Email marketing can help a small business keep customers informed, share useful advice, introduce relevant services and build relationships over time. It can also become a source of frustration when people receive messages they did not expect, cannot unsubscribe easily or discover that their details have been shared without their understanding.
For South African businesses, permission-based marketing must be considered alongside the Protection of Personal Information Act, commonly known as POPIA. Section 69 addresses direct marketing through unsolicited electronic communications, including email, SMS and other electronic channels covered by the legislation.
The rules are important for more than large mailing lists. A small business sending occasional promotional emails must still think carefully about why it collected the recipient's information, what permission or other applicable basis it relies on, and how it handles objections.
This guide explains how to build a more responsible email marketing process while keeping campaigns practical and useful.
It is general information rather than legal advice. Businesses with complex customer databases, multiple marketing channels or uncertain consent records should obtain advice appropriate to their circumstances.
1. Understand the difference between an enquiry and marketing permission
One of the most common mistakes is assuming that anyone who contacts a business has agreed to receive promotional messages indefinitely.
A person may submit an enquiry because they want a quotation, request information about a service, or ask a specific question. That action does not automatically mean they want ongoing promotional emails about unrelated offers.
Consider these examples:
- A visitor requests a quotation for a website.
- A customer purchases a service and provides an email address for transaction-related communication.
- A visitor subscribes to a newsletter after being told what it contains.
- A person receives a business card or sends a message through social media.
These situations have different contexts and purposes. A business should not treat every email address it encounters as a marketing subscriber.
The Information Regulator's guidance notes on direct marketing explain the application of POPIA to direct marketing, including electronic communication under section 69.
Start by deciding what the communication is intended to do. A message necessary to respond to a specific customer request is different from a campaign promoting additional products or services.
2. Understand section 69 of POPIA
Section 69 regulates the processing of personal information for direct marketing through unsolicited electronic communications.
In broad terms, the section provides that this processing is prohibited unless the data subject has given consent or qualifies for the existing-customer exception set out in the Act.
The existing-customer exception is not a blanket permission to send any promotion to anyone who has ever bought something.
Section 69(3) sets conditions. Among other things, the contact details must have been obtained in the context of a sale of a product or service, the marketing must concern the responsible party's own similar products or services, and the customer must have been given a reasonable opportunity to object without charge or unnecessary formality.
That opportunity must be provided when the details are collected and with each subsequent marketing communication where the customer has not initially refused the use.
Read the Protection of Personal Information Act 4 of 2013 alongside the applicable regulations and the Information Regulator's guidance.
What about a new subscriber?
Where the business needs consent for unsolicited electronic direct marketing, section 69(2) provides that a person who has not previously withheld consent may be approached only once to request it.
The consent request must follow the applicable prescribed requirements. A business should not treat a non-response as permission or repeatedly contact someone who has already refused.
The detailed requirements are important, so do not build a campaign around a simplified assumption that one checkbox or a general privacy notice automatically makes every subsequent marketing message lawful.
3. Account for the amended regulations
South Africa's POPIA regulations were amended in April 2025, including the provisions governing requests for consent for unsolicited electronic direct marketing.
The Information Regulator's amended regulations replace Regulation 6 with requirements addressing written consent, Form 4 or a substantially similar approach, and methods through which a consent request can be made.
The amended text refers to channels including email, telephone, SMS and WhatsApp, as well as other specified methods. It also addresses recording consent requests made telephonically and through automated calling machines.
Importantly, Regulation 6.4 states that opting out does not constitute consent for unsolicited electronic direct marketing.
This is a reason to review old signup processes rather than assuming that a mechanism designed several years ago still meets the current requirements.
Review your consent mechanism
Check whether your process:
- Explains that the person is being asked to consent to direct marketing.
- Identifies the responsible party.
- Specifies the goods or services to be marketed as required.
- Records the person's decision and the date.
- Captures the preferred communication method where applicable.
- Stores evidence that can be retrieved later.
- Avoids treating silence or an opt-out as consent.
The appropriate implementation depends on the circumstances and the current legal requirements. For a detailed review, consult the official regulation and obtain legal advice where necessary.
4. Build a clear subscription experience
A newsletter signup should explain what the person is signing up to receive.
Avoid vague promises such as "Stay connected" when the actual intention is to send frequent sales promotions.
Instead, describe the expected content in straightforward language. For example, a business might explain that its newsletter contains practical business advice, occasional product updates and relevant service announcements.
Be transparent about the organisation sending the messages. If multiple businesses or unrelated brands will receive subscriber information, do not conceal that fact behind a generic signup statement.
Do not combine a necessary enquiry form with an ambiguous marketing opt-in that makes people think they must agree to advertising before they can request a quotation.
Keep the choices understandable and the form usable on mobile devices.
Store evidence of the decision
A database entry containing only an email address is weak evidence of how that address became a marketing contact.
Where consent is the applicable basis, maintain appropriate records of the consent request, the person's response, the date and the scope of permission.
A simple record might include:
- Subscriber identifier.
- Contact address.
- Source of the signup.
- Date and method of the consent request.
- Wording or version of the consent notice.
- The response received.
- The categories of marketing covered.
- Any later withdrawal or objection.
Keep only the information needed for the relevant purpose and protect the records against unauthorised access.
5. Do not purchase or casually reuse email lists
Buying a mailing list may seem like a shortcut to reaching more customers, especially when a business is trying to grow quickly.
But the fact that a third party possesses an email address does not establish that the business has permission to use it for its own direct marketing.
A list may have been collected for another purpose, under a different relationship or with unclear permission. The business may not be able to establish what recipients were told or whether their preferences have changed.
Before importing any existing list, ask:
- How were the addresses collected?
- What purpose was communicated to the people concerned?
- Does the available evidence support the intended use?
- Which organisation was identified in the original consent?
- Have recipients objected or withdrawn consent?
- Can the business demonstrate the applicable legal basis?
If these questions cannot be answered, do not assume that the list is suitable for marketing.
A smaller list of relevant people who genuinely want to hear from the business can be more useful than a large, poorly understood database.
6. Make unsubscribing straightforward
Every marketing process needs a reliable way to record and respect objections.
Section 69 requires direct marketing communications to identify the sender or the person on whose behalf the message is sent, and provide an address or other contact details through which the recipient can request that communications cease.
Design the process so recipients can exercise this choice without unnecessary effort.
Practical measures include:
- A clear unsubscribe link where suitable.
- A monitored contact method for opt-out requests.
- A process for handling requests received by reply email.
- A suppression list to prevent accidental re-importing.
- Staff instructions for updating subscriber preferences.
- A record of when the objection was received and processed.
Do not require someone to log into an account, explain why they want to leave or navigate a long series of screens just to stop receiving marketing messages.
The process should also work when a person contacts the business through a different channel. If someone asks a staff member to stop marketing messages, make sure that request reaches the people responsible for the mailing list.
Keep a suppression record
Deleting an unsubscribed person's address from one mailing list can create a problem if the same address is later imported from an old spreadsheet.
A carefully controlled suppression mechanism helps prevent this.
Keep only the minimum information needed to honour the objection and protect it appropriately. Do not use the suppression record as a reason to resume marketing.
7. Send content that is worth receiving
Permission is a starting point, not a guarantee that every message will be useful.
A successful campaign should provide a clear reason for the recipient to open it.
Depending on the business, useful content might include:
- Practical guidance related to the customer's needs.
- Product or service updates that match the subscriber's stated interests.
- Important information about a service the customer uses.
- Relevant educational material.
- Announcements that are genuinely useful to the intended audience.
Avoid sending every announcement to every subscriber simply because the mailing platform allows it.
A small business can start with a manageable schedule, such as a useful newsletter at a consistent interval, and adjust according to the needs of its audience.
The correct frequency depends on the value of the content and what subscribers were told to expect. A business should not promise monthly updates and then start sending daily promotions without reviewing the scope of its communications.
8. Segment your list carefully
Segmentation means dividing a subscriber list into relevant groups so messages better match the audience.
A business might separate subscribers by the types of updates they selected or by an appropriate customer relationship.
For example, a business selling several distinct services may allow people to choose which topics interest them. A subscriber interested in website maintenance may not want updates about unrelated products.
Keep segmentation transparent and proportionate. Do not collect sensitive or unnecessary information just to create more elaborate marketing categories.
Also remember that segmentation does not create legal permission by itself. A business still needs an appropriate basis for processing the personal information and sending the communication.
Where possible, let subscribers manage their preferences and record changes accurately.
9. Protect the subscriber database
An email list is a collection of personal information. It should be handled with appropriate security and access controls.
Review the following:
- Who can export the mailing list?
- Are staff using shared accounts?
- Is multi-factor authentication available?
- Can former employees still access the database?
- Are subscriber records included in backups?
- Does the provider explain how information is stored and processed?
- Are old records reviewed when they are no longer necessary?
- Can the business retrieve records needed to demonstrate its decisions?
If an external email marketing platform processes subscriber information on the business's behalf, review the service terms, security arrangements and responsibilities that apply.
Do not upload the entire customer database to a new platform simply because it offers a convenient marketing feature. Establish what information is needed and whether the proposed use is appropriate.
POPIA compliance involves more than a checkbox on a signup form. It also requires responsible handling of the personal information throughout the relevant processing activities.
10. Measure campaigns without losing sight of the customer
Email analytics can help a business understand whether its messages are useful.
Depending on the platform, available measures may include delivery, opens, clicks, unsubscribes and conversions. Some measurements, particularly open rates, can be affected by privacy features and technical limitations, so they should not be treated as perfect evidence of human behaviour.
Focus on questions that support decisions:
- Are messages reaching the intended audience?
- Are links working correctly?
- Do subscribers engage with the information?
- Which topics generate relevant visits or enquiries?
- Are unsubscribe rates changing after a campaign?
- Are the resulting enquiries appropriate for the business?
Avoid interpreting a high open rate as proof that a campaign is profitable. The more important question is whether the communication supports the intended customer relationship and business objective.
Keep tracking proportionate to the purpose and consider the privacy implications of the technologies used.
If your website collects email addresses, review the signup journey before expanding your campaigns.
Website assessment: Use Mogen's website assessment to discuss the website forms and customer journey involved in collecting enquiries or newsletter subscriptions.
A practical email marketing checklist
Before sending a campaign, confirm that:
- The purpose of the message is clear.
- The intended recipients have an appropriate basis for receiving it.
- Required consent evidence is available where consent is relied upon.
- Existing-customer marketing meets the applicable conditions.
- The sender is clearly identified.
- Recipients can request that marketing stop through a suitable contact method.
- Previous objections are respected.
- The message matches the audience's expectations.
- Subscriber information is protected.
- The campaign links work on mobile devices.
- Results and complaints are reviewed.
- The process reflects current requirements rather than outdated assumptions.
Current website offers:
Review Mogen's promotions page for published offers that may be relevant to your website and digital presence needs.
Frequently asked questions
Can I email a customer because they previously purchased from me?
Sometimes, section 69(3) provides a limited existing-customer exception for marketing the responsible party's own similar products or services, subject to the conditions in the Act. A previous purchase is not blanket permission for every type of marketing.
Can I ask someone to subscribe if they have not consented?
Section 69(2) provides a limited once-only approach for requesting consent from a person who has not previously withheld it, where consent is required. The request must comply with the applicable requirements. Do not repeatedly ask after a refusal or treat silence as permission.
Is an unsubscribe link enough to make an email campaign compliant?
No. A suitable method for stopping messages is important, but it does not replace the need for an appropriate basis for sending the marketing in the first place or the other applicable requirements.
Can I use a list of business email addresses found online?
Do not assume that publicly available contact details automatically permit unsolicited electronic direct marketing. Establish the applicable legal basis and follow the relevant requirements before using the information for a campaign.
Conclusion
Responsible email marketing starts with a clear purpose, an appropriately obtained subscriber relationship and a reliable way to honour preferences.
For South African businesses, section 69 of POPIA and the amended regulations provide important rules for unsolicited electronic direct marketing. A practical process should account for those requirements, maintain suitable evidence, protect subscriber information and make objections easy to exercise.
Start by reviewing how your current list was collected, how permission is recorded and how unsubscribe requests are handled. Then improve the quality and relevance of the messages you send.
A smaller, well-managed list can provide a stronger foundation for long-term customer relationships than a large database whose origins and permissions are unclear.