The three legs — all of them, together
“A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)— (a) if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service; (b) for the purpose of direct marketing of the responsible party’s own similar products or services; and (c) if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details— (i) at the time when the information was collected; and (ii) on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.”
Note — Paraphrased legs for the checklist: (1) contact details obtained “in the context of the sale of a product or service”; (2) marketing “the responsible party’s own similar products or services”; (3) a free, easy opportunity to object “at the time when the information was collected” and “on the occasion of each communication”.
Note the conjunction: and. The legs are cumulative. Details scraped from a directory fail leg one even if the person later becomes a customer-ish contact; an unrelated product fails leg two even for a genuine customer; and a signup form with no objection opportunity poisons leg three from the start — which is why the opt-out box belongs on the order form, not just in the emails.
What counts as “similar products or services”?
The Regulator’s Guidance Note answers with a concrete example: for a clothing retailer, “similar products include shoes, belts etc. A funeral insurance cover will not constitute a similar product.” The test is the customer’s reasonable expectation, anchored in what they bought: adjacent items in the same commercial universe pass; a leap into a different industry — however profitable the cross-sell — needs fresh consent. Groups should take particular care: the exception covers the responsible party’s own similar products, not the whole stable’s catalogue (see intra-group sharing).
The edge cases
Quote-only prospects are the commonest stumble: no sale, no leg one — use the once-off consent ask instead. Lapsed customers keep the relationship in law, but honour the spirit: a customer who hasn’t heard from you in five years experiences your “soft opt-in” as spam, and complaints — not statutes — start investigations. An initial refusal ends the exception: leg three only operates “if the data subject has not initially refused such use”. And every message, exception or not, must identify you and offer a cease-contact route (s 69(4)) — the suppression list is permanent infrastructure, not a courtesy.