POPIA, the New Opt-Out Registry and Your Marketing List

If your business emails, SMSes or phones its customers, the rules changed this year. South Africa now has a national opt-out registry on top of POPIA, and the practical burden falls on you rather than on the person who did not want to hear from you.

This is not a legal opinion, and if you market at scale you should get one. It is a plain-language summary of what changed and what it means for the way your website collects contact details.

1. POPIA has always regulated marketing — not banned it

A persistent myth is that POPIA made email marketing illegal. It did not. Section 69 of the Protection of Personal Information Act allows direct marketing by electronic communication in two situations:

• The person consented. Consent must be obtained in the prescribed manner, using a format the same as or similar to the Information Regulator's Form 4. Someone who is not already your customer may be asked once — not repeatedly until they give in.
• They are an existing customer and the conditions in section 69(3) are met.

2. The existing-customer exception is narrower than people think

Section 69(3) is where most businesses assume they are covered. It only applies if all of the following are true:

• You obtained their contact details in the context of a sale of a product or service;
• You are marketing your own similar products or services — not a partner's, not an unrelated new line;
• You gave them a free, simple way to object when you collected the details, and in every single message since.

3. Every message needs an identity and a way out

Section 69(4) requires that any direct marketing communication contains the identity of the sender, or of the person on whose behalf it is sent, and an address or contact details to which a request to stop can be sent. An unsubscribe link and a real business footer are not optional niceties.

4. What actually changed in 2026: the opt-out registry

On 15 April 2026 the Minister of Trade, Industry and Competition gazetted the Consumer Protection Act Amendment Regulations, which operationalise a national opt-out registry administered by the National Consumer Commission. It replaces a voluntary industry arrangement with a statutory one.

The practical obligations on a direct marketer are:

• Register with the Commission before contacting consumers;
• Do not market to any consumer who has registered a pre-emptive block;
• Cleanse your database monthly against the registry, removing the data of anyone who has registered a block.

Consumers can opt out of an individual company or of the industry as a whole. Registration for consumers and marketers was expected to open from July 2026, and reporting around the launch has pointed to penalties running to R1 million for non-compliance.

5. What this means for your website

Most compliance problems are not malice — they are a signup form built years ago that nobody has looked at since. A short checklist:

• Unticked by default. A pre-ticked marketing box is not consent, and it is the single most common defect we find.
• Separate the consents. Agreeing to your terms is not agreeing to marketing. Two boxes, two meanings.
• Record how and when. If you cannot show when someone agreed and through which form, you cannot defend it. Store it with the contact.
• Make unsubscribe permanent. If a later import or CRM sync can quietly put someone back on the list, your unsubscribe does not work.
• Do not buy lists. Purchased data fails the consent test and will fail the registry cleanse too.
• Name yourself in every message, with contact details and a working opt-out.

6. The upside nobody mentions

A consent-based list is a better list. You are mailing people who asked to hear from you, which means higher open rates, fewer spam complaints and better deliverability for the mail that matters — including your order confirmations. Businesses that treat the rules as the floor rather than the ceiling usually end up with marketing that performs better, not worse.

Where to start

Open your own checkout and your own signup form as a customer would. Is the marketing box unticked? Is it separate from the terms? If you unsubscribed right now, would anything put you back? If you do not like the answers, that is the work — and it is a morning's work, not a quarter's.

If you want a hand, our marketing and SEO team does this as part of onboarding, and our web development side builds the capture properly in the first place.