POPIA-Safe Marketing: What South African Businesses Can and Cannot Do With Customer Data

Why POPIA matters to small businesses

The Protection of Personal Information Act (POPIA) regulates how personal information is processed in South Africa.

A business does not need to be large to handle personal information.

A small retailer may collect customer names and telephone numbers. A service provider may store addresses and quotation details. An accountant may process financial and employee information.

All of these activities involve personal information.

POPIA is therefore relevant to sole proprietors, start-ups, small businesses and larger organisations.

What counts as personal information?

Personal information includes information relating to an identifiable person.

Examples include:

• Full names.
• Telephone numbers.
• Email addresses.
• Home addresses.
• Identification numbers.
• Employment details.
• Financial information.
• Customer records.
• Photographs that identify individuals.
• Information about an individual’s preferences or activities.

A list of customer WhatsApp numbers is also personal information.

Understand the difference between collecting and using information

A customer giving your business their telephone number does not automatically give permission for every type of marketing communication.

For example:

A customer provides their number so that a furniture manufacturer can confirm a delivery.

The business can use the information for the agreed delivery-related purpose, subject to applicable lawful-processing requirements.

That does not automatically mean the business can add the customer to a regular promotional broadcast list.

The purpose for which information is collected matters.

Direct electronic marketing under POPIA

Section 69 of POPIA regulates unsolicited electronic direct marketing.

The general position is that electronic direct marketing requires consent, subject to the limited existing-customer exception in the Act.

The existing-customer exception is not a general permission to market anything to anyone who has ever purchased from your business.

It applies under specific conditions, including marketing similar products or services and providing an appropriate opportunity to object.

Before launching an email or WhatsApp campaign, understand which legal basis applies to the communication.

What businesses should do before sending marketing messages

1. Obtain the required consent

Where consent is required, obtain it before sending direct electronic marketing.

Use a clear explanation of what the person is agreeing to receive.

2. Record consent

Keep a record of:

• Who gave consent.
• When consent was given.
• How it was given.
• What type of communication was authorised.
• Whether consent was later withdrawn.

3. Provide a simple opt-out method

Customers should be able to object or unsubscribe from marketing communications.

Make sure staff know how to process these requests.

4. Respect the purpose of collection

Do not collect information for one purpose and automatically use it for unrelated marketing.

5. Protect customer information

Limit access to customer records and use appropriate security measures.

WhatsApp marketing: practical examples

Example 1: A customer requests a quotation

The customer sends their number and asks for a quotation.

The business can use that contact information to respond to the quotation request and handle the related transaction.

Example 2: A customer buys a product

The business may communicate with the customer about delivery, payment, warranties or other relevant aspects of the purchase.

Promotional marketing must be assessed separately against POPIA’s requirements.

Example 3: A business collects numbers from a public Facebook page

The fact that a number is publicly visible does not automatically give the business permission to send unsolicited marketing messages.

Example 4: A customer asks to stop receiving promotions

The business must respect the objection and update its marketing records.

A simple consent message

Where consent is required and the appropriate process is being used, a business could use clear wording such as:

Would you like to receive occasional WhatsApp updates from [Business Name] about our products, services and special offers? You can opt out at any time by replying STOP.

The exact consent request and process must meet the applicable legal requirements. Do not treat a generic message as a substitute for checking section 69 and the prescribed requirements.

What about email marketing?

Email marketing is also covered by the direct electronic marketing rules.

Businesses should:

• Use appropriate consent or a valid statutory exception.
• Identify the sender.
• Explain the purpose of communication.
• Provide an effective way to opt out.
• Maintain a suppression list so that opted-out contacts are not added again.
• Keep customer data secure.

Purchasing an email database does not automatically create permission to market to everyone on it.

The Information Officer and business responsibilities

Businesses should understand their obligations as responsible parties and ensure that the appropriate Information Officer arrangements are in place.

The business should know:

• What personal information it collects.
• Why it collects it.
• Where the information is stored.
• Who can access it.
• Whether it is shared with service providers.
• How long it is retained.
• How people can exercise their rights.

A privacy policy should explain the business’s information-handling practices in a clear and accessible way.

Check the current rules

The rules and regulations on objections, deletion requests and direct marketing have been amended in recent years.

Businesses should check the current POPIA text, the applicable regulations and the Information Regulator’s official guidance when implementing consent requests and opt-out procedures. Do not assume that a change to one process removes the other obligations under POPIA.

Common POPIA mistakes

• Adding every customer to a WhatsApp broadcast list.
• Assuming a saved number means consent.
• Buying customer contact lists without checking the lawful basis.
• Sharing customer information with third parties without an appropriate basis.
• Failing to honour opt-out requests.
• Collecting more information than the business needs.
• Giving every employee access to customer records.
• Keeping information indefinitely without a justified retention basis.
• Having a privacy policy that does not reflect actual business practices.

A simple customer-data audit

Use this checklist to review your business.

Frequently asked questions

Yes. There is no general small-business exemption from the core requirements of POPIA.

You can respond to their enquiry and communicate about the matter for which they contacted you, subject to the applicable legal basis. Promotional marketing requires a separate assessment under the direct-marketing rules.

Do not assume you can. Make sure you have the required consent or that a valid statutory exception applies, and provide an effective way to object.

There is a limited existing-customer exception under section 69, subject to conditions. It is not unlimited permission to send any promotion.

Record the objection and stop the relevant marketing communication. Ensure the contact is not accidentally re-added to future campaigns.

Only where there is an appropriate lawful basis and suitable safeguards and agreements. A service provider handling personal information must be managed in accordance with POPIA’s requirements.

Consequences can include enforcement notices, administrative fines, civil claims and criminal consequences for specified offences. The applicable outcome depends on the nature of the violation.

Your next action

Audit your WhatsApp contacts, email lists and customer databases. Identify which records are used for marketing, check the lawful basis for that use, and make sure customers can exercise their rights.