Cold electronic outreach in South Africa runs through two laws at once. POPIA section 69 has prohibited unsolicited electronic direct marketing since 2021 and allows one consent request per prospect, ever. The 2026 CPA regulations add a national opt-out registry, compulsory marketer registration with the National Consumer Commission, and monthly list cleansing, phasing in across 2026. What survives: a single lawful consent ask, referrals, inbound, and in-person contact.
What happened in April 2026
On 15 April 2026 the Minister of Trade, Industry and Competition published the Consumer Protection Act Amendment Regulations, with immediate effect. They bring to life the national opt-out registry that section 11(6) of the CPA always promised, administered by the National Consumer Commission.
Five things in the regulations matter to a working sales team:
- Anyone may pre-emptively block unwanted electronic direct marketing by registering once, centrally. You do not get one free message to a registered person.
- Every direct marketer must register with the National Consumer Commission before contacting anyone at all. The prescribed fee starts at R2,574, renewing annually at R1,930.50. An unregistered marketer may not lawfully do electronic direct marketing, full stop.
- Marketing databases must be cleansed monthly against the registry, with records that prove each cleanse happened.
- You must be identifiable in every message: name, electronic address, physical address and a contact number.
- The CPA's reach is broad: its direct-marketing provisions cover telephone, SMS, email, fax and similar technologies, and its "consumer" includes juristic persons below the R2 million threshold, so a large slice of the small-business market sits inside it too.
It is phasing in, and that matters for planning. The regulations took effect on 15 April 2026, but registration of direct marketers and consumers commenced in July 2026, and the registry is expected to be fully operational around September 2026. Read that as a runway rather than a reprieve: registration is open now, and the monthly cleansing duty will land on a database you should already be organising.
The law that was already there
The registry did not arrive into a vacuum. Section 69 of POPIA has prohibited electronic direct marketing without consent since 2021, unless the person is an existing customer under a narrow soft opt-in. Two details make South Africa stricter than most people assume:
- POPIA protects companies, not only people. A juristic person is a data subject here, so "it is B2B" is not the defence it is in Europe.
- The existing-customer exception is narrow. It covers your own customers, for similar goods or services, with an opt-out in every message.
Two things practitioners genuinely disagree about
Live telephone calls. Section 69 names "automatic calling machines, facsimile machines, SMSs or e-mail". A well-argued reading holds that a live human call falls outside that list, because the message is never stored on a system for the recipient to collect later, and several South African compliance practices say plainly that cold calling remains lawful under POPIA. Others read the Regulator's 2024 guidance more broadly. What is not in dispute: once the NCC registry is operational, calling a registered person for direct marketing is prohibited under the CPA, however section 69 is read.
Role-based business addresses. Some commentary distinguishes a generic address aimed at a company (info@, sales@) from a named individual's address, and argues the first sits outside section 69's strictest consent requirement because the target is the legal entity rather than a natural person. Notice the difficulty: that argument is weaker here than it would be in Europe, precisely because South Africa protects legal entities. If a company is itself a data subject, then aiming at the company does not escape the rule, it only changes which data subject you are aiming at. The permissive reading also tends to appear in marketing commentary rather than legal commentary, which is a source with an interest in the answer. It remains unsettled, and it is exactly the question to put to your own attorney rather than to a blog, this one included. Do not plan a quarter around it.
And one thing that is not in dispute, which catches people out. Section 69 covers direct marketing by any form of electronic communication. There is no volume threshold and no craftsmanship exemption: a hand-typed message from a real mailbox to one managing director is exactly as unsolicited as a ten-thousand-contact sequence. Sending fewer, better emails lowers your chance of a complaint. It does not change the law.
Section 69(2) permits exactly one approach to ask for consent, in the prescribed manner and form. One. A prospect who does not respond is not a lead to recycle next quarter; they are off the list permanently. A consent request that also sells something is not a consent request.
Enforcement is not theoretical. The Regulator's enforcement action against a Johannesburg consultancy carried exposure of up to R10 million or ten years' imprisonment.
What a sales team may still do
The lawful contact surface is narrow but real:
- One prescribed-form consent request per prospect, in any medium, containing an opt-in ask and a free opt-out and no marketing content.
- Marketing to people who opted in, and to existing customers within the soft opt-in's limits.
- Referral introductions through existing relationships.
- Inbound. Someone who finds you and asks is always fair.
- Events and in-person conversation.
- Live telephone calls, on the permissive reading above, and only until the registry is operational, after which registered numbers close. Treat it as the contested channel it is.
The teams that treat this as a design constraint, rather than a compliance tax, are quietly building the only marketable audiences that will exist in this country: audiences that said yes.
The checklist
- Confirm your firm's NCC direct-marketer registration exists before the next send. If it does not, stop sending until it does.
- Consolidate every opt-out you hold into one suppression list: channel unsubscribes, POPIA objections, registry entries. Any one of them suppresses.
- Cleanse against the registry monthly and keep the receipts.
- Rebuild the cold sequence around one consent request per prospect, with no pitch inside it.
- Record, for every contact record, the lawful basis you hold: consent, existing customer, referral, or inbound.
- Stop buying lists. A purchased contact's consent cannot be audited, which makes it the highest-risk record you can own.
- Brief whoever makes calls on where that disagreement sits, and plan for the registry to close registered numbers either way.
Corrected 9 August 2026. An earlier version of this page stated that a live telephone call is settled to be electronic communication under section 69, and did not carry the registry's phase-in dates. Both are fixed above, and the disagreement is now shown rather than resolved on your behalf. We publish our corrections for the same reason we publish our sources.
Updated 9 August 2026. Added the point that section 69 draws no distinction between a hand-typed message and a bulk sequence, and set out why the role-based-address argument is weaker in South Africa than in Europe. No earlier claim was withdrawn; both notes make the page less comfortable to read, which is usually the sign that it is more useful.
This is how our acquisition engine is built
Intric Solves designed its client acquisition engine after these rules took effect, not before: consent checked before every send, decliners never contacted again, no purchased lists, ever. If you want meetings on your calendar without gambling your brand on the old playbook, start with a conversation.
SEND US THE PROBLEM