On 15 April 2026, new regulations (“new regulations”) to the Consumer Protection Act (“CPA”) came into operation. The CPA defines direct marketing as approaching a person, either in person or by mail or electronic communication, for the direct or indirect purpose of— (a) promoting or offering to supply, in the ordinary course of business, any goods or services to the person; or (b) requesting the person to make a donation of any kind for any reason.
The new regulations introduce a system in terms of which a consumer may opt out of direct marketing. The new regulations further require direct marketers to register, make payment to the Commission of a registration, annual, and cleansing fee, and cleanse their database monthly with the Commission.
What has changed?
- All direct marketing must now contain the direct marketer’s name, electronic address, physical address, and contact number. This is done to ensure a recipient is able to identify the direct marketer.
- A direct marketer may not disseminate any electronic communication from a public platform where the originator of the electronic communication is unidentifiable. We pause to point out that direct marketing includes approaching in person, or by mail or electronic communication. The identifiability provision seems to relate only to electronic communication. We are, however, of the humble opinion that in all direct marketing material, whether electronic or not, the sender must be identifiable and must thus comply with paragraph 1 above.
- No direct marketing may be made to any consumer who has registered a pre-emptive block.
- A monthly cleanse of a direct marketer’s database is now compulsory. The cost per data entry submitted to the Commission for cleansing is currently 0.12 cents and will escalate to 0.18 cents by 2029.
- A direct marketer must complete and submit “Annexure P” to the new regulations to register as a direct marketer. The initial registration cost is R2,574.00 and the annual renewal fee amounts to R1,930.00. By 2029, the registration fee will increase to R2,979.73 and the annual renewal fee will be R2,234.80. As the registration fee is a once-off fee, it is advisable to register before the registration fee increase. The first increase is set for 2027, at which time the registration fee will be R2,702.70.
- The new regulations do not replace the Protection of Personal Information Act (“POPIA”), as the CPA and POPIA are to be read together. This means that consent to do direct marketing still needs to be obtained in terms of section 69 of POPIA. Note the provision of section 69(2)(ii), which states one may only approach a consumer once, and such approach must solely be to obtain consent to
direct market to the consumer. Therefore, a direct marketer cannot send direct marketing and a request to send direct marketing in the same correspondence. A direct marketer first needs to send a message (to a consumer who has not registered an opt-out) requesting permission to direct market. Only once the consumer has consented to receiving direct marketing may the direct marketer send a second message or contact the consumer to communicate the direct marketing material. This is easy enough if the correspondence is in writing, as the consent will also be received in writing. Should the consent be requested during a telecommunication, we advise the direct marketer to record the consumer giving consent and store such recording. - Kindly note that The Direct Marketing Association of South Africa’s (“DMASA”) voluntary opt-out registry has been replaced by the new regulations. Therefore, direct marketers can no longer rely on their DMASA registration, as each direct marketer must register individually with the Commission.
- Each direct marketer needs to ensure that the information kept on the opt-out registry is up to date.
What should a direct marketer practically do?
- At the outset, we need to emphasise that the new regulations are indeed new. Thus, there is some uncertainty as to the interpretation of the new regulations, what is expected of a direct marketer, and exactly what compliance with the new regulations looks like.
- The first step would be to register with the Commission as a direct marketer and make the required payments. It is our humble opinion that a company can register with the Commission and all its employees who do direct marketing may then submit their databases under the company. We emphasise this to be only our opinion, and thus we need to await further clarity as to whether the Commission requires each individual direct marketer to register individually.
- Thereafter, on a 30-day cycle, the entire database of the direct marketer needs to be cleansed. This is the process of removing consumers who have opted out of any electronic communication from the direct marketer’s database to ensure such consumers can no longer be contacted.
- Once you have received your cleansed database back from the Commission, you will need to obtain consent in terms of POPIA to do direct marketing.
- A direct marketer may then only send direct marketing to the consumers who have confirmed that direct marketing may be sent to them.
The new regulations confirm that non-compliance with the CPA may result in the issuing of a compliance notice in terms of section 100, calling upon the direct marketer to remedy his/her/its non-compliance. Failure to comply with the notice is a criminal offence and carries a fine or imprisonment of up to 12 months, or both a fine and imprisonment. In addition to the above, an administrative fine of R1,000,000.00 or 10% of the direct marketer’s annual turnover, whichever is greater, may be imposed.
Download the pdf document to read the full article.