Cold electronic outreach in South Africa now runs through two laws at once. POPIA allows one consent request per prospect, ever, and treats phone calls as electronic communication. The 2026 CPA regulations add a national opt-out registry, compulsory marketer registration with the National Consumer Commission, and monthly list cleansing. What survives: a single lawful consent ask, referrals, inbound, and in-person contact.
What happened in April 2026
On 15 April 2026 the Minister of Trade, Industry and Competition published the Consumer Protection Act Amendment Regulations, with immediate effect. They bring to life the national opt-out registry that section 11(6) of the CPA always promised, administered by the National Consumer Commission.
Five things in the regulations matter to a working sales team:
- Anyone may pre-emptively block unwanted electronic direct marketing by registering once, centrally. You do not get one free message to a registered person.
- Every direct marketer must register with the National Consumer Commission before contacting anyone at all. The prescribed fee starts at R2,574, renewing annually at R1,930.50. An unregistered marketer may not lawfully do electronic direct marketing, full stop.
- Marketing databases must be cleansed monthly against the registry, with records that prove each cleanse happened.
- You must be identifiable in every message: name, electronic address, physical address and a contact number.
- "Electronic communication" is broad: telephone, SMS, email, fax and similar technologies are all inside the net. And the CPA's "consumer" includes juristic persons below the R2 million threshold, so a large slice of the small-business market is covered too.
The law that was already there
The registry did not arrive into a vacuum. Section 69 of POPIA has prohibited electronic direct marketing without consent since 2021, unless the person is an existing customer under a narrow soft opt-in. Two details make South Africa stricter than most people assume:
- POPIA protects companies, not only people. "It is B2B" is not a defence here the way it is in Europe.
- A phone call counts as electronic communication. The Information Regulator's December 2024 guidance note closed the cold-call loophole explicitly.
Section 69(2) permits exactly one approach to ask for consent, in the prescribed manner and form. One. A prospect who does not respond is not a lead to recycle next quarter; they are off the list permanently. A consent request that also sells something is not a consent request.
Enforcement is not theoretical. The Regulator's enforcement action against a Johannesburg consultancy carried exposure of up to R10 million or ten years' imprisonment.
What a sales team may still do
The lawful contact surface is narrow but real:
- One prescribed-form consent request per prospect, in any medium, containing an opt-in ask and a free opt-out and no marketing content.
- Marketing to people who opted in, and to existing customers within the soft opt-in's limits.
- Referral introductions through existing relationships.
- Inbound. Someone who finds you and asks is always fair.
- Events and in-person conversation.
The teams that treat this as a design constraint, rather than a compliance tax, are quietly building the only marketable audiences that will exist in this country: audiences that said yes.
The checklist
- Confirm your firm's NCC direct-marketer registration exists before the next send. If it does not, stop sending until it does.
- Consolidate every opt-out you hold into one suppression list: channel unsubscribes, POPIA objections, registry entries. Any one of them suppresses.
- Cleanse against the registry monthly and keep the receipts.
- Rebuild the cold sequence around one consent request per prospect, with no pitch inside it.
- Record, for every contact record, the lawful basis you hold: consent, existing customer, referral, or inbound.
- Stop buying lists. A purchased contact's consent cannot be audited, which makes it the highest-risk record you can own.
- Brief whoever makes calls: a call is an electronic communication.
This is how our acquisition engine is built
Intric Solves designed its client acquisition engine after these rules took effect, not before: consent checked before every send, decliners never contacted again, no purchased lists, ever. If you want meetings on your calendar without gambling your brand on the old playbook, start with a conversation.
kamau@intricsolves.com