptive block registered on the Registry. Thus, it is noteworthy to mention that POPIA also provides for the withdrawal of a data subject’s consent in terms of receiving communication such as marketing material. On this trajectory, having a consumer register a pre-emptive block on the Registry could, certainly, be construed as analogous to such a withdrawal of consent.
Given the potential overlap between the Regulations and POPIA, the legislation itself anticipates this overlap in regulatory compliance.
Section 2(9)(a) of the CPA provides that where a provision of the CPA is inconsistent with a provision of another Act, both apply concurrently to the extent that it is possible to comply with one without contravening the other. Section 2(9)(b) provides that, where concurrent application is impossible, the provision extending the “greater protection” to the consumer prevails.
The practical impact for your business is that compliance with one regime does not excuse non-compliance with the other. A business’s obligations under POPIA and under the Registry are cumulative and not in the alternative.
Importantly, a consumer who has registered a block can, in principle, still give fresh, marketer-specific consent to receive communications from a particular business, but should then remove the pre-emptive block from the Registry.
What direct marketers should be doing now?
For any business that markets directly to South African consumers, whether domestic or foreign, this means that compliance programmes built purely around consent capture and POPIA Opt-Out functionality may no longer be sufficient.
Registration as a direct marketer on the Registry, monthly cleansing of the marketing database against the Registry, suppression of flagged records before each campaign, and auditable records of every cleanse are now free-standing obligations that sit alongside, not instead of, existing POPIA compliance.
The key takeaway here is nonetheless straightforward. Direct marketing in South Africa would, in effect, now carry more onus, and POPIA compliance in and of itself will no longer do.
Registering with the NCC Registry, cleansing the marketing database regularly against the Registry, and monitoring compliance on an ongoing basis will, now, have to become part of the cost of doing business.
With the NCC having already opened the Registry for registration by both direct marketers and consumers, direct marketers ought to be taking proactive steps towards compliance. However, it remains to be seen when the NCC will communicate a deadline by which all direct marketers must be registered on the Registry. For now, each direct marketer should assess the impact that the Regulations will have on its operations and prepare to register on the NCC Registry.
This bulletin was authored by authored by Partner Venolan Naidoo, Associate Ferdinand Pike and Candidate Attorney Zahraa Aboo.
