The 2021 panic and the provision that answers it
As POPIA’s grace period ended in mid-2021, a chain message swept South African group chats: admins must get every member’s consent or delete the group. Stokvels drafted “POPIA notices”; family groups voted on consent. All of it answered by one subsection:
“WhatsApp group admins need every member’s consent under POPIA.”
POPIA does not apply at all to purely personal or household activity. Family, friend and neighbourhood groups fall outside the Act — there is nothing to consent to.
“(1) This Act does not apply to the processing of personal information— (a) in the course of a purely personal or household activity;”
Where the personal/business line runs
The test is the activity, not the app. The braai-planning group, the lift club, the cousins’ group — personal, excluded. The moment the group serves a commercial or organisational activity, the exclusion falls away: a business’s customer-service channel, an estate agency’s buyer list, a body corporate’s official residents’ channel (see body corporates) — all ordinary POPIA processing, needing a ground and the conditions. That is rarely hard: communicating with your own customers or members about the thing they signed up for is contract or legitimate interest. The line that actually bites is marketing.
Business WhatsApp channels and marketing
WhatsApp messages are electronic communication, so marketing through them lives under section 69: consent or the existing-customer exception, identify yourself, and offer an opt-out in every message. The amended Regulations (April 2025) cut both ways here: consent may now be requested via WhatsApp in the prescribed form — once, per section 69(2) — and objections may arrive by WhatsApp too, and must be honoured. Broadcasting specials to a group built from saved customer numbers is exactly the conduct the Regulator’s direct-marketing enforcement now targets.