Marketing to existing customers under POPIA
When a South African business may e-mail or SMS marketing to its existing customers without fresh consent, and the opt-out it must offer every time.
By Achekam · · 5 min read · For Running a business businesses in South Africa
A garden-service company wants to tell last year's clients about its new irrigation offering. A hair salon wants to tell its regular clients about a new treatment. An office-supplies business wants to send its trade customers the new catalogue. None of them has asked these people for marketing consent, and none of them thinks it needs to: these are customers, after all.
They are partly right. POPIA does let a business market electronically to its existing customers without fresh consent, but only within limits, and the limits are narrower than "anyone who has ever bought from us". This article sets out those limits, the opt-out every message must carry, what each message must say about the sender, and how Achekam's newsletters and e-mail records help keep the evidence.
The existing-customer route in the Act
The POPIA text published on the government's page prohibits direct marketing by electronic communication, including SMS and e-mail, unless the person has consented or is an existing customer. That is section 69 of the Act as published. The existing-customer route is the one this article is about; for everyone else, see consent before e-mail marketing under POPIA.
The Information Regulator's guidance note on direct marketing spells out what "existing customer" allows. It says a business may market electronically to an existing customer only:
- its own similar products or services;
- where it got the contact details in a sale; and
- if the customer was given a free and simple chance to object when the details were collected, and in every message.
All three conditions must be met. Missing any one of them sends you back to the consent route.
Your own similar products or services
The first condition limits what you may market. It must be your own products or services, and they must be similar to what the customer bought.
In the opening examples, the garden-service company offering irrigation to garden clients, and the office-supplies business sending trade customers its catalogue, are on firm ground. The salon's new treatment for its clients is probably similar as well, though each business has to judge its own case. A partner's product, an unrelated new venture, or a "special offer from our friends" is not your own similar product, and the existing-customer route does not cover it.
Contact details obtained in a sale
The second condition looks at how you got the e-mail address or phone number. It must have come to you in the context of a sale.
So a person who gave their details when buying from you is a candidate. A person who entered a competition, attended a free webinar, or enquired without buying did not give their details in a sale, and is not an existing customer for this purpose, however warm the relationship feels. Those people need consent.
A free, simple chance to object, at collection and in every message
The third condition has two moments. The customer must have been given a free and simple way to object when the details were collected, and again in every marketing message. The Regulator's guidance note adds that silence cannot be treated as consent.
At collection, that means the checkout, the account-opening form or the order confirmation should offer a plain way to say "no marketing". In every message, it means an unsubscribe link or equivalent that costs the customer nothing and takes no effort.
The guidance note also says every direct marketing message must identify the sender and give an address or contact details where the recipient can ask for the messages to stop. A message with no business name and no way to ask for the messages to stop falls short of that, however good the offer.
The Regulator's guidance note on direct marketing under POPIA sets out the existing-customer conditions alongside the consent rules; the version cited here is dated 3 December 2024.
When a customer objects
When an existing customer uses that chance to object, the route closes for them. The guidance note says a business must keep a database of people who have withheld consent or objected to direct marketing, and that the business bears the onus of proving that a person consented.
In practice, the objection must reach the same list as every other refusal, and that list must be checked before the next send. How to run that list is covered in keeping a do-not-contact list for marketing.
A quick test before each campaign
- Is every recipient someone who bought from us, with details obtained in that sale?
- Is the offer our own, and similar to what they bought?
- Were they offered a free, simple way to object when we collected their details?
- Does this message name us, give a way to stop, and include an unsubscribe link?
- Have we removed everyone on the objection list?
Newsletters with unsubscribe links, and e-mails kept on the record
In Achekam, a business can keep a mailing list, design newsletters and send or schedule campaigns, with an unsubscribe link in every letter. Campaigns live under CRM & SALES, in Campaigns. The unsubscribe link answers the "every message" half of the third condition; the "at collection" half depends on how you gathered the details in the first place.
One-to-one messages matter too. From a lead, an opportunity, a client contact or Client 360, staff can have AI draft an e-mail from a preset; the staff member then edits it, adds any attachments and sends it, and the message is kept on the record. The draft is only a draft: a person edits it and chooses whether to send it. A record of what was sent to each customer helps if anyone later asks what they received. Note that "sent" in Achekam means only that the mail provider accepted the message, not that it was read.
Write the three conditions into your process
Put the three conditions, the sender details and the objection list into a one-page marketing procedure, and ask whoever sends campaigns to work through the quick test every time. Existing customers are the easiest people to market to lawfully, provided you stay inside the lines the Regulator has drawn.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
