Back to Insights

Complying with POPIA in Direct Marketing

POPIA has important implications for newsletters, email campaigns and social media targeting. Understanding how consent works across different channels is essential for compliant digital marketing.

Complying with POPIA in Direct Marketing

From 1 July 2021, organisations operating in South Africa are required to comply with the Protection of Personal Information Act, more commonly known as POPIA.

For businesses involved in digital marketing, newsletters and social media campaigns, this has important implications. Understanding how personal data may be collected, stored and used is essential to ensure compliance.

What is POPIA?

POPIA stands for the Protection of Personal Information Act. The legislation regulates how organisations collect, store and use personal information relating to identifiable individuals and organisations.

Personal information may include:

  • Name and surname
  • Race and gender
  • Contact information
  • Financial information
  • Medical information
  • Employment or criminal history
  • Educational information

What is direct marketing?

The Consumer Protection Act defines direct marketing as approaching a person, either in person or through electronic communication, to promote or offer goods, services or donations.

Under Section 69 of the POPI Act, direct marketing includes forms of electronic communication such as automatic calling machines, facsimile machines, SMS messages and email.

In practical terms, this means newsletters, email campaigns and certain forms of targeted digital communication may fall within the scope of direct marketing.

If a user subscribes to your newsletter through your website, they have given consent to receive that newsletter. That does not automatically mean their information may be used for other forms of promotion or targeting.

For example, if you collect subscriber information for a newsletter and then use that same database to target those users directly on a social media platform, you may be acting outside the purpose for which that information was originally collected.

Personal information should only be used for the purpose for which it was obtained.

By contrast, if you are targeting unknown audiences in a defined area, without using identifiable personal information, this may not fall within the same category.

As a general principle, if promotional content is sent to identifiable users, the Information Regulator may view it as direct marketing. In those cases, users should give consent for each direct marketing channel through which they are contacted.

For consent to be valid under POPIA, it should be:

  • Specific about what the user can expect, which products or services may be promoted, and which channels may be used
  • Explicit through a clear opt-in mechanism, such as a visible unticked checkbox
  • Voluntary, and not hidden in terms and conditions or made a condition of access to a service
  • Clear, given through an unambiguous affirmative action rather than pre-ticked boxes or confusing wording
  • Informative, so the user understands what information is being collected, how it will be used, and whether it will be shared with third parties
  • Understandable, written in clear language and not open to misinterpretation
  • Flexible, allowing users to update their preferences or unsubscribe easily
  • Transparent, so users may access or review the information held about them

A useful rule of thumb is this: users should never be surprised to hear from you.

How G2 helps clients manage subscriber data

When implementing newsletter and digital marketing systems for clients, we place strong emphasis on secure data handling and clear consent management.

Subscription forms can be connected directly to a central database so that information is stored and managed with minimal manual handling. This reduces unnecessary exposure and helps ensure that personal information is handled responsibly.

Users should also be able to update their details, adjust communication preferences and unsubscribe with ease.

If you need help implementing secure newsletter subscription systems or reviewing how customer data is used in your marketing activities, feel free to contact us at [email protected].

Disclaimer: This article is provided for general informational purposes and should not be regarded as legal advice. Please consult your attorney for legal guidance.