South African businesses have received a timely reminder that an opt-out mechanism does not replace permission for electronic direct marketing. In a 21 April 2026 statement, the Information Regulator said the Consumer Protection Act Amendment Regulations introduce additional measures aimed at curbing unsolicited marketing communications, including spam calls. It also stressed that compliance with the Protection of Personal Information Act remains mandatory.

The regulator’s message is important for businesses that treat a marketing list as a simple spreadsheet. POPIA section 69 applies to unsolicited electronic communications such as email, SMS and automated calls. The regulator says electronic direct marketing is prohibited unless the recipient has given consent or qualifies for the customer exception set out in the legislation.

What the regulator’s reminder means

The statement makes a distinction that marketing teams should build into their daily processes. A consumer who has not registered on a pre-emptive block or opt-out registry is not automatically available for promotional messages. The Information Regulator says consent is still required, unless the business can rely on the relevant customer provision.

This does not mean every follow-up message is prohibited. It does mean that the business should be able to explain why a person was contacted, what permission or customer relationship applied, and how the person can stop future marketing. The regulator’s direct-marketing guidance note, dated 3 December 2024, is intended to help responsible parties apply POPIA to direct marketing.

Turn consent into an operating record

For a small business, the practical response is not another isolated checklist. It is a connected record that follows a contact from first enquiry to campaign subscription and later suppression.

  • Capture the source: record whether the contact came from a website form, event, referral, inbound call or another channel.
  • Separate purposes: distinguish a request for a quotation, a service update and permission to receive promotional content.
  • Keep the status visible: record consent, refusal, withdrawal and the date of each change.
  • Control invitations: send opt-in invitations only to selected contacts who fit the purpose and audience.
  • Suppress promptly: ensure unsubscribes and objections are available to everyone handling campaigns.

A shared CRM can reduce the risk created by handovers between sales, marketing and administration. In Manager, leads and contacts can be kept in one workspace, with selected contacts assigned to an opt-in invitation and subscriber lists maintained separately from general enquiries. Recorded consent and suppression statuses give the team a clearer basis for deciding who should enter a nurture sequence.

Measure follow-up without losing the audit trail

Tracking opens and links can help a team understand engagement, but engagement should not be treated as permission. A contact clicking a link does not automatically replace the need for a lawful marketing basis. Teams should review campaign performance alongside list status, consent source and unsubscribe activity.

The next useful step is a short list audit: identify every active marketing list, remove unclear records from promotional sends, document the source of permission and define who owns suppression updates. For businesses that want to connect these steps with timed email sequences and branded campaign design, a structured email-sequence setup can help reduce manual handovers while keeping human review in the process.