Email marketing and POPIA: how to build a list and send emails legally in South Africa.

You want to send a newsletter, a sale announcement or a monthly special to people who might buy from you. Then someone mentions POPIA, and you are not sure whether the email addresses you already have are safe to use. Or you send anyway, and half of it lands in spam.

This guide covers both problems. First, the POPIA rules for email marketing in plain words: who you may email, how to ask for consent, the existing-customer exception and the records to keep. Then how to set up your sending so your emails reach the inbox.

The POPIA direct marketing rules in plain words

Email marketing falls under section 69 of the Protection of Personal Information Act (POPIA), which covers direct marketing by email, SMS and other electronic communication.

The starting point is a ban. You may not send someone direct marketing by email unless one of two things is true:

1. They have given consent to receive it, or
2. They are your customer, and you meet the conditions for the customer exception set out further down.

"Direct marketing" is broad: any approach that promotes your goods or services, directly or indirectly, or asks for a donation. A newsletter with a special offer counts, and so does a "we miss you" email with a discount code.

Consent under POPIA means a voluntary, specific and informed expression of will. Silence is not consent, a pre-ticked box is not voluntary, and the business has to prove consent was given, not the other way round.

This guide explains the law in general terms and is not legal advice.

How to build an email list in South Africa legally

The cleanest list is one where every person asked to join, through your website sign-up form, your checkout or a sign-up sheet at your counter.

The Information Regulator's guidance says consent for electronic direct marketing should be obtained on Form 4, which the Regulator prescribes, or a form that is substantially similar. A sign-up form that captures the same things is the safe approach. Make sure it:

• Asks a clear question, such as "Send me news and offers by email", with a box the person ticks themselves.
• Says what you will send, for example new stock, specials and event invitations. Form 4 asks the business to name the goods or services it will market.
• Names the channel. Consent to email is not consent to SMS or WhatsApp.
• Links to your privacy notice, which says who you are, why you collect the details and how to object or complain.

Double opt-in, where the person clicks a link in a confirmation email, is not a legal requirement. It is still worth doing, because it proves the address is real and its owner agreed.

Bought and rented lists

Do not buy or rent an email list. The Regulator's guidance treats selling or renting contact lists as further processing under sections 15 and 18 of POPIA, and the people on it have not consented to hear from you.

The one-time consent request

POPIA allows one approach to a person who is not your customer, only to ask for consent. Three rules apply:

• You may ask only once. If they ignore you, that is not a yes, and you may not ask again.
• You may not ask someone who has already said no.
• The first message must be the request, not a sales pitch with a consent line at the bottom.

The Regulator's guidance says an emailed version of Form 4 is fine, ending with "I give my consent" and "I do not give my consent" options.

The existing-customer exception and its limits

You can email marketing to your own customers without separate opt-in consent, but only when all three of these conditions hold:

1. You got their contact details in the context of a sale of a product or service. A person who bought from your online shop qualifies. Someone who only sent an enquiry does not.
2. You market your own similar products or services. The Regulator's example is a clothing shop: shoes and belts are similar to clothes, funeral cover is not.
3. They had a free, simple chance to object when you collected their details, and they get that chance again in every marketing email.

The third condition is the one most often missed. If your checkout never asked about marketing, the Regulator's view is that you cannot treat the customer as having agreed. The fix is an unticked, plainly worded marketing box at checkout.

A plain order confirmation is not direct marketing. Adding a "you might also like" block or a discount code can make it one.

What every marketing email must contain

Section 69(4) says every direct marketing message must include:

• Who it is from: the business sending it, or the business it is sent for.
• A way to ask for the messages to stop: an address or other contact details.

In practice, put your business name and contact details in the footer, with a visible unsubscribe link. When someone unsubscribes, stop promptly and for good.

Records to keep

If a complaint reaches the Regulator, records are your defence. Keep:

• Proof of consent for each person: the date, where they signed up, and the exact wording they agreed to.
• A do-not-contact list of everyone who refused consent, unsubscribed or objected. The Regulator's guidance says businesses must keep this list, so check every new import against it.
• Your sign-up form, checkout wording and privacy notice, with the date each version went live.

What the Information Regulator has said and done about direct marketing

Three recent steps show where the Regulator stands.

• February 2024: the first enforcement notice on direct marketing. It went to FT Rams Consulting, a training company that kept emailing a person about its courses after repeated opt-out requests. The Regulator found it broke section 69 by never asking for consent first, and said offering an opt-out did not fix that. It was ordered to stop, to make its first message a consent request on the prescribed form, and to keep a database of people who had refused. Failing to comply with an enforcement notice is an offence that can carry a fine of up to R10 million, prison of up to ten years, or both.
• December 2024: the Guidance Note on Direct Marketing. It is advisory, but shows how the Regulator reads the law. It treats phone calls, push notifications, Instagram or LinkedIn direct messages and cookies as electronic communication, alongside email and SMS.
• April 2026: a statement on the new Consumer Protection Act regulations. The regulations gazetted on 15 April 2026 deal with unsolicited marketing, including an opt-out registry. The Regulator said POPIA consent is still needed whether or not a person is on that registry. Not opting out does not mean opting in.

Deliverability: getting your emails into the inbox

Send from your own domain

Send as news@yourbusiness.co.za, not a free Gmail or Outlook address. You cannot authenticate a domain you do not control, and mailbox providers check that the From address matches the domain that passed SPF or DKIM.

Set up SPF, DKIM and DMARC

These three DNS records prove an email really came from you. Google's sender guidelines require every sender to Gmail addresses to have SPF or DKIM. Anyone sending more than 5,000 messages a day to Gmail must have all three, plus one-click unsubscribe. Our guide to SPF, DKIM and DMARC walks through the setup step by step.

Keep your list clean

• Remove hard bounces after each send. Many newsletter tools do this for you.
• Prune inactive readers. Send one re-engagement email to people who have not opened anything in a year, then remove those who stay quiet.
• Watch spam complaints. Google asks senders to stay below a 0.3% spam rate and recommends staying below 0.1%. A consent-based list is the best way to stay there.
• Keep emails light. Many people read email on a phone using mobile data, so use a few small images, not one large one.

What to do next

Start with three checks. Make sure the marketing box on your sign-up form and checkout is unticked and clearly worded. Make sure every marketing email has your business details and a working unsubscribe link. Then run your domain through our free email domain health check to see which records need fixing.

If you would like help with your sign-up flow, newsletter tool and DNS records, we can set them up as part of a website project. You can reach us through the contact page.