What counts as consent under POPIA?
POPIA’s consent is not a checkbox formality — it is a defined term with three cumulative requirements:
“’consent’ means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information;”
Voluntary — given freely, without coercion or bundling into terms the person cannot refuse. Specific — tied to an identified purpose; a blanket “we may do anything with your data” clause fails. Informed — the person knew what they were agreeing to. And an expression of will — so a pre-ticked box is not consent, and silence is not consent. Under the amended Regulations (April 2025), consent for electronic marketing may be obtained by email, telephone, SMS or WhatsApp — but telephonic consent requests must be electronically recorded, and regulation 6.4 closes the old loophole in one sentence: opt-out does not constitute consent.
When is consent actually required?
Less often than South African business practice suggests. Consent is the right ground when nothing else fits — when the processing is genuinely optional for the data subject and serves no contract, legal duty or balanced legitimate interest. The clearest cases where the Act genuinely demands consent:
- Electronic marketing to non-customers — section 69(1)(a), with the once-off consent ask under section 69(2). See section 69.
- Optional extras — newsletters, profiling beyond the service, sharing with partners for their own marketing.
- Some special-information and children gateways — where no other section 27 or 35 gateway applies. See special personal information.
For everything else — performing contracts, paying staff, FICA checks, invoicing, security, debt recovery, references — one of the other five grounds almost always fits better.
Why consent is often the worst choice
Two subsections make consent fragile by design. First, the burden of proof sits with you:
“The responsible party bears the burden of proof for the data subject’s or competent person’s consent”
Second, the data subject “may withdraw his, her or its consent... at any time” (s 11(2)(b)) — although processing that happened before withdrawal, and processing resting on grounds (b) to (f), is unaffected. So if you collect consent for something you could have done under contract or legitimate interest, you have voluntarily made your processing revocable at will and taken on the burden of proving the consent. That is not caution; it is self-sabotage.
The 2021 “please re-consent or we delete you” wave
As the POPIA grace period closed in mid-2021, inboxes filled with emails begging customers to “re-consent” on pain of deletion. For most businesses the exercise was legally pointless: their processing already rested on contract, legal obligation or legitimate interests, none of which needed consent then or now. Worse, businesses that deleted non-responders destroyed records they were entitled — sometimes required — to keep. The lesson stands: before asking for consent, ask which ground actually carries the processing. The answer is usually already in section 11.