POPIA is less onerous than most South African small businesses fear and stricter than many currently practise. The core requirement is straightforward: you need a lawful basis for processing someone's personal information, and for direct marketing to people who are not already your customers, that basis is consent.

This is general guidance rather than legal advice. For anything high-risk, take advice on your specific circumstances.

What consent has to look like

Voluntary, specific and informed. In practice that means four things.

Opt-in, not opt-out. An unticked box the person chooses to tick. Pre-ticked boxes and "by submitting you agree to receive marketing" bundled into a form do not meet the standard.

Separate from other terms. Consent to be marketed to is a different thing from agreeing to your terms of service, and should be a separate choice.

Specific about what you will send. "Monthly updates and offers" is meaningful. "Communications" is not.

Easy to withdraw. A working unsubscribe link in every message, honoured promptly.

The existing customer exemption

POPIA permits direct marketing to existing customers about similar products or services, where you obtained their details in the course of a sale and gave them a chance to opt out at that point and in every message since.

This is narrower than it sounds. It covers your actual customers and similar offerings. It does not cover people who once enquired, entered a competition or downloaded something, and it does not cover unrelated products.

Your enquiry form

A common and important distinction. When someone submits a contact form, processing that enquiry is covered by the purpose they submitted it for. You can reply, quote and follow up on that enquiry.

Adding them to your monthly newsletter is a different purpose and needs its own consent. That is why a separate, unticked marketing opt-in checkbox belongs on the form.

Collect less

POPIA requires that you collect only what is adequate and not excessive for the purpose. Most South African lead forms ask for more than they need, which is both a compliance issue and a conversion problem.

If you do not need a physical address to quote, do not ask for one. Shorter forms comply better and convert better, which is a rare alignment.

Tracking pixels and analytics

Tracking that profiles an identifiable person needs a lawful basis. The workable approach is a consent tool that holds marketing and analytics tags until the visitor accepts, rather than firing them the moment the page loads.

Most consent platforms support this directly, and configuring it is a settings change rather than a development project.

A practical checklist

Unticked marketing opt-in on every form, separate from terms. A privacy notice saying what you collect, why, and how long you keep it. Working unsubscribe in every message. Consent-gated tracking. Only the fields you genuinely need. A record of when and how each person consented. An appointed Information Officer, which for most small businesses is the owner, registered with the Information Regulator.

Why it is worth doing properly

Beyond the legal position, consent-based lists perform better. People who chose to hear from you open, click and buy at rates that purchased lists never approach. The compliant route is also the effective one.

Juicy Designs builds compliant lead capture into lead generation and email marketing. See how to build a list from scratch for the practical side.

Frequently asked questions

How does POPIA affect email marketing and lead capture?

POPIA requires a lawful basis for processing personal information, and for direct marketing to people who are not existing customers that basis is consent. In practice it means opt-in rather than pre-ticked boxes, a clear statement of what you will send, an easy way to opt out, and only collecting the information you actually need.

Can I email people who have not opted in?

Only in limited circumstances. POPIA allows direct marketing to existing customers about similar products where the details were obtained in the course of a sale and an opt-out was offered. Cold emailing purchased lists does not qualify.

Do I need consent for a contact form?

Processing an enquiry someone submitted is generally covered by the purpose they submitted it for. Adding them to a marketing list afterwards is a separate purpose and needs separate consent, which is why a distinct marketing opt-in checkbox matters.

What about tracking pixels and analytics?

Tracking that profiles an identifiable person needs a lawful basis. The practical approach is a consent tool that holds marketing and analytics cookies until the visitor accepts, rather than firing them on arrival.

What are the penalties?

POPIA provides for administrative fines and, in serious cases, criminal sanction. For most small businesses the realistic risk is a complaint to the Information Regulator and the reputational cost, rather than a maximum penalty, but the compliance steps are inexpensive enough that the calculation is straightforward.