Consent before e-mail marketing under POPIA
Whether a South African business may send marketing e-mails or SMSes to people who have never bought from it, and how POPIA consent must be obtained.
By Achekam · · 5 min read · For Running a business businesses in South Africa
A business buys a list of e-mail addresses from a marketing company, or collects business cards at an expo, or scrapes contact details from a directory. The plan is simple: send a promotional newsletter, see who bites. For many South African businesses this still feels like ordinary marketing.
Under the Protection of Personal Information Act it is not. Electronic marketing to people who are not your customers is prohibited unless they have consented, and the Act and the Information Regulator are specific about how that consent is obtained and proved. This article explains the two routes the law allows, the single approach you may make to ask for consent, the form consent must take, a common misunderstanding about the Consumer Protection Act, and how Achekam's web forms and mailing list fit in.
Two routes: consent, or an existing customer
The POPIA text published on the government's page prohibits direct marketing by electronic communication, including SMS and e-mail, unless the person has consented or is an existing customer. That is section 69 of the Act as published.
So there are only two doors:
- The person is an existing customer. This route has conditions of its own and is covered in marketing to existing customers under POPIA.
- The person has consented. For everyone else, including people on a bought list, expo contacts and directory entries, consent is required before any marketing message is sent.
The rule as published lists no exception for "their address is public" or "we only send one newsletter a month". If the person is not your customer, the question is consent.
One approach, and only to ask
POPIA does allow a first contact with a non-customer, but it is narrow. The Act as published says a non-customer may be approached only once to request consent. The Information Regulator's guidance note on direct marketing puts it practically: a business must obtain a non-customer's consent before sending direct marketing by electronic communication, so the first message may only be a request for consent, and it may approach that person only once.
Two consequences follow:
- The first message cannot be the marketing. It cannot be a newsletter with a consent request at the bottom. It must be a request for consent.
- There is no second attempt. If the person does not respond, or declines, you may not ask again.
The Regulator's guidance note on direct marketing under POPIA explains consent for electronic marketing and marketing to existing customers, and anyone who sends marketing for the business should read it. The version cited here is dated 3 December 2024.
Form 4, or a substantially similar form
Consent must take a particular shape. The Regulator's guidance note says consent for electronic direct marketing must be obtained in writing on the prescribed Form 4, or a substantially similar form. Where consent is sought by telephone, the form must be read out and the call recorded.
The guidance note also says a business must keep a database of people who have withheld consent or objected to direct marketing, and that the business bears the onus of proving that a person consented. In other words, if a recipient complains, it is for you to show the consent, not for them to show its absence. A tick in a spreadsheet column labelled "OK to market" is unlikely to carry that weight. A record that shows the wording the person agreed to, when and how, is far stronger.
A CPA pre-emptive block is not the test
Some businesses reason that if a person has not registered on a do-not-contact register under the Consumer Protection Act, they may be marketed to. The Regulator's guidance note rejects that. It says a business may not contact a person for electronic direct marketing simply because that person has not registered a pre-emptive block under the Consumer Protection Act; POPIA consent is still required.
The absence of an objection is not consent. For non-customers, the starting position is "no" until the person says "yes" in the required form.
Web forms with consent wording, and an unsubscribe link in every newsletter
The cleanest way to build a consented list is to let people sign up themselves. In Achekam, a business can design web forms for its website, each with its own public address. A submission creates a lead, or adds to a recent lead with the same e-mail. The forms are found under CRM & SALES, in Leads, under Web forms. They start paused, suspected robot submissions are logged as spam, and the submitter must accept the business's consent wording before the form goes through.
That last point puts the wording in your hands. Draft it against Form 4 with your adviser, so that what people accept on the form is a consent you can rely on, and keep a copy of each version you use.
Achekam also lets a business keep a mailing list, design newsletters and send or schedule campaigns, with an unsubscribe link in every letter. Campaigns are under CRM & SALES, in Campaigns. The unsubscribe link gives every recipient a way to withdraw.
Keeping one record per person matters when consent and objections are tracked. Each new lead gets a code that is never reused, and when staff enter a lead whose e-mail or phone matches one already held, Achekam names the existing lead and asks before creating a second. Leads can also be imported from a CSV file, up to 5,000 rows at a time; an imported list is exactly where consent needs checking before anyone is marketed to. Accounting firms using the same tools will find their version in web forms and the mailing list.
Before the next campaign goes out
Go through the list you plan to use and sort it into three groups: existing customers who meet the conditions, people whose consent you can prove, and everyone else. Only the first two receive marketing. For the third group, at most one message is allowed, and it can only ask for consent.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
