Get cold outreach wrong and the damage outlasts the campaign: complaints, a bruised brand, a restricted WhatsApp number and a compliance problem you did not need. If you contact people you have not dealt with before, by email, SMS, WhatsApp or automated call, South Africa’s Protection of Personal Information Act (POPIA) applies.
Many businesses assume it only concerns consumers, or that a business email address is fair game. Neither is safe to assume.
This is a plain-language overview to help you ask better questions. It is general information, not legal advice: the details depend on your situation, so have a POPIA-qualified attorney confirm your own position.
What the law is aiming at
POPIA regulates how personal information is collected, used and shared. Direct marketing by electronic communication gets specific attention, because that is where people most often feel they were contacted without permission.
Broadly, the rules for unsolicited electronic direct marketing restrict contacting a person unless they have given consent or are an existing customer of yours. The Information Regulator oversees compliance.
It is not only about consumers
A common assumption is that business-to-business outreach falls outside the rules. In practice, the information you hold about a named person at a company, such as their name, role and work email or mobile number, is personal information. POPIA can also cover information about businesses themselves in some circumstances.
The safer position is to treat B2B outreach as regulated and design it accordingly, rather than rely on an exemption you may not have.
Consent, and the existing-customer route
The law recognises two main routes to electronic marketing: the person has consented, or they are your existing customer and you are marketing your own similar products or services to them.
For the customer route, the usual conditions are that you obtained their details in the course of a sale, that you gave them a chance to object when you collected those details and give them that chance again in every message, and that you only market your own similar offerings.
The one-time approach
The law also allows a business to approach a person once to ask for their consent, provided they have not previously refused it. That approach has to be handled carefully, and it cannot become a back door for sending marketing.
If they say no, or do not respond, you do not keep asking.
Good practice that applies in every case
Whatever your basis for contact, these habits belong in every campaign:
- Say clearly who you are and why you are contacting them.
- Include an easy way to opt out in every message, and honour it promptly.
- Keep a suppression list of everyone who has opted out, and check every campaign against it.
- Know where each contact came from and what basis you have for contacting them.
- Collect only what you need, keep it secure and delete it when you no longer need it.
- Use a separate sending domain for outreach, so your main business email is protected.
What this means for how campaigns are built
A responsible outreach process starts with the basis for contact, not the tool. Lists are segmented by how each person came to you, opt-outs are enforced automatically, and messages give a real reason for the contact rather than disguising it.
Where the basis for contacting a group of people is not defensible, the right answer is not to contact them.
Start with the leads you already have
Before you buy or build a cold list, look at the leads you already hold: people who filled in a form asking to be contacted, enquiries that went quiet, past customers. Every day they wait, they cool, and the business that replies first is the one most likely to win them.
That is where HDS starts. AI lead optimisation contacts new enquiries within seconds, follows up the ones who are not ready until they decide, and re-engages dormant lists in a natural, human tone. Abby, our flagship AI voice agent, introduces herself by name and confirms she is an AI whenever she is asked, because trust starts with being clear about who is calling.
Outbound work is designed around POPIA and the rules of each channel, and where the basis for contacting someone is not defensible, we do not do it. Like the rest of this guide, that is general information, not legal advice, so check your own position with a professional.
Common questions
Is cold email to a business address legal in South Africa?
It depends on the circumstances, and it is not automatically exempt because the recipient is at a company. Treat it as regulated and take advice on your own position.
Does POPIA apply to WhatsApp messages?
The rules on electronic direct marketing are not limited to email. WhatsApp and SMS marketing are electronic communications, and WhatsApp’s own platform rules apply on top.
Who do I ask for definitive advice?
A POPIA-qualified attorney or privacy specialist, and the Information Regulator’s published guidance. This article is general information only.
Put this guide to work
Knowing where leads leak is half the job. Closing the leak is the other half, and every day it stays open, enquiries you paid for go straight to whoever answers first. These HDS services are built to close it.
- Lead Generation We run your paid and organic advertising so a steady flow of new leads reaches your business, and AI lead optimisation contacts each one within seconds.
- Database Reactivation Old enquiries, past customers and cold leads re-engaged in a natural, human tone, every reply handled and booked, with no ad spend and no list to build.
Turn this guide into booked meetings.
Book a meeting with Jared