Definition
POPIA (the Protection of Personal Information Act) is South Africa's data protection law, enforced by the Information Regulator; section 69 restricts direct marketing by electronic communication, including SMS.
Section 69 prohibits processing personal information for direct marketing by electronic communication, including SMS, unless the person has consented or is your customer under narrow conditions. You may approach a person whose consent is required only once to ask for it, and only if they have not previously refused. The request must follow the prescribed form.
The existing-customer route needs three things: you obtained the details in the sale of a product or service, the marketing is for your own similar products or services, and the person was given a reasonable, free and easy chance to object when you collected the details and with each message. Every direct marketing message must also carry the sender's identity and an address or number where the person can ask for it to stop.
POPIA sits alongside other rules. The Consumer Protection Act regulation bars direct marketing to consumers at home on Sundays and public holidays, on Saturdays before 09:00 or after 13:00, and on other days from 20:00 to 08:00. The WASPA Code of Conduct, an industry code binding members and their clients, applies similar windows and requires members to honour STOP requests for marketing.
Do not buy lists, and do not send a second request after a refusal. Our regulation data says to keep timestamped consent records for at least 12 months. This entry is general information, not legal advice; confirm requirements with South African counsel.
Frequently asked questions
Do I need consent to send marketing SMS in South Africa?
Generally yes. Section 69 prohibits electronic direct marketing unless the person consented or is an existing customer under the three narrow conditions. You may ask for consent only once if the person has not refused before.
Who enforces POPIA?
The Information Regulator enforces POPIA. ICASA regulates electronic communications, and the WASPA Code of Conduct binds WASPA members and their clients through membership and provider contracts.
What must a marketing message include?
The sender's identity, or that of the party on whose behalf it is sent, and an address or number where the person can ask for the messages to stop.