01
Consent in one tool, ignored in another
Someone opts out by email and still gets the SMS, because consent lives in one system and campaigns run from another.
THE PROBLEM
Where compliance breaks in practice
02
No suppression list
People who refused or objected get contacted again. The Information Regulator's direct marketing guidance expects you to keep a record of them.
03
"Existing customer" stretched too far
The customer exception only covers your own similar products, and only if people could object when you collected their details and in every message since.
04
Data kept forever
Old lists and dormant profiles sit in every tool long after you need them. POPIA says not to keep records longer than necessary.
05
Data leaving the country unnoticed
Many engagement and analytics platforms are hosted abroad. That's allowed, but only on the conditions in section 72.
WHERE WE HELP
What POPIA asks of marketing teams
01
Consent for electronic marketing
To market by email, SMS or other electronic messages to someone who isn't your customer, you need their consent. You may ask once, in the prescribed form (Form 4). Section 69.
02
The existing-customer exception
You may market your own similar products to customers whose details you got in a sale, if they could object when you collected the details and can object in every message. Section 69(3).
03
Say who you are, every time
Every marketing message must say who it's from and how to ask for the messages to stop. Section 69(4).
04
Only what you need, only as long as you need it
Collect what's adequate, relevant and not excessive, and delete or de-identify records you no longer need. Sections 10 and 14.
05
Tell people up front
When you collect information, tell people what you're collecting, why, who receives it, whether it goes abroad, and what their rights are. Section 18.
06
Contracts with the platforms you use
Platforms that process data for you need a written contract requiring proper security, and must tell you immediately about a suspected breach. Sections 20 and 21.
07
Transfers abroad
Sending data to platforms outside South Africa needs a basis, such as adequate protection by law or a binding agreement, or the person's consent. Section 72.
STEP BY STEP
- 01Map where personal information lives across your tools, and where each tool is hosted.
- 02Decide the lawful basis for each use, and record consent on the customer profile, including the channel the person agreed to.
- 03Sync consent and opt-outs across every platform, and keep a suppression list of people who refused or objected.
- 04Set retention rules in each tool, so data you no longer need is deleted or de-identified.
- 05Limit access to the people who need it, and check your contracts with each platform cover security and breach notification.
- 06Document every transfer abroad and the basis for it.
- 07Test it: opt out as a customer and check every channel listens.
WORTH KNOWING
Not legal advice
This page summarises parts of POPIA and the Information Regulator's guidance to explain how we set platforms up. It isn't legal advice. For decisions about your obligations, speak to your legal adviser or Information Officer.
RELATED GUIDES
You might also want to read.
FAQS
The questions people ask us first.
Does POPIA apply to WhatsApp marketing?
Section 69 names email, SMS, fax and automatic calling, and the Information Regulator's direct marketing guidance adds other electronic examples such as push notifications and direct messages. Neither names WhatsApp. We treat WhatsApp marketing as needing consent, which Meta's own policy requires anyway.
Can we keep messaging customers who haven't opted out?
Only within the existing-customer exception: your own similar products, contact details obtained in a sale, and a chance to object when you collected them and in every message. The Regulator's guidance is clear that silence can't mean consent.
What are the penalties?
The Information Regulator can impose administrative fines of up to R10 million, and some offences under the Act carry prison terms. In 2024 it issued its first enforcement notice over direct marketing, for marketing emails sent without consent.
Do we need to register an Information Officer?
The Act says Information Officers may only take up their duties once they're registered with the Information Regulator, which handles registration through its eServices portal.
Our platforms are hosted overseas. Is that a problem?
Not necessarily. Section 72 allows transfers abroad on conditions, such as the recipient being bound by law or a binding agreement that gives adequate protection, or the person's consent. We check each platform's basis and write it down.
OTHER WAYS WE CAN HELP
Get connected
Talk to us about POPIA and your stack.
Tell us which tools hold customer data and what worries you. We'll tell you honestly what we'd fix first, and when you need a lawyer instead of us.