The myth
“POPIA killed direct marketing.”
POPIA regulates marketing by channel. Electronic marketing needs consent or an existing-customer relationship; post and in-person marketing run on legitimate interest with a right to opt out. What died was the bought-list blast — not marketing.
“Where direct marketing communication is by non-electronic means, the responsible party may be able to process personal information for direct marketing without obtaining consent from the data subject. This is possible where the responsible party relies on section 11(1) (d or (f) as justification...”
What counts as direct marketing?
The Act defines direct marketing as approaching a data subject “either in person or by mail or electronic communication” to promote goods or services or to solicit donations (s 1). Note the breadth: charity fundraising is direct marketing; a personalised LinkedIn pitch is direct marketing; and because POPIA protects juristic persons, B2B campaigns sit inside the same rules.
The two regimes
Regime 1 · Opt-out
Post, hand-delivered mail, in person
Runs on the ordinary section 11 grounds — typically legitimate interest, which the Guidance Note insists must be assessed (purpose, necessity, balancing), not assumed. The data subject’s protection is the unconditional right to object (s 11(3)(b)) — after which the processing stops (s 11(4)). Keep a database of objectors and leave them alone.
Regime 2 · Opt-in
Electronic: email, SMS, automated calls — and calls generally
Prohibited unless the person consented or is your customer (s 69(1)). Two doors: the once-off consent ask (s 69(2), prescribed form, opt-out is not consent) and the existing-customer exception (s 69(3), three legs). The Regulator’s December 2024 view brings live phone calls into this regime.
Duties on every channel
Whatever the channel, section 69(4) requires every marketing communication to disclose the sender’s identity and provide contact details “to which the recipient may send a request that such communications cease”. Two more rules from the Guidance Note every marketer should memorise: “Therefore, silence cannot mean consent” — and where you do ask a prospect for consent, “the first communication which the responsible party sends to the data subject must be a communication requesting consent”, not a pitch wearing a consent hat.
Enforcement and what’s coming
Enforcement is no longer theoretical. The Regulator’s first direct-marketing enforcement notice went to FT Rams Consulting in February 2024 — persistent marketing emails without consent, opt-outs ignored — followed by a R100 000 fine when the notice was ignored. Announcing it, the Chairperson said: “Our leniency regarding direct marketing through unsolicited electronic communications is going to be a thing of the past...”. On the horizon: a national opt-out registry (flagged for 2025/26) and a possible court test of the phone-call question — both tracked on the enforcement tracker and the cold-calling page.