South Africa changed materially in April 2026, and most guidance written before then is now incomplete. Direct marketing here is governed by three overlapping statutes rather than one, and since 15 April 2026 there is a registration gate that applies before consent even becomes relevant.
- POPIA section 69 — the consent rules for electronic direct marketing. Enforced by the Information Regulator.
- The Consumer Protection Act and its 2026 Amendment Regulations — the National Opt-Out Registry, marketer registration and prohibited contact hours. Enforced by the National Consumer Commission.
- The ECT Act 2002, section 45 — older provisions on unsolicited commercial communications.
The new gate: you must register before contacting anyone
The National Opt-Out Registry went live on 15 April 2026, with registration of marketers and consumers commencing from July 2026.
The critical point is that this is a gate, not a formality. A direct marketer may not contact any consumer unless the marketer itself is registered with the National Consumer Commission — regardless of what consent you hold. Registration carries an annual fee in the region of ZAR 2,574 plus per-cleanse charges.
And the regulations require your database to be cleansed against the Registry monthly. That is the operative number in South Africa — not a per-request deadline, but a recurring obligation.
Consent under POPIA section 69
Section 69 splits sharply depending on whether the person is already your customer.
Non-customers: Form 4, and you may ask once
To market to someone who is not an existing customer you need express opt-in obtained using the prescribed Form 4. And section 69(2) contains a rule with no real parallel anywhere else:
You may request that consent once, ever. If the person declines, or simply does not respond, you may not ask again. The refusal is permanent.
This makes cold acquisition in South Africa effectively a one-shot exercise. There is no follow-up sequence, no second attempt next quarter. Marketers used to a three-touch opt-in sequence need to understand that the second touch is itself a breach.
Existing customers: a soft opt-in exists
For people who are already your customers you may market your own similar products or services without Form 4, provided you gave them a reasonable opportunity to object both at the point you collected their details and in every subsequent message.
That dual-objection requirement is stricter than it first reads: an unsubscribe link in the campaign is not enough on its own if no objection opportunity existed at collection.
Prohibited contact hours
Regulation 4 of the Consumer Protection Act regulations restricts when direct marketing contact may be made:
- No contact on Sundays or public holidays
- Saturdays: only between 09:00 and 13:00
- Weekday windows apply outside those
Most international platforms schedule sends without any concept of South African public holidays. If you run a Saturday-afternoon campaign into a South African list, that is a compliance issue no send-time optimiser will catch for you.
Penalties
Two separate regimes, and the criminal exposure is the one people miss:
- POPIA s109(2)(c): administrative fine up to ZAR 10 million.
- POPIA s107: a fine and/or up to 10 years’ imprisonment — including for failing to comply with an enforcement notice.
- CPA s112: up to ZAR 1 million or 10% of annual turnover, whichever is greater.
The ten-year custodial provision attaching to ignoring an enforcement notice is unusual, and it is the reason South African compliance is taken more seriously by local counsel than the headline fine figures alone would suggest.
Territorial reach
POPIA applies to responsible parties domiciled in South Africa, and to those outside it who process personal information using means within South Africa. If you are marketing to South African consumers, plan on being in scope.
A practical compliance checklist
- Register with the National Consumer Commission first. Without it, nothing else matters — you may not contact consumers at all.
- Cleanse your database against the Opt-Out Registry monthly.
- Use the prescribed Form 4 for non-customer consent, and record it
- Never ask twice. One request per person, ever
- For existing customers, give an objection opportunity at collection and in every message
- Configure sending windows to respect Sundays, public holidays and the Saturday 09:00–13:00 limit
- Keep consent records — the Information Regulator will expect them
Frequently asked questions
Do I need opt-in consent to email South African consumers?
For non-customers, yes — express consent via the prescribed Form 4, requestable only once. For existing customers you may market your own similar products under the soft opt-in, provided an objection opportunity was given at collection and appears in every message.
What is Form 4?
The consent form prescribed under POPIA regulations for obtaining direct-marketing consent from someone who is not an existing customer. Section 69(2) permits you to send that request once only.
How quickly must I honour an opt-out in South Africa?
Neither POPIA nor the ECT Act sets a day count. The operative obligation since April 2026 is different in kind: monthly cleansing against the National Opt-Out Registry.
Can I email South African consumers on a Sunday?
No. CPA regulations prohibit direct marketing contact on Sundays and public holidays, and restrict Saturdays to 09:00–13:00.
What is the maximum POPIA fine?
ZAR 10 million as an administrative fine under s109(2)(c). Section 107 additionally provides for a fine and/or up to 10 years’ imprisonment for certain breaches, including ignoring an enforcement notice.
Related reading
- Best email marketing software in South Africa — platforms and ZAR billing
- Email marketing rules by country
- Bulk email services in Nigeria — the other major African market
- GDPR and email marketing — POPIA’s closest relative
- Double opt-in explained
Verified against POPIA, the Consumer Protection Act Amendment Regulations 2026 and Information Regulator guidance, September 2026. General information, not legal advice — and this is a market where the rules changed recently, so confirm current requirements before launching.
Bluey Email includes consent capture, suppression handling and scheduling controls on every plan, and bills in 128 currencies including ZAR. Start free.