POPIA compliance is treated by most businesses as either a paperwork exercise nobody has done or a reason to be frightened of marketing at all. It is neither. The Act settles one practical question: who you may send a marketing message to without asking first, and what you have to give them if you do.
This is how we run marketing lists, written for owners rather than for lawyers. It is not legal advice, and where a decision has real money attached it is worth twenty minutes with somebody who does that for a living.
The rule in one paragraph
Sending direct marketing by electronic means to a person who is not your customer requires their consent, given beforehand. Where somebody is already a customer, and you obtained their contact details in the course of selling them something, you may market your own similar products or services to them, as long as they were given a reasonable opportunity to object at the time, free of charge and without a process, and are given that opportunity in every message afterwards.
Two details catch people out. Electronic communication includes a telephone call in the Regulator guidance, which puts cold calling in the same category as email. And every message has to identify who is sending it and offer a way out.
What an enquiry actually permits
Somebody who fills in your form asking for a quote has given you their details for that quote. Replying about it is what they asked for. Adding them to a monthly newsletter is a different purpose, and it needs its own agreement.
The fix is a single unticked checkbox next to the form, in plain words, saying what you would send and how often. It costs nothing, and the people who tick it are the only ones worth having on the list anyway.
What to record, and it is less than you think
- Where each contact came from: the form, the shop counter, the event, the order.
- The date, and what they were told they were agreeing to.
- Whether they opted in to marketing separately from the transaction.
- Every opt-out, and the date it was actioned.
A spreadsheet does this. What matters is that the answer exists for any given person on the list, because the question, when it comes, is always about one person rather than the list as a whole.
POPIA does not prohibit marketing. It settles one question: who you may contact without asking first, and what you owe them if you do.
The four things that make a list unusable
It was bought or scraped
Consent given to somebody else is not transferable, and no unsubscribe link repairs it. There is no version of a bought list that is compliant.
Collected for another purpose
The addresses were gathered for one thing and used for another, with no record of what was agreed to at the time.
Opt-outs never actioned
Collecting an objection and continuing to send is worse than never offering a way out, because it proves the request was received.
Nobody can say where it came from
An unexplainable list is treated as an unlawful one, and the burden of showing otherwise sits with you rather than with the complainant.
The two housekeeping items
Every business has an Information Officer by default, and in most owner-run businesses it is the owner whether or not anybody has said so. That person is meant to be registered with the Information Regulator. It is free and it takes minutes.
The second is retention. Personal information is kept for as long as there is a reason to keep it and then removed. In practice that means clearing out the enquiry list nobody has looked at since 2022, which improves the marketing as well as the compliance, because a stale list damages deliverability every time it is mailed.
The point
POPIA compliance for marketing comes down to four habits: ask before you send, keep a record of what was agreed, make leaving easy and immediate, and never buy a list. Businesses that do those things market more confidently than the ones that do not, because they are never guessing whether the next campaign is allowed to go out.
Sources and method
- Protection of Personal Information Act, section 69, on direct marketing by unsolicited electronic communications.
- Information Regulator of South Africa, guidance note on direct marketing, including its position that a telephone call is an electronic communication. Checked 29/08/2026.
Written by Assay House, a South African brand strategy and creative agency. Published 29 August 2026.
