Open the average small-business CRM and you will probably find more than customers.
There will be people who asked for quotations. Old customers. Newsletter subscribers. Contacts from networking events. Prospects added by sales. People imported from Outlook. Maybe a bought lead list. Perhaps a spreadsheet that has been passed from one salesperson to the next for years.
Most of those records look identical on screen.
Name. Company. Email. Mobile number.
Legally, however, the rows may be very different.
One person may have specifically agreed to receive your marketing. Another may qualify under the existing-customer provisions in section 69. Someone else merely asked for a quotation. Another person's details may have been copied from a public website.
The spreadsheet shows you who is there. It does not necessarily tell you why you may market to them.
A contact detail is not the same thing as marketing permission. Before using the contact, understand where it came from, what relationship exists, what the person was told and which rule allows the marketing.
Our Insight on what actually happens to personal information looks at why the history behind a record matters once information starts moving through the business.
Our Information Officer guide explains why privacy governance needs to hear about business changes before decisions are already implemented.
Our data-subject rights guide covers the wider rights framework, including objections that need to be recognised and managed.
The number of names tells you the size of your database. The history behind those names tells you what the database is actually worth.
Understanding the story behind the contact
A big database can create a false sense of value
Imagine two SMMEs.
Business A has 12,000 contacts in its CRM.
Nobody is completely sure where several thousand came from. Consent records sit in an old marketing platform. Customer objections are in somebody else's spreadsheet. Some contacts were bought. Others were imported by employees who have since left.
Business B has 2,500 contacts.
It knows which are customers, which asked to receive marketing, where consent is recorded, what each customer originally bought and who has opted out.
Which business has the better marketing asset?
The answer may not be the one with more rows.
This is why cleaning a marketing database should involve more than removing duplicate email addresses.
Sometimes the real duplicate is not the contact.
It is the business assumption that every contact can be used in the same way.
Electronic direct marketing starts from a restrictive position
Section 69 of POPIA regulates direct marketing by means of unsolicited electronic communications.
It prohibits processing personal information for that purpose unless the data subject has consented, or the data subject is a customer and the requirements in section 69(3) are satisfied.
That distinction is important because it changes the usual marketing question.
Instead of beginning with:
"How many people can we send this campaign to?"
begin with:
"What allows us to include each category of person on the campaign?"
An unsubscribe link is important.
But an unsubscribe link at the bottom of an email does not answer whether the person should have received the email in the first place.
"We only market to businesses" is not an automatic POPIA exemption
POPIA's definition of personal information extends to information relating to an identifiable, existing natural or juristic person.
An SMME operating in a B2B environment should therefore assess the actual information and marketing activity rather than assuming that company contacts automatically fall outside POPIA.
A customer relationship is not an unlimited marketing permission slip
This is probably the part of section 69 that deserves the most attention from growing businesses.
The section 69(3) customer route has three core requirements that work together.
Notice what section 69 does not say.
It does not say:
"If somebody bought anything from us once, we can market anything to them forever."
There is no arbitrary statutory expiry period for the customer relationship in section 69(3). That does not make the context irrelevant. The statutory requirements must still be satisfied, and the wider POPIA rules on purpose and further processing remain relevant to the use of the information.
Finding an email address and marketing to it are two different decisions
A sales employee finds a managing director's email address on the company website.
Another person connects with the business on LinkedIn.
A list provider offers 5,000 "POPIA compliant" leads.
Someone hands over a business card after a networking event.
Each scenario needs context.
POPIA does recognise circumstances in which personal information does not have to be collected directly from the data subject. Section 12 includes, for example, information contained in or derived from a public record or information deliberately made public by the data subject.
That answers a collection question.
It does not automatically answer the electronic direct-marketing question in section 69.
A public email address is therefore not the same thing as a standing invitation to receive unsolicited promotional messages.
A LinkedIn connection does not automatically convert into consent for an email campaign either.
The Information Regulator's Direct Marketing Guidance Note goes further and treats direct messaging through platforms such as LinkedIn and Instagram as electronic communication for direct-marketing purposes. That is the Regulator's published interpretive position and should be taken into account when designing campaigns.
If a marketing agency or technology provider will process the contact information on your behalf, the relationship may also require separate third-party governance. See our guide to POPIA operators and third parties .
One small change in context can change the conversation
You meet somebody at an industry event.
They give you their business card and ask you to send the information you were discussing.
Sending the requested information is one thing.
Returning to the office, uploading every business card from the event into a recurring promotional campaign is something else.
Human beings understand the difference.
One interaction was a requested follow-up. The other creates an ongoing marketing relationship.
Good privacy governance often begins by noticing when the context has changed.
Consent changed operationally in 2025
Where the business needs consent under section 69(1)(a), section 69(2) allows it to approach a data subject only once to request that consent, provided the person has not previously withheld it.
Regulation 6 sets out how that request can be made.
This is an area where older POPIA guidance and templates need to be read with care because Regulation 6 was amended in April 2025.
The amended regulation allows the consent process contemplated in section 69(2) to use a form substantially similar to Form 4 or other expedient, free and reasonably accessible methods identified in the regulation, including email, telephone, SMS or WhatsApp, facsimile and automated calling.
Telephonic and automated-calling consent requests must be electronically recorded and the recording, or a transcription, must be made available to the data subject on request free of charge.
Regulation 6 also expressly states that an opt-out does not constitute consent for purposes of section 69(2).
For an SMME, the practical lesson is simpler than the legal wording.
If your campaign depends on consent, make sure your system can show what the person agreed to and how that agreement was captured.
"They are in Mailchimp" is not evidence of why they are lawfully there.
What if every contact carried its own story?
Most CRMs tell you the person's name, company, email address and perhaps the last time sales contacted them.
Imagine adding a different kind of history.
Not every SMME needs eight extra CRM fields.
The point is to retain enough of the story to make the next decision without archaeology.
A marketing database becomes more valuable when the business no longer has to guess why a person is in it.
The people you cannot market to may need their own record
Marketing teams naturally care about the "yes" list.
Who can we contact?
There is another record that deserves just as much attention.
The people who said no.
Suppose somebody unsubscribes and the business responds by deleting every trace of that preference.
Six months later, an old sales spreadsheet is imported.
The person appears again.
Nobody remembers the objection, so the marketing starts again.
A proportionate suppression mechanism can therefore be an important part of practical direct-marketing governance.
The Information Regulator's Direct Marketing Guidance Note also discusses maintaining a database of objections in the context of the objection framework.
The aim is not to keep unnecessary information forever.
It is to keep enough information, for as long as legitimately necessary, to respect the person's instruction and prevent old records from undoing it.
Your POPIA answer may no longer be the only answer
Direct marketing in South Africa is not governed by POPIA alone.
On 15 April 2026, the Consumer Protection Act Amendment Regulations, 2026 came into effect and introduced the National Consumer Commission's Opt-Out Registry framework.
Where the CPA regime applies, the amended regulations create additional obligations for direct marketers, including registration, annual renewal, identifying the marketer appropriately, honouring relevant pre-emptive blocks and cleansing marketing databases against the Registry on a monthly basis.
The NCC has been providing implementation guidance as the system is rolled out.
Regulation 4(7) prohibits a direct marketer from marketing goods or services to a consumer who has registered a relevant pre-emptive block and requires those records to be removed through monthly cleansing. A business should therefore not treat earlier marketing consent as permission to disregard a current Registry block.
For an SMME, this means direct-marketing governance can no longer sit entirely inside the email platform.
The business needs a process that brings together the POPIA position, its own objection records and the applicable CPA Registry requirements.
A green light in one system does not necessarily mean the campaign has a green light everywhere.
Sales finds an old spreadsheet called "Great Leads"
There are 1,800 names on it.
The employee who created it left two years ago.
Some contacts appear to be former customers. Some are enquiries. Others have no source recorded.
Marketing wants to upload the entire file to the email platform because the business has a new service to promote.
This is the point where an SMME can make the process either complicated or sensible.
The result may be a smaller list.
That is not necessarily a marketing failure.
A list of 900 contacts you can explain may be worth more than 1,800 contacts you cannot.
Could you explain why each category of person is on your next campaign?
You do not need to investigate every contact manually. Start by testing whether the business has reliable rules and evidence for the main groups in the database.
Direct marketing under POPIA
Can we market electronically to our existing customers without obtaining new consent?
Potentially, but only where the requirements of section 69(3) are met. The contact details must have been obtained in the context of a sale, the marketing must concern the responsible party's own similar products or services, and the customer must have received the required opportunities to object.
Is someone who asked for a quotation an existing customer?
Not merely because the business has their contact details. Section 69(3)(a) refers specifically to contact details obtained in the context of the sale of a product or service. A prospect or enquiry should therefore not automatically be treated as qualifying under the customer exception.
If an email address is publicly available, can we use it for electronic direct marketing?
Public availability can be relevant to whether indirect collection is permitted under section 12, but it does not automatically satisfy section 69. The proposed electronic direct marketing still needs its own POPIA assessment.
Does accepting a LinkedIn connection mean the person consented to marketing?
A connection should not automatically be treated as consent to unrelated electronic direct marketing. The Information Regulator's Direct Marketing Guidance Note also identifies direct messaging through platforms such as LinkedIn and Instagram as electronic communication for purposes of its direct-marketing guidance.
Do we still have to use Form 4 to obtain marketing consent?
Current Regulation 6, as amended in April 2025, allows the section 69(2) consent process to use a form substantially similar to Form 4 or the other expedient, free and reasonably accessible methods contemplated in the regulation, including email, telephone, SMS or WhatsApp, facsimile and automated calling. The detailed Regulation 6 requirements must still be followed.
Can we repeatedly ask somebody to consent?
Section 69(2) allows one approach to request consent where consent is required and the data subject has not previously withheld it. Repeated consent requests should therefore not be used to work around an earlier refusal.
If every email has an unsubscribe link, are we compliant?
Not necessarily. Section 69(4) requires identifying information and an address or other contact details through which the recipient can request that the communications cease. That does not replace the requirement to establish that the electronic marketing itself falls within section 69(1).
Does the new NCC Opt-Out Registry replace POPIA?
No. The Registry arises under the Consumer Protection Act framework. POPIA and applicable CPA direct-marketing requirements need to be assessed together where both apply.
Does POPIA apply to B2B marketing?
B2B marketing should not automatically be treated as outside POPIA. POPIA can protect personal information relating to identifiable, existing natural and juristic persons. The actual information, recipient, collection circumstances and marketing activity should be assessed.
A good marketing database remembers more than an email address
Small businesses need to market.
POPIA should not turn every campaign into a legal project.
The practical answer is to build enough discipline into the database that the next campaign does not begin with guesswork.
Know where contacts came from.
Distinguish customers from prospects.
Capture consent properly when you need it.
Remember objections.
Check the applicable consumer-protection requirements.
And be suspicious of the mystery spreadsheet that everybody insists contains "great leads".
The number of names in your database tells you its size. The story behind those names tells you its value.
Know who is on the list. Know why they are there.
The Provara Group POPIA Compliance Programme helps South African SMMEs connect processing records, lawful-processing decisions, privacy notices, data-subject rights, supplier governance, direct-marketing controls, evidence and ongoing compliance into one practical implementation framework.
This guide has been reviewed for alignment, as at 10 September 2026, with the Protection of Personal Information Act 4 of 2013, particularly the definition of direct marketing in section 1; the rights of data subjects in section 5; the processing-limitation and objection provisions in section 11; the indirect-collection provisions in section 12; purpose specification in section 13; further processing in section 15; transparency requirements in section 18; and section 69 concerning direct marketing by means of unsolicited electronic communications.
Section 69(1) prohibits processing personal information for direct marketing by means of electronic communication unless the data subject has consented to the processing or is, subject to section 69(3), a customer of the responsible party.
Section 69(2) provides that where consent is required and has not previously been withheld, a responsible party may approach the data subject only once to request that consent. The consent must be requested in the prescribed manner and form.
Section 69(3) provides that the customer route applies only where the responsible party obtained the contact details in the context of the sale of a product or service; the marketing concerns that responsible party's own similar products or services; and the data subject received a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, when the information was collected and on each marketing communication if the use was not initially refused.
Section 69(4) requires any direct-marketing communication to contain details of the identity of the sender or the person on whose behalf it was sent and an address or other contact details through which the recipient can request that the communications cease.
Regulation 6 of the Regulations Relating to the Protection of Personal Information, 2018 was substituted with immediate effect on 17 April 2025 by Government Notice 6126 in Government Gazette 52523. Current Regulation 6 addresses the section 69(2) consent process and permits a form substantially similar to Form 4 or other expedient, free and reasonably accessible methods contemplated in the regulation, including email, telephone, SMS or WhatsApp, facsimile and automated calling machines. It also contains recording requirements for telephonic and automated-calling consent requests and expressly provides that an opt-out does not constitute consent for purposes of section 69(2).
The Information Regulator's Guidance Note on Direct Marketing in terms of POPIA dated 3 December 2024 provides interpretive guidance concerning electronic and non-electronic direct marketing, lead generation, customer marketing, objections, public sources, further processing, transparency and related matters. The Guidance Note is advisory in nature and itself states that POPIA and the Regulations prevail in the event of inconsistency.
Because the Direct Marketing Guidance Note predates the April 2025 substitution of Regulation 6, this article relies on the amended Regulation 6 for the current consent-request mechanism and uses the Guidance Note for relevant interpretive guidance. References in this article to the Regulator's treatment of direct messaging through platforms such as LinkedIn and Instagram reflect the Regulator's published Guidance Note position.
References to the source and history of marketing contacts also reflect the wider POPIA framework. Section 12 regulates when personal information should be collected directly from the data subject and identifies exceptions, including certain information contained in or derived from a public record or deliberately made public by the data subject. The existence of a section 12 exception does not by itself establish compliance with section 69 for unsolicited electronic direct marketing.
The Consumer Protection Act 68 of 2008 creates a separate consumer-protection framework concerning unwanted direct marketing. On 15 April 2026, the Consumer Protection Act Amendment Regulations, 2026 were published under Government Notice R.7380 in Government Gazette 54521 and took effect on publication. The amended Regulation 4 operationalises the National Consumer Commission Opt-Out Registry and, where the CPA regime applies, includes requirements concerning direct-marketer registration, renewal, identification, pre-emptive blocks and periodic database cleansing.
The National Consumer Commission has been issuing implementation information concerning the Opt-Out Registry during 2026. The NCC has indicated that applicable consumer Registry blocks are intended to be honoured notwithstanding earlier marketing consent. Organisations should therefore assess the current CPA requirements and the NCC's latest operational instructions in addition to their POPIA position before conducting affected direct-marketing activities.
Practical references in this guide to contact provenance, marketing-status fields, suppression records, campaign categorisation, database health checks and retaining the "story behind the contact" describe Provara Group governance approaches. They are not presented as prescribed POPIA document names, mandatory database fields or statutory forms.
The appropriate position can also be affected by an applicable code of conduct, sector-specific legislation, the nature of the recipient, the communication channel, the source of the information, the original collection purpose and other laws that apply to the particular organisation or marketing activity.
Important: This article provides general compliance information and practical governance guidance. It is not legal advice, does not constitute a legal opinion and does not guarantee compliance. Direct-marketing compliance should be assessed against the organisation's actual processing activities, customer relationships, consent records, objections, communication channels, products or services, applicable consumer-protection requirements and operating circumstances.