Email marketing can help a small business stay in contact with customers, share useful information and introduce relevant products or services. It can also become an expensive and frustrating exercise when messages are sent to people who never asked to receive them.
A common mistake is assuming that having someone's email address gives a business permission to send promotional messages.
In South Africa, the Protection of Personal Information Act (POPIA) regulates the processing of personal information for direct marketing through unsolicited electronic communications. Section 69 sets out the conditions under which this type of marketing may take place.
The Information Regulator has also published guidance on direct marketing and the regulations have been amended since their original publication. Businesses should therefore be careful about relying on old email marketing advice or outdated interpretations of the rules.
This article explains how a small business can build and manage a permission-based email list while keeping its marketing process practical.
It is general business information, not legal advice. Businesses with complex marketing arrangements, existing databases or uncertain consent records should obtain appropriate professional advice.
Why permission matters
An email address is personal information when it relates to an identifiable person. POPIA defines direct marketing broadly, including approaches made to promote or offer goods and services.
Section 69 deals specifically with direct marketing through unsolicited electronic communications. It includes examples such as email, SMS, fax and automatic calling machines.
The Act's definition of electronic communication is also broad. It covers text, voice, sound or image messages sent over an electronic communications network and stored until collected by the recipient.
This matters when a business uses more than one marketing channel. Email is not the only electronic communication that needs consideration.
A business collecting contact details from customers in Maboloka, Soshanguve, Centurion or elsewhere should have a clear reason for collecting those details and a suitable basis for using them.
The relevant legal starting points are section 69 of POPIA and the Information Regulator's guidance notes on direct marketing.
1. Understand the two routes under section 69
Section 69(1) generally prohibits processing personal information for direct marketing through unsolicited electronic communication unless the data subject has given consent or qualifies for the existing-customer exception in section 69(3).
These are two different routes. A business should not assume that every person who has ever interacted with it qualifies for the customer exception.
Route A: The person has consented
A business can market electronically where the person has provided the required consent.
Consent should be voluntary, specific and informed. The business should be able to explain what the person agreed to receive and maintain evidence of that agreement.
Route B: The person is an existing customer
Section 69(3) provides a limited exception for marketing to an existing customer.
The exception applies only when the relevant conditions are met:
- The business obtained the person's contact details in the context of a sale of a product or service.
- The marketing relates to the business's own similar products or services.
- The person received a reasonable opportunity to object, free of charge and without unnecessary formality, when the information was collected.
- The person is given that opportunity again in each marketing communication if they have not initially refused.
These conditions are important.
A person who merely requested a quotation is not automatically covered by the existing-customer exception. Neither is someone whose details were collected from a public directory, a networking event or a purchased database.
If the business cannot confidently establish that the exception applies, it should not assume that the address can be used for promotional email marketing.
2. Understand the one-time consent request
Section 69(2) allows a responsible party to approach a person whose consent is required, provided that the person has not previously withheld consent, only once to request that consent.
The request must follow the prescribed requirements.
This is not permission to send an unsolicited promotional email and then treat the recipient's silence as agreement.
A consent request should be a genuine request for permission, not a disguised sales campaign.
It should identify the business, explain the products or services to be marketed and give the person a clear choice.
The amended POPIA Regulations provide more detail about the form and methods that may be used for requesting consent. Regulation 6 allows a form substantially similar to Form 4 or another expedient, free and reasonably accessible method, including email, telephone, SMS and WhatsApp. Requests made telephonically must be electronically recorded in the circumstances specified by the regulations.
The amendment was published for implementation with immediate effect on 17 April 2025. The official Government Notice 6126 and the amended POPIA Regulations provide the relevant detail.
3. Design a clear newsletter sign-up form
A website sign-up form is often the simplest way to build a permission-based list.
However, the form should explain what the visitor is agreeing to receive.
Avoid a vague checkbox that simply says "I agree" without identifying the marketing purpose.
A more useful form should explain:
- The identity of the business.
- The type of marketing messages the person will receive.
- The products or services that may be promoted.
- The intended communication channel.
- Where the person can find further privacy information.
- How the person can withdraw consent or ask for marketing to stop.
The form should make the choice clear and should not rely on preselected options that make the person's intention uncertain.
Example of clearer sign-up wording
A business might use wording along these lines, adapted to its actual marketing activities and reviewed against the applicable requirements:
"I agree to receive occasional email updates from [Business Name] about its [specified products or services]. I understand that I can ask to stop receiving these marketing emails."
The business must identify itself and specify what it intends to market. It should not use broad wording to obtain permission for unrelated future campaigns.
The official regulations include Form 4, which identifies the responsible party, the goods or services to be marketed and the data subject's consent. A business should use the current requirements when designing its own process rather than copying an old template without review.
The Information Regulator maintains a POPIA forms page where Form 4 is listed.
4. Do not confuse an enquiry with marketing permission
A customer may submit a contact form because they want a quotation, ask a question or request a callback.
That action should not automatically add the person's email address to a recurring newsletter list.
The purpose of collecting information matters.
For example:
| Customer action | What it normally tells the business |
|---|---|
| Requests a quotation | Wants information about a particular service |
| Submits a contact form | Wants the business to respond to an enquiry |
| Registers for a newsletter | Wants the specified marketing updates |
| Completes a purchase | Becomes a customer, subject to the applicable conditions |
| Downloads a document | Wants the requested resource; this does not automatically establish newsletter consent |
A business can provide a useful enquiry process without bundling unrelated marketing permission into it.
If the person wants to subscribe, make that a clear and separate choice.
This also makes it easier for the business to understand which contacts belong in its marketing database and which should only be retained for the purpose of responding to an enquiry.
5. Keep evidence of consent
A business should be able to demonstrate why a contact is on its marketing list.
A spreadsheet or marketing platform can help, provided that the business records enough information to understand the permission it obtained.
Useful fields may include:
| Record | Why it matters |
|---|---|
| Contact identifier | Identifies the person or record |
| Date and time | Helps establish when permission was obtained |
| Collection method | Records whether consent came from a website, email or another channel |
| Consent wording or version | Shows what the person was told |
| Marketing purpose | Identifies the products or services covered |
| Preferred channel | Records the channel selected by the person |
| Evidence reference | Points to the relevant form submission or record |
| Withdrawal date | Records when consent was withdrawn or marketing was stopped |
Do not collect more information than the business needs.
If the newsletter only requires an email address, asking for an identity number, physical address and other unrelated details creates unnecessary data management responsibilities.
The purpose of keeping consent records is not to build a larger personal information database. It is to maintain enough evidence to manage the marketing process responsibly.
6. Make unsubscribing straightforward
People should be able to stop receiving marketing messages without unnecessary difficulty.
Section 69(4) requires every direct marketing communication to contain the identity of the sender or the person on whose behalf the message is sent, together with an address or other contact details to which the recipient can send a request that the communication cease.
In practical terms, the business should make its identity clear and provide a working way for the recipient to ask for marketing to stop.
A visible unsubscribe link is a useful way to achieve this in email campaigns.
Avoid processes that require a customer to telephone during business hours, explain why they want to leave the list or complete an unnecessarily complicated form.
When someone withdraws permission or objects, update the marketing records promptly.
A suppression list can help prevent a person who has unsubscribed from being accidentally re-imported during a future database upload. The suppression process should be designed carefully so that the business does not continue using the address for marketing simply because an old spreadsheet still contains it.
7. Treat the existing-customer exception carefully
The existing-customer exception can be useful, but it is not a general permission to market to every past contact.
Consider a business that sells a particular service and obtains the customer's email address during that sale.
The business may be able to market its own similar products or services under section 69(3), provided that all the conditions are met.
It should not assume that this allows it to:
- Market unrelated services.
- Share the customer's address with unrelated businesses for their marketing.
- Add the person to a broad newsletter without considering the applicable conditions.
- Ignore an objection.
- Continue marketing after the person has asked for it to stop.
Keep the exception narrow and document why the business believes the conditions apply.
If a customer has purchased one service, a relevant offer about a similar service may be different from an unrelated third-party promotion.
When the distinction is unclear, obtain appropriate legal advice rather than stretching the exception to cover the entire database.
8. Avoid purchased and scraped email lists
Buying a list of email addresses can look like a shortcut to reaching more potential customers.
It can also introduce significant compliance and marketing problems.
The business may not know:
- How the addresses were collected.
- Whether the individuals were informed about the intended use.
- Whether consent was obtained for the business's marketing purpose.
- Whether the contact details are accurate.
- Whether people have already objected.
- Whether the list contains outdated or duplicated records.
A public email address is not automatically permission to send promotional email.
Likewise, a person handing over a business card at an event has not necessarily agreed to receive a recurring marketing newsletter.
A smaller list built through clear, relevant sign-up choices is generally more useful than a large database with uncertain permission.
9. Make the newsletter worth receiving
Permission is only the starting point. A business still needs to give subscribers a reason to remain on the list.
A newsletter should have a clear purpose.
Depending on the business, it might include:
- Practical advice related to the products or services.
- Announcements about relevant developments.
- Useful maintenance or planning reminders.
- New resources or guides.
- Relevant product or service information.
- Genuine business updates.
Avoid sending messages simply because the marketing calendar says it is time to send something.
Before each campaign, ask:
- Is this information relevant to the people receiving it?
- Does it fit the purpose they agreed to?
- Is the subject line accurate?
- Can the recipient identify the sender?
- Is there a straightforward way to stop future marketing?
- Have the links and contact details been checked?
Consistency is useful, but frequency should be appropriate to the audience and the type of content being sent.
10. Protect the marketing database
A marketing list is a business asset, but it is also a collection of personal information that needs appropriate protection.
Limit access to staff who need it. Use suitable account security and avoid sharing full customer lists through informal channels.
Consider:
- Strong passwords and multi-factor authentication.
- Access permissions based on job responsibilities.
- Secure storage of exported contact lists.
- Review of marketing platform providers.
- Appropriate handling of backups.
- Removal of unnecessary duplicate records.
- A documented process for access and deletion requests.
- A procedure for handling security incidents.
If an external email marketing platform processes personal information on behalf of the business, review the relationship and the applicable POPIA responsibilities. The Act contains requirements relating to operators and security safeguards.
Do not assume that moving a contact list into a cloud platform transfers all responsibility to the provider.
11. Measure useful outcomes, not just list size
A large subscriber count does not necessarily indicate an effective marketing programme.
A small business should focus on whether its messages are reaching the intended audience and contributing to useful business outcomes.
Relevant indicators may include:
| Metric | What it can help explain |
|---|---|
| New permitted subscribers | Whether the sign-up process is attracting interest |
| Unsubscribes | Whether the content or frequency needs review |
| Bounces | Whether contact information is valid |
| Clicks | Whether readers are engaging with links |
| Website visits | Whether campaigns are encouraging further exploration |
| Enquiries | Whether marketing is generating relevant business conversations |
| Sales | Whether campaigns contribute to commercial outcomes |
Do not interpret an open rate as a perfect measure of whether a person read a message. Email privacy features and automated image loading can affect open tracking.
Compare campaigns over time and use several indicators rather than relying on one metric.
Also avoid collecting extra personal information solely to improve marketing reports. The business should have a clear purpose for every additional data field it stores.
12. A practical implementation checklist
A small business can begin improving its email marketing process without adopting a complex marketing automation platform.
Step 1: Review the current list.
Identify where the addresses came from and whether the business has evidence of the relevant consent or can establish that the existing-customer exception applies.
Step 2: Separate enquiries from subscribers.
Do not automatically add every contact form submission to the newsletter database.
Step 3: Review the sign-up wording.
Make the business identity, marketing purpose and communication channel clear.
Step 4: Update the consent process.
Review section 69 and the current regulations, including the applicable Form 4 requirements and permitted consent-request methods.
Step 5: Keep evidence.
Store the consent record and the information needed to understand what the person agreed to receive.
Step 6: Check every campaign template.
Confirm the sender's identity and provide a straightforward way to request that marketing stops.
Step 7: Test the unsubscribe process.
Verify that a request is received, recorded and acted upon.
Step 8: Review access and storage.
Ensure that only authorised people and appropriate service providers can access the marketing database.
Step 9: Monitor campaign performance.
Focus on relevant engagement and business outcomes rather than subscriber numbers alone.
Frequently asked questions
Can I send marketing emails to everyone who has contacted my business?
No. An enquiry does not automatically establish permission for recurring marketing. Section 69 provides a consent route and a limited existing-customer exception, each with specific conditions.
Does an unsubscribe link count as consent?
No. The amended POPIA Regulations expressly state that an opt-out does not constitute consent for the purposes of section 69(2).
Can I use WhatsApp to request marketing consent?
The amended regulations identify WhatsApp among the methods that may be used for requesting consent, subject to the applicable requirements. The business should ensure that the request is genuine, appropriately recorded and compliant with the relevant provisions.
Can an existing customer receive marketing without giving fresh consent?
Section 69(3) provides a limited exception for a customer's own similar products or services, provided all the conditions are met. It is not a general permission to market unrelated products or share customer details.
Do I need a large email marketing platform?
Not necessarily. A small business can start with a manageable system that stores permission records, sends appropriate messages and processes unsubscribe requests reliably. The system should be selected according to the business's actual requirements.
Conclusion
Email marketing works best when people understand why they are receiving messages and have made a meaningful choice to receive them.
For South African small businesses, that means understanding POPIA section 69, distinguishing enquiries from marketing subscriptions, applying the existing-customer exception carefully and keeping evidence of permission.
A well-managed list does not need to be enormous. It needs to be relevant, responsibly maintained and supported by content that subscribers actually find useful.
Build the permission process properly, make it easy to stop receiving messages and treat customer information with care. These practices support more sustainable marketing and help protect the trust on which long-term customer relationships depend.