Lead sequences and auto-replies within POPIA
How a South African firm can set up lead auto-replies, follow-up sequences, web forms and newsletters so they stay within POPIA's direct marketing rules.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa
An accounting firm that switches on lead automation usually does it for a good reason. Enquiries arrive at night and over weekends, partners forget to follow up, and a prospect who heard nothing for a week has often signed with someone else. Automatic replies and follow-up sequences fix that.
They also send e-mails nobody reads first, to people who may never have agreed to hear from the firm. In South Africa, that brings POPIA's direct marketing rules into play. This article explains where the line falls and how to set up each piece of automation so it stays on the right side of it.
An enquiry is not a licence to market
The POPIA text published on the government's site prohibits direct marketing by electronic communication, including SMS and e-mail, unless the person has consented or is an existing customer. A person who is not a customer may be approached only once to request consent.
The Information Regulator's guidance note on direct marketing, dated 3 December 2024, puts it in operational terms: a business must obtain a non-customer's consent before sending direct marketing electronically, so the first message may only be a request for consent, and it may approach that person only once. The note also makes clear that silence cannot be treated as consent.
So a prospect who filled in a contact form asking about a tax return has asked about a tax return. That is not, by itself, agreement to receive the firm's newsletter, its year-end promotions or a multi-step sales sequence.
Acknowledgements and marketing are different messages
A reply that answers what the person asked is different in purpose from a message that promotes the firm's services. Keep the two apart.
Achekam lets a firm switch on an automatic acknowledgement e-mail to each lead a connector captures. The e-mail is written by AI from a fixed preset and sent without anyone reading it first. It is off until an administrator switches it on, and by default goes at most once per address per day.
Because nobody reads each one, the preset is where the firm exercises its judgement. Before switching it on:
- read several sample acknowledgements the preset produces;
- keep it to confirming the enquiry and saying who will respond and how;
- leave out offers, other services and invitations to subscribe;
- make sure it names the firm and gives a way to ask for no further messages.
Sequences that stop when they should
Achekam's follow-up sequences combine tasks and AI-written e-mails. Once switched on, a sequence enrols leads and stops when the lead replies, books a meeting, is won or lost, or says it is not interested. A new sequence starts paused, sequence e-mails are sent without anyone reading each one, and no address receives more than one automatic e-mail in 12 hours.
Those stop rules are useful, but they do not answer the consent question. A sequence of several e-mails to someone who never consented and is not a customer goes beyond the single approach the Act allows. Two set-ups fit better:
- For leads who have consented, such as those who ticked the firm's marketing consent on a form, a multi-step sequence can run, with an opt-out in every message.
- For leads who have not, design a sequence with one e-mail that asks for consent, and make the remaining steps tasks for staff, such as checking whether the lead replied.
Leave each new sequence paused until a partner has read every step.
Consent wording on web forms
Achekam lets a firm design web forms for its website, each with its own public address. A submission creates a lead, or adds to a recent lead with the same e-mail. Forms start paused, suspected robot submissions are logged as spam, and the submitter must accept the firm's consent wording before submitting.
That wording is the firm's to write, and it matters. The Regulator's guidance note says a business bears the onus of proving that a person consented. Wording that runs "we may contact you about our services" inside a general privacy statement makes that proof harder than a clear, specific statement of what the person is agreeing to receive. For the drafting itself, see ethical marketing e-mails and forms.
Newsletters, opt-outs and the "not interested" list
Achekam lets a firm keep a mailing list, design newsletters and send or schedule campaigns, with an unsubscribe link in every letter. That link answers one of the guidance note's requirements: every direct marketing message must identify the sender and give an address or contact details where the recipient can ask for the messages to stop.
One behaviour needs attention. A lead marked "Not interested" is added to the mailing list automatically. Under the guidance note, someone who said no has not consented, and a business must keep a database of people who have withheld consent or objected to direct marketing. Before each campaign, review who came onto the list this way, and do not send marketing to anyone who has not consented or is not a customer.
Existing clients are treated differently. The guidance note says a business may market electronically to an existing customer only its own similar products or services, only where it obtained the contact details in a sale, and only if the customer had a free and simple chance to object when the details were collected and in every message. More on consent itself is in POPIA consent for direct marketing.
A checklist before switching anything on
- Acknowledgement preset read and limited to the enquiry.
- Every sequence reviewed step by step while paused.
- Separate sequences for consented and unconsented leads.
- Web form consent wording specific enough to prove what each person agreed to.
- Mailing list reviewed for "Not interested" additions before each send.
- A record of objections and withdrawals kept and respected.
The guidance worth reading in full
The Information Regulator's guidance note on direct marketing explains how POPIA regulates electronic marketing, including consent and marketing to existing customers. Read it with the person who set up your automation, then go through each preset, sequence and form against it before the next lead arrives.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
