Can I send marketing emails and SMS under POPIA?

Yes, but only to two groups of people, and each group has its own rules. Under section 69 of the Protection of Personal Information Act 4 of 2013 (POPIA), electronic direct marketing by email, SMS, automated calls or similar means is prohibited unless the person has consented, or is an existing customer being marketed to in a specific, limited way. Every message, to anyone, must offer a way to opt out.

If your marketing list is made up of people who bought from you and gave you their details in the process, you are largely fine, as long as you stick to similar products and include an opt-out. If your list was bought, scraped, collected from a competition entry form with no marketing tick box, or built from business cards at an expo, most of it cannot lawfully be used for electronic marketing until each person opts in.

This guide explains the two groups, what consent looks like, how the opt-out must work, and how the rules fit with the Consumer Protection Act 68 of 2008 and the Electronic Communications and Transactions Act 25 of 2002.

What counts as direct marketing

Direct marketing is approaching a person, in person or by mail or electronic communication, to promote or offer goods or services, or to ask for a donation. "Electronic communication" includes email, SMS, WhatsApp and similar messaging, automated calling machines, and fax. Section 69 is aimed at the electronic forms. Ordinary phone calls made by a person are governed mainly by the Consumer Protection Act, which gives consumers the right to refuse direct marketing and to demand that you stop.

A message is marketing if its purpose is to sell. A delivery confirmation, an invoice, a booking reminder or a warranty notice is not marketing. A "we miss you, here is 20% off" message is.

Group one: people who are not existing customers

For anyone who is not an existing customer, you need their prior consent before you send electronic marketing. Three rules apply:

1. Consent must be given before the first marketing message. You cannot send a message that says "reply STOP if you do not want more of these" and treat silence as consent.
2. You may ask for consent only once. If the person has refused, or has not responded, you cannot keep asking. The Regulator has prescribed a form for the request, and using that form or something with the same content is the safe way to ask.
3. The consent must be specific and recorded. A ticked box on your website, an opt-in reply to a request, or a signed line on a paper form all work. A box that was ticked by default and the person "did not untick" does not.

Consent under POPIA is a voluntary, specific and informed expression of will. If people did not know they were agreeing to marketing, they did not consent.

Group two: existing customers

You may send electronic marketing to an existing customer without fresh consent, but only if all of the following are true:

• you obtained their contact details in the context of a sale of a product or service
• you are marketing your own similar products or services
• the person was given a reasonable opportunity to object, free of charge and without undue effort, when you collected the details and in every message afterwards

"Similar" is not defined in the Act. A hardware store emailing customers about a sale on tools is safe. A hardware store emailing customers about a partner's insurance product is not marketing its own similar products and needs consent.

The opportunity to object at collection is the part most small businesses miss. A line on the invoice, order form or sign-up screen saying "we may send you offers on similar products; tick here or reply STOP to opt out" does the job. If you did not give that opportunity when you collected the details, the safest fix is to send a single consent request in the prescribed form.

The opt-out rule for everyone

Every electronic marketing message must:

• identify the sender, or the person on whose behalf it is sent
• give an address or contact detail to which the recipient can send a request to stop
• be honoured promptly when someone opts out

An unsubscribe link in an email, "reply STOP" in an SMS and a working contact address all satisfy this. What does not satisfy it is a link that goes to a dead page, a STOP that only works on certain networks, or an opt-out that takes six weeks to process. Keep a suppression list of everyone who has opted out and check every campaign against it.

The Electronic Communications and Transactions Act 25 of 2002 adds its own requirement that unsolicited commercial communications identify the sender and offer an opt-out, and the Consumer Protection Act 68 of 2008 gives consumers the right to refuse and opt out of direct marketing. The three Acts point the same way: identify yourself, offer a real opt-out, and honour it.

Illustrative example: a coffee roastery

The example is illustrative only.

Anele runs a small coffee roastery in Durban with an online shop and a stall at a weekend market. She has three lists.

Online customers, about 900 people who bought beans through the shop. The checkout page has a tick box: "Send me news about new roasts and specials." About 600 ticked it. The other 300 are still existing customers who gave their details in a sale, so Anele may email them about similar products with an opt-out in each message, since the checkout page also told them they could object.

Market stall sign-ups, about 400 people who wrote their number on a clipboard next to a "Win a bag of beans" sign. None of them bought anything, and the sign said nothing about marketing. Anele may send each of them one consent request in the Regulator's prescribed form. Those who say yes join the list. Those who say no or say nothing are deleted.

A list of 2 000 addresses a friend sold her from a defunct café. None of these people consented to marketing from Anele. She may not email them, and sending even a consent request to a list she had no lawful basis for holding is risky. She deletes the list.

Every email Anele sends has her business name, physical address and a working unsubscribe link. Her SMS specials end with "Reply STOP to opt out." She keeps a spreadsheet of opt-outs and checks it before every send.

What to do this week

1. Sort your list into existing customers, opted-in prospects, and everyone else.
2. Delete everyone else, or send a single consent request in the prescribed form and delete those who do not opt in.
3. Add an opt-out line at every point where you collect contact details: checkout, invoice, intake form, competition entry.
4. Check every template for sender identification and a working opt-out.
5. Set up a suppression list and a process to check it before every campaign.
6. Confirm that your email or SMS platform, which is an operator under POPIA, has signed a data processing agreement with you and handles unsubscribes automatically.
7. Run the POPIA compliance checker to catch anything else.

Documents and records to set up

• A consent record showing, for each person, what they consented to, when, and how, with a screenshot of the form or a copy of the reply.
• A suppression list of opt-outs, with dates.
• Template wording for the consent request, based on the Regulator's prescribed form.
• Template opt-out lines for email footers, SMS and paper forms.
• An operator agreement with your email or SMS platform.
• A privacy notice that mentions marketing and the right to object. See does POPIA apply to my small business.
• A campaign log noting each send, the list used and the suppression check.

Realistic timeline

• Day one: stop any sends to lists you cannot justify.
• Week one: sort lists, add opt-out lines, fix templates.
• Weeks two to four: send consent requests, process responses, delete non-responders.
• Ongoing: honour opt-outs within a day or two, and re-check the suppression list before every campaign.

A small business with a few thousand contacts can be compliant within a month.

Common mistakes and what they cost

• Buying a list. The people on it did not consent to hearing from you. Every message is a contravention and a likely complaint.
• Treating silence as consent. Consent must be given, not assumed.
• Asking repeatedly. You may ask once. A monthly "would you like to subscribe?" to non-responders breaks the rule.
• Marketing unrelated products to customers. The existing customer exception only covers your own similar products and services.
• A broken unsubscribe. An opt-out that does not work is the fastest route to a complaint, and the easiest thing for the Regulator to verify.
• No record of consent. If a person complains, you must show they consented. A spreadsheet with a date and a screenshot is enough. Nothing is not.

The Regulator can issue an enforcement notice requiring you to stop and fix your processes, and can impose administrative fines, the amounts of which are set by law and change. Some contraventions of POPIA are offences. Beyond the law, a spam reputation gets your domain blacklisted by mail providers. See what small business and POPIA compliance costs.

If you cannot afford an attorney

You do not need one for this. The Regulator's guidance on direct marketing and its prescribed consent form are free on its website. The Small Enterprise Development Agency (Seda) runs free marketing and compliance support for small businesses. University law clinics can review your consent wording. If a list broker or marketing agency sold you a non-compliant service and will not refund you, the Small Claims Court hears money claims up to its limit without attorneys. Legal Aid South Africa is for individuals rather than businesses.

Frequently asked questions

Can I WhatsApp my customers? The same rules apply as for SMS. Existing customers, similar products, opt-out in every message. Everyone else needs prior consent. WhatsApp's own business terms add further restrictions.

Can I market to businesses? POPIA protects juristic persons as well, so a company's contact details are personal information. The same two groups and the same rules apply.

Does a competition entry count as consent? Only if the entry form clearly said that entering means agreeing to receive marketing, and the person had a real choice. A hidden line in the terms is unlikely to be enough.

Can I phone people? Voice calls by a human are governed mainly by the Consumer Protection Act, which lets consumers refuse and demand that you stop. Automated calls fall under section 69 and need consent.