POPIA and Cold Outreach: What South African Businesses Should Know

What the law is aiming at

POPIA regulates how personal information is collected, used and shared. Direct marketing by electronic communication gets specific attention because it is where people most often feel they were contacted without permission.

Broadly, the rules for unsolicited electronic direct marketing restrict contacting a person unless they have given consent, or they are an existing customer of yours. The Information Regulator oversees compliance.

It is not only about consumers

A common assumption is that business-to-business outreach falls outside the rules. In practice the information you hold about a named person at a company, such as their name, role and work email or mobile number, is personal information, and POPIA can also cover information about businesses themselves in some circumstances.

The safer position is to treat B2B outreach as regulated and design it accordingly, rather than relying on an exemption you may not have.

Consent, and the existing-customer route

The law recognises two main routes to electronic marketing: the person has consented, or they are your existing customer and you are marketing your own similar products or services to them.

For the customer route, the usual conditions are that you obtained their details in the course of a sale, that you gave them a chance to object when you collected them and give them that chance again in every message, and that you only market your own similar offerings.

The one-time approach

The law also allows a business to approach a person once to ask for their consent, provided they have not previously refused it. That approach has to be done carefully and cannot become a way of sending marketing.

If they say no, or do not respond, you do not keep asking.

Good practice that applies in every case

• Say clearly who you are and why you are contacting them.
• Include an easy way to opt out in every message, and honour it promptly.
• Keep a suppression list of anyone who has opted out and check every campaign against it.
• Know where each contact came from and what basis you have for contacting them.
• Only collect what you need, keep it secure and delete it when you no longer need it.
• Use a separate sending domain for outreach so your main business email is protected.

What this means for how campaigns are built

A responsible outreach process starts with the basis for contact, not the tool. Lists are segmented by how each person came to you, opt-outs are enforced automatically, and messages are written to give a real reason for the contact rather than to disguise it.

Where the basis for contacting a group of people is not defensible, the right answer is not to contact them.

Common questions