What Is POPIA?
POPIA stands for the Protection of Personal Information Act (Act 4 of 2013). It is South Africa's primary data privacy legislation, modelled closely on the European Union's GDPR principles.
The Act became fully enforceable on 1 July 2021, giving South African businesses a one-year grace period to align their operations.
Since that date, non-compliance can result in fines of up to R10 million or imprisonment of up to 10 years for the most serious offences.
For digital marketers, POPIA is not abstract legal theory.
It directly affects how you build and maintain email lists, how you obtain consent before sending promotional messages, how long you may retain subscriber data, and what you must do when a subscriber asks to be forgotten.
Every marketing database in South Africa is subject to the Act, regardless of whether the data was collected online or offline.
The law identifies eight conditions for lawful processing of personal information: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.
In plain terms: you must collect only what you need, tell people why you are collecting it, keep it secure, and give people meaningful control over their own data.
A Johannesburg retailer that buys a third-party email list and blasts it without consent would be in direct violation of POPIA, regardless of whether recipients are based in South Africa or overseas.
The Information Regulator is the independent body responsible for enforcing POPIA in South Africa. Complaints can be lodged directly with the Regulator, and investigations can lead to enforcement notices, administrative fines, or referrals to the National Prosecuting Authority.
POPIA In Practice
Consider a Cape Town e-commerce clothing brand building its email marketing list. Under POPIA, the brand must obtain specific, informed, and voluntary consent before adding anyone to its newsletter. A pre-ticked checkbox buried in the terms and conditions does not constitute valid consent.
Instead, the sign-up form must clearly state what communications the subscriber will receive, and the brand must retain a record of when and how that consent was obtained.
Every marketing email the brand sends must include a clear and functional unsubscribe mechanism. Once a subscriber opts out, the brand must honour that request within a reasonable period, typically within 10 business days at most, and must not continue sending promotional messages.
The brand is also obliged to update or delete a subscriber's personal data on request, and must implement reasonable technical and organisational safeguards to protect that data from unauthorised access or leaks.
For smaller South African businesses, appointing an Information Officer and documenting a basic data processing register are practical starting points for demonstrating compliance.
What POPIA requires from marketers
The Protection of Personal Information Act governs how South African organisations collect, store and use personal information. For marketing teams, four obligations do most of the work.
- A lawful basis for processing. Consent is the most common for marketing, but not the only one. Existing customers can be contacted about similar products under narrower conditions.
- Consent that is specific and demonstrable. No pre-ticked boxes, no bundling into terms acceptance, and a record of what was agreed and when.
- Purpose limitation. Data collected for a quote cannot be repurposed into a newsletter list without a fresh basis.
- An easy opt-out in every direct electronic communication, honoured promptly.
Section 69 deals specifically with direct marketing by electronic means, which covers email, SMS and WhatsApp. It is the section most marketing activity touches.
What compliance looks like in practice
| Activity | What you need |
|---|---|
| Newsletter signup | Unticked consent checkbox, clear description of what they will receive, stored timestamp |
| Quote or contact form | Consent for contact about that enquiry; separate consent if you want to market later |
| WhatsApp follow-up | Same basis as email; treat it as direct electronic marketing |
| Purchased lists | No lawful basis. Do not use them |
| Website analytics and pixels | Privacy notice disclosure and, for non-essential tracking, a genuine choice |
The practical test most businesses fail is evidence. If you cannot show when and how someone consented, you cannot demonstrate compliance. Keep the record with the contact, not in a spreadsheet nobody maintains.
See opt-in, double opt-in and our email marketing service. This is general information, not legal advice.
FAQ
Does POPIA apply to email marketing in South Africa?
Yes. POPIA requires that South African businesses obtain consent before sending marketing emails, clearly identify themselves as the sender, provide an opt-out mechanism in every message, and honour unsubscribe requests promptly. Non-compliance can attract fines of up to R10 million or criminal penalties.
What is the difference between POPIA and GDPR?
POPIA is South Africa's domestic data protection law, while GDPR is the European Union's equivalent. Both require consent, transparency, and data subject rights, but GDPR is generally stricter on breach notification timelines. South African businesses serving EU customers must comply with both laws simultaneously.
Does POPIA apply to email marketing in South Africa?
Yes. Direct marketing by electronic means, including email, SMS and WhatsApp, falls under POPIA section 69. You need a lawful basis, usually consent, a record of it, and a working opt-out in every message.
Can I market to people who bought from me before?
Existing customers can be contacted about similar goods or services under narrower conditions than cold contacts, provided they were given the chance to opt out when their details were collected and in every message since. Keep the messaging related to what they actually bought.