Say goodbye to spam calls in South Africa

The Information Regulator has published amendments to the Protection of Personal Information Act (POPIA) Regulations, which include new rules for direct telemarketers in South Africa.

The new regulations, effective from 17 April 2025, introduce requirements such as recording telephonic consent when a direct marketer first contacts a data subject.

This also applies to direct marketers using automated calling machines.

According to Bowmans’ partner Nadine Mather and senior associate Pascale Towers, these consent recordings must be made available to data subjects upon request.

“This requirement aligns with the Guidance Note on Direct Marketing released by the Information Regulator late last year,” they said.

The new regulations also specify that organisations intending to send direct marketing communications to people who aren’t existing customers must first obtain their consent.

Marketers must obtain consent in a manner that is convenient, free of charge, and reasonably accessible to the data subject.

This can include channels like email, telephone, SMS, WhatsApp, or automated calling machines.

Another notable change surrounds opt-out clauses for direct marketing.

“Opt-out shall not constitute consent,” the Information Regulator states.

According to Bowmans, providing a data subject with a means to opt out of direct marketing communications is insufficient if the person doesn’t exercise the right to opt out.

Therefore, marketers must obtain explicit consent from customers even if they offer an opt-out clause.

“This does not mean that the data subject has provided their consent to be contacted or have their personal information processed,” writes Mather and Towers.

“Consent in this context requires a positive action.”

Effectively, this means that data subjects must opt in to receiving direct marketing communications.

The Information Regulator has also made changes to the document required for consent. While previous regulations required using “Form 4” for consent, they now allow consent to be obtained in a form that is “substantially similar to” Form 4.

However, marketers must still specify the goods and services to be marketed and obtain the data subject’s consent to receive marketing communications for those products, including their preferred method of communication.

The Information Regulator also changed the regulations relating to access for data subjects.

The amendments provide multi-channel access for data subjects to object to processing their information, or request the correction or deletion of their personal information free of charge.

This can be done by hand, fax, post, email, SMS, WhatsApp, or any other convenient method for the data subject.

Marketers are now also required to explicitly inform data subjects of their right to object to processing their personal information.

When a request for the correction or deletion of personal information is received, marketers must inform the data subject of the action taken in response to their request within 30 days of receipt.

New no-call list in the pipeline

The Department of Trade, Industry, and Competition (DTIC) says it plans to launch a new national opt-out register for direct marketers in the 2025/26 financial year.

This would put the launch at any time between 1 April 2025 and 31 March 2026.

Acting commissioner at the National Consumer Commission (NCC), Hardin Ratshisusu, said the new no-call list will give the NCC full sight of all direct marketers in South Africa.

“The Minister of Trade and Industry has published an amendment to the current regulations. The main thing here is there now has to be a national opt-out register that will be managed by the National Consumer Commission,” he said.

“We do appreciate that there are current external registers, but there is a concern that with the existing structures and frameworks, we still have a lot of abuse of consumers.”

Ratshisusu said the DTIC was developing the processes and regulations surrounding the new no-call list and the registration of direct marketers.

The DTIC told MyBroadband that the register will enable residents to restrict or block unwanted communication from direct marketers.

Marketers themselves must also register and clear their list of marketing leads before launching a campaign.

“A cleansed consumer list will be valid for 30 days,” the DTIC said.