DIRECT MARKETING & THE CONSUMER PROTECTION ACT

Written by Dane Frost

The Consumer Protection Act (CPA) Amendment Regulations, 2026 have turned direct marketing from a routine business habit into a regulated compliance risk, and every business that emails, texts, WhatsApps or calls customers needs to take notice.

There are moments when a regulatory change quietly redraws the line between ordinary business practice and legal exposure. This is one of them. On 15 April 2026, the Minister of Trade, Industry and Competition gazetted the Consumer Protection Act Amendment Regulations, 2026 (Government Notice R.7380, Gazette No. 54521). These are not proposals waiting somewhere in the legislative pipeline. They are already law, and the National Consumer Commission's (NCC) formal registration process for direct marketers is fully operational this month. If a business sends marketing emails, SMSes, WhatsApp messages, or makes sales calls, this affects that business directly.

consumer-protection-act-amendment-regulations-2026.pdf

Download PDF • 1.04MB

The point of this article is not to bury business owners in legal language. It is to make clear what has changed, why it matters, what it will cost, and what will happen if businesses continue marketing as though nothing has shifted. The practical tools remain useful, but they should be read against a bigger message: direct marketing is no longer a low-friction activity that can run on habit, old templates and informal opt-out lists. It now requires evidence, process and discipline.

The First Question: Are You Caught by the Rules?

For most businesses, the answer will be yes. The Consumer Protection Act 68 of 2008 applies to virtually every transaction between a supplier (product and/or service) and a consumer in South Africa. Two common assumptions still circulate among business owners, but neither survives close scrutiny:

• “I only sell to other businesses, so this doesn't apply to me.”

  Not quite. The Act still applies where you sell to individuals, or to juristic persons (companies, close corporations, trusts) whose annual turnover or asset value is below R2 million at the time of the transaction. A large share of your business customers may fall within this threshold, whether you've thought about it that way or not.

  
  

• “I only send a newsletter, not sales pitches, so I don't need to register.”

  Also incorrect. If your newsletter promotes a product, service or event in any way, it is direct marketing in the eyes of the law, and you are required to register before you send a single one.

Put plainly: if a business sends promotional email, SMS or WhatsApp messages, or makes telephonic sales or marketing calls, it is operating as a direct marketer under the CPA. That label now carries real obligations, not merely best-practice expectations.

The Real Shift Is Structural, Not Cosmetic

These amendments do more than add another form to the compliance pile. They create a national opt-out system, backed by registration duties, recurring database cleansing and new evidence requirements. In practical terms, six changes matter most:

1. New legal definitions for ‘cleansing’, ‘direct marketer’, ‘electronic communication recipient’ and ‘pre-emptive block’ — these terms now carry fixed legal meaning for the first time.

2. A new fee schedule (Annexure N), setting out what businesses must pay to register, renew, and cleanse their databases each month.

3. A standardised form (Annexure O) that customers can use to register a pre-emptive block against businesses and other marketers.

4. A standardised form (Annexure P) that businesses must use to register as direct marketers.

5. An updated NCC complaint form (Annexure E), which now demands full documentary evidence from complainants — which means businesses should expect complaints to arrive better substantiated than before.

6. An amended Regulation 4, setting out eight binding obligations that direct marketers must now meet.

Where the Risk Now Sits

For business owners, the centre of gravity is Regulation 4. It is here that the new regime stops being abstract and becomes operational. Direct marketers must now meet eight binding requirements:

1. Register with the NCC

   Complete the prescribed Annexure P form, and submit it together with a valid B-BBEE certificate and tax clearance certificate.

2. Renew registration annually

   Businesses must renew every year, pay the renewal fee, and keep their business details current.

3. Identify the business clearly in every communication

   The business must state its name, electronic address, physical address, and contact number every time it markets to someone.

4. Label every electronic communication

   Make sure it is clearly identifiable as direct marketing on the recipient's device.

5. Respect the pre-emptive block, without exception

   A business may never market to a consumer who has registered a block on the NCC registry — even if the business separately holds that consumer's consent.

6. Cleanse the database every single month

   Businesses must submit their full marketing databases to the NCC monthly, pay the applicable per-record fee, and remove any blocked records without delay.

7. Register before sending anything at all

   Not one marketing communication may legally go out before NCC registration is complete. There is no grace period to rely on.

8. Keep registry details current at all times

   This is an ongoing duty, not a once-off task.

One more rule to flag for calling schedules

• You may not make telephonic marketing calls on Sundays or public holidays at all.

• On Saturdays, you're restricted to between 09h00 and 13h00.

• On weekdays, you may call only between 08h00 and 20h00.

If a business or its team runs outbound calling campaigns, these windows should be built into the dialling schedule as standard practice, not an afterthought.

Practical tool: compliance checklist

This can be used as a working checklist. Each item should be completed and revisited every quarter:

☐ NCC registration submitted using Annexure P, with B-BBEE certificate and tax clearance attached

☐ Registration renewal date diarised, one month ahead of the anniversary

☐ Marketer identification details added to every email, SMS and WhatsApp template

☐ Opt-out mechanism tested and confirmed working in every communication channel

☐ Monthly cleansing submission process assigned to a named person, with a recurring

calendar reminder

☐ Suppression list updated and cross-checked before every campaign send

☐ Outbound calling schedule configured to block Sundays, public holidays, and out-of- hours calling

☐ Written direct-marketing policy drafted, dated and version-controlled

The Price of Compliance Is Smaller Than the Price of Delay

No business owner welcomes another recurring compliance cost. But in this case, the arithmetic is difficult to ignore: the administrative burden is real, yet the cost remains manageable when set against the consequences of non-compliance. The prescribed fee schedule from 2026 to 2029 is set out below:

Fee type	2026	2027	2028	2029
Initial registration	R2 574.00	R2 702.70	R2 837.84	R2 979.73
Annual renewal	R1 930.50	R2 027.03	R2 128.38	R2 234.80
Cleansing fee (per record)	R0.12	R0.14	R0.16	R0.18

A database of 10 000 marketing records, for example, would cost roughly R14 400 a year to cleanse monthly. That is not trivial, but it is modest beside the maximum administrative penalty for non-compliance: R1 million, or 10% of annual turnover, whichever is greater. Seen through that lens, compliance is less a discretionary expense than a rational form of risk control.

POPIA Compliance Is Not a Shield Against the CPA

One of the easiest mistakes to make is assuming that POPIA compliance has already solved the direct-marketing problem. It has not. POPIA and the CPA are separate regimes, enforced by separate regulators, and a business can satisfy one while still falling short under the other. Every marketing email, SMS, WhatsApp message and phone call may therefore need to survive scrutiny under both.

Feature	CPA (National Consumer Commission)	POPIA (Information Regulator)
Opt-out	Monthly cleansing against the NCC pre-emptive block registry is mandatory	Objections to processing must be honoured immediately, at any time
Consent	Does not require consent — but a blocked consumer may not be marketed to, regardless of consent	Requires consent, or an existing customer relationship, for electronic marketing
Liability	Administrative penalty of up to R1 million, or 10% of annual turnover	Fines, and criminal liability for certain offences
Key obligation	Register with the NCC; cleanse monthly; remove blocked records	Establish a lawful basis; uphold data subject rights; keep consent records

The rule businesses should operate by

A customer who has given POPIA consent can still separately register a CPA pre-emptive block, and that block overrides the consent held by the business. Businesses should operate on the standard of “cleanse AND consent”, never one instead of the other.

Your Best Defence Will Be the Paper Trail

If a business is challenged by either regulator, good intentions will not be enough. Its defence will rest on records: what was sent, to whom, on what basis, after which checks, and with what evidence of consent or suppression. At a minimum, the business should be able to produce, on request:

• Your NCC registration number and proof of each annual renewal.

• The lawful basis you're relying on for every record in your database — consent, an existing customer relationship, or a legitimate interest assessed under POPIA.

• A complete opt-out log: date, channel, date of suppression, and confirmation sent to the customer.

• Monthly cleansing logs: date, dataset size, fee paid, and the NCC's confirmation receipt.

• Full consent records: the exact wording presented, date, time, source form and channel for every consent obtained.

• A record of campaign approvals, showing compliance sign-off and pre-send checks for each campaign.

• A current, version-controlled written direct-marketing policy.

Practical tool: a simple records register

Expensive software is not needed to start. A single shared spreadsheet with the following tabs can support compliant record-keeping from day one: Registration & Renewals, Consent Log, Opt-Out Log, Monthly Cleansing Log, and Campaign Sign-Off Log. One owner should be assigned per tab, and all five should be reviewed with the compliance officer every quarter.

Compliance Cannot Live in One Department

A direct-marketing failure rarely belongs to marketing alone. It may start with a database, a template, a script, a contract term, or an unchecked campaign send. That is why this obligation cannot simply be handed to a compliance officer and forgotten. In smaller operations where one person wears several of these hats, the list below should be read as a practical allocation of responsibility rather than an organisational chart.

The Owner, or Designated Compliance Owner

Registers the business via Annexure P, maintains a compliance register, and reviews CPA and POPIA records jointly every quarter.

Marketing & IT:

Cross-checks every send against the suppression database before it goes out, ensures sender identification appears on every communication, and keeps a functional opt-out mechanism in every message.

Database or CRM Administration:

Submits monthly cleansing files to the NCC, updates the suppression list after each cycle, and retains cleansing records for a minimum of three years.

Legal or contracts (internal or outsourced):

Audits standard-form contracts for prohibited liability or indemnity clauses, and confirms any automatic renewal clauses meet the 40-to-80-business-day notice rule.

Finance & Operations

Confirm that quotes, invoices and pricing disclosures are accurate, publish a compliant returns and refunds policy, and document cooling-off and cancellation procedures.

The Owner

Formally designates a named compliance officer, takes ownership of penalty risk, and sets clear remediation deadlines wherever gaps are found.

The Wider CPA Picture Still Matters

The 2026 amendments may have put direct marketing in the spotlight, but the CPA reaches much further. It shapes consumer-facing contracts, warranties, price displays and communications. A few points remain especially important:

• Your contract terms must be fair, reasonable and just. Clauses that try to waive a customer's implied statutory warranties, or blanket indemnities, are simply unenforceable; don't rely on them.

• Automatic renewal clauses require you to give advance written notice of between 40 and 80 business days before the renewal date.

• Goods you sell to consumers carry an implied warranty of quality, and customers may claim a repair, replacement or refund within six months of delivery.

• Where an agreement results from direct marketing, your customer has a cooling-off right to cancel within five business days, and you must refund them within 15 business days of that cancellation.

• The price you actually charge must match the price you quoted or displayed. Where the two differ, the lower price applies, not the one you meant to charge.

• All your communications, written or verbal, must be understandable to a customer with low literacy, and remember that a verbal promise made by your sales representative is legally binding on your business. Proper script control for your sales staff is a genuine compliance control, not a nicety.

Now Wearing the Other Hat: What Business Owners Can Do as Consumers

Business owners are not only direct marketers. They are also consumers themselves, receiving marketing calls, SMSes and emails from other businesses. The same regulations give them concrete rights, and it is important to know how those rights can be used.

1. Register a pre-emptive block

   Consumers can register on the NCC's opt-out registry using the standardised Annexure O form. Once registered, no direct marketer may contact them for marketing purposes, regardless of any consent the marketer may separately hold. Consumers should keep their details up to date on the registry, since that obligation also applies to them.

2. Know the limited exception that still applies

   Even after a consumer has registered a block, a business may still make contact if there has been a recent transaction, or if written permission has been given. But the moment the consumer asks the business to stop, it must comply immediately, and be able to prove that it did.

3. Know what every marketing message is legally required to disclose

   Every legitimate marketing communication received by a consumer must include the marketer's name, electronic address, physical address and contact number, together with a working opt-out mechanism that must be actioned within 24 hours of use.

4. If a complaint is needed

   The updated Annexure E complaint form now requires full documentary evidence of any steps already taken to resolve the matter. A simple record should be kept from the first interaction; dates, screenshots and copies of correspondence, rather than trying to reconstruct one after the fact.

5. Remember the bigger picture

   Direct marketing sits mainly at the intersection of two of the CPA's eight foundational consumer rights: the right to privacy, which underpins the pre-emptive block, and the right to fair dealing, which prohibits misleading or unconscionable conduct. The other six rights: equality, choice, disclosure, fair value, accountability, and fair agreements, apply to every purchase consumers make, not just marketing.

The Sensible Response Is to Act Now

The Consumer Protection Act Amendment Regulations, 2026 are already in force, and the NCC's registration process for direct marketers is live this month. The businesses most exposed are not necessarily those acting in bad faith; they are often those that continue using old marketing routines without recognising that the legal environment has changed. There is no grace period to rely on, and the maximum penalty — R1 million or 10% of annual turnover — is too significant to treat this as a back-office housekeeping exercise.

Practical tool: a 30-60-90 day action plan

1. Within 30 days: Register the business on the NCC Opt-Out Registry, appoint a named compliance owner, and add marketer identification and a working opt-out link to every marketing template used.

2. Within 60 days: Set up the monthly cleansing process with the NCC, build the records register, and audit the calling schedule against the permitted hours.

3. Within 90 days: Complete the first quarterly CPA-POPIA record review, audit standard contracts for prohibited clauses, and finalise a version-controlled written direct-marketing policy.

The conclusion is straightforward. The compliance steps are clear and, in financial terms, affordable. What is now required is disciplined implementation: register with the NCC, cleanse the database every month, keep accurate records, and make sure the team understands that direct marketing is no longer just a growth channel. It is a regulated activity, and it should be treated as one.