The prohibition — and its two doors
“The processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject— (a) has given his, her or its consent to the processing; or (b) is, subject to subsection (3), a customer of the responsible party.”
Door one is consent — including the once-off ask below. Door two is the existing-customer exception, which has its own three legs. “Including” means the list is not closed — WhatsApp messages and push notifications are electronic communication too, and the Regulator reads live phone calls into the same regime.
The once-off consent ask
Section 69(2) lets you approach a person who is not your customer only once to request consent, provided they have not previously withheld it. The request must be in the prescribed manner and form — Form 4 under regulation 6 — and it must be a genuine request, not a pitch: the Guidance Note requires that “the first communication which the responsible party sends to the data subject must be a communication requesting consent”. One ask. A clear question. No marketing payload. Keep the response — under section 11(2)(a) you bear the burden of proving any consent you rely on.
The April 2025 modernisation — and the loophole it closed
The amended Regulations (in force 17 April 2025) modernised the mechanics: written consent may be obtained on a form substantially similar to Form 4 “or in any manner that may be expedient” — including by email, telephone, SMS or WhatsApp, fax or automated calling machine — but telephonic and automated-call consent requests must be electronically recorded(regs 6.2–6.3). And regulation 6.4 closes the old loophole in one blunt sentence:
“For the purposes of direct marketing through unsolicited electronic communications, opt-out shall not constitute consent as referred to in section 69 (2) of the Act.”
The “we emailed them and they didn’t unsubscribe” model is dead in law as well as in spirit. The full set of 2025 changes is consolidated on the 2025 amendments page.
The first fine: FT Rams Consulting
The Regulator’s first direct-marketing enforcement notice (February 2024) targeted FT Rams Consulting for persistent marketing emails sent without consent and despite opt-outs; when the company ignored the notice, a R100 000 administrative fine followed. Every element of the conduct — no consent, no customer relationship, opt-outs ignored — maps onto the rules above. The matter, and every other enforcement action, is logged on the enforcement tracker.