South African businesses should treat marketing permission as an operating record, not a once-off checkbox. In a statement issued on 21 April 2026, the Information Regulator welcomed Consumer Protection Act amendment regulations published on 15 April that aim to curb unsolicited marketing communications, including spam calls. The regulator also stressed that POPIA obligations continue to apply, whether or not a consumer is registered on a pre-emptive block or opt-out registry.

The message is important for owners and marketing teams that rely on email, SMS or automated follow-up: an address in a database is not automatically permission to market to that person. The regulator says electronic direct marketing generally requires consent, subject to the customer-related provisions in section 69 of POPIA. Read the Information Regulator’s statement.

What the announcement means operationally

The regulatory position creates a practical test for every campaign: can the business show why this contact was selected, what permission was given, and whether the person later asked not to receive marketing?

That evidence can become difficult to reconstruct when leads sit across spreadsheets, inboxes, website forms and personal devices. It is also easy for an old list to be reused for a new campaign without checking whether the original permission covered that purpose.

Our analysis is that consent should therefore be managed as part of the lead-handling process. A useful record should connect the contact to the source of the enquiry, the invitation or form used, the date permission was captured, the communication categories selected and any later withdrawal of consent.

Three controls to put in place

  • Separate leads from permission. A person may be a valid business lead without being an opted-in subscriber. Keep those statuses distinct in the shared CRM.
  • Make suppression visible. When someone opts out, the instruction should be recorded centrally and checked before future campaigns or nurture sequences are activated.
  • Approve audiences before sending. Assign only eligible contacts to an invitation, review the audience, and retain the campaign record alongside the consent history.

This approach also improves follow-up discipline. When leads and contacts are held in one workspace, a team can assign selected contacts to an opt-in invitation, record consent, use the appropriate subscriber list and avoid repeated manual checks between marketing and sales.

Build the workflow around permission

A practical sequence starts with a clear invitation, continues with a recorded consent event and ends with controlled follow-up. Branded emails, timed nurture steps and open or link tracking can support the process, but tracking activity is not a substitute for permission.

Teams should also review older lists before importing them into a new campaign. If the origin or scope of consent cannot be explained, pause the marketing use of that list and investigate the source rather than assuming that previous contact makes future messages acceptable.

For businesses that need help connecting consent records, subscriber lists and email sequences, review the email sequence setup options. The appropriate workflow will depend on the business’s data sources, permissions and configured plan.