Prepare for South Africa's Opt-Out Registry

Businesses often invest considerable effort in building marketing databases.

They collect contact details through enquiries, sales, competitions, customer registrations, online forms, events and other interactions.

Over time, these records become valuable marketing assets. They allow businesses to communicate with customers, announce services and promote relevant offers.

But a large database is not necessarily a well-managed database.

Contact details can become outdated. Customers can withdraw permission or object to marketing. Different employees may maintain separate lists, and external agencies may run campaigns without the business having a clear view of which contacts are being used.

South Africa is introducing an additional control for direct marketing through the National Opt-Out Registry.

The National Consumer Commission (NCC) launched the registry on 7 October 2026. It gives consumers a government-administered mechanism to block unwanted direct marketing communication under section 11 of the Consumer Protection Act.

The rollout is taking place in phases. As at 1 November 2026, direct marketers are in the registration phase, which the NCC says runs from 15 September to December 2026. A five-month list-cleansing phase is planned from December 2026 to April 2027, followed by consumer pre-emptive blocking from May 2027.

For South African businesses, this is a good time to review how marketing lists are collected, stored, updated and used.

The objective is not to stop responsible marketing. It is to ensure that marketing operations respect consumer choices and use contact information appropriately.

What is the National Opt-Out Registry?

The National Opt-Out Registry is administered by the National Consumer Commission.

It gives consumers a way to register a pre-emptive block against unwanted direct marketing communication.

Section 11 of the Consumer Protection Act provides consumers with rights to restrict unwanted direct marketing. The 2026 amended regulations establish the framework for the NCC to administer the registry.

The NCC describes the registry as a way for consumers to block unwanted direct marketing calls, SMSes and other electronic communication.

Its announcement also refers to email communication when describing the protection the system is intended to provide.

The important change for marketers is that the NCC says direct marketers must register and cleanse their marketing lists monthly before running direct marketing campaigns.

This means that businesses should prepare their marketing processes to account for the registry rather than treating it as an optional database-cleaning exercise.

The official announcement is available from the National Consumer Commission.

1. Understand the rollout dates

The registry is being introduced in stages.

The NCC's published rollout provides the following timeline:

The NCC states that the list-cleansing period from December to April will be provided at no cost to direct marketers so that they can understand the process and prepare to interface with the system.

The Commission also warns that failure to register during the registration phase may constitute a contravention of section 11 of the CPA, read with the amended regulations.

These dates matter because businesses have an opportunity to prepare their internal systems before consumer blocking begins.

Do not wait until a campaign is about to be sent to discover that the marketing database is disorganised or that nobody knows which supplier is responsible for a contact list.

Review the NCC's latest instructions before registering or making operational decisions, as the Commission may publish further guidance as the rollout progresses.

2. Do not confuse the registry with POPIA

One of the most important points for businesses to understand is that the National Opt-Out Registry does not replace POPIA.

The Information Regulator addressed this directly in its 21 April 2026 statement following publication of the amended CPA regulations.

It emphasised that POPIA compliance remains mandatory whether or not a consumer has registered a pre-emptive block with the NCC.

This distinction is critical.

A person who has not registered on the new Opt-Out Registry is not automatically available for unsolicited electronic marketing.

POPIA section 69 continues to regulate direct marketing through unsolicited electronic communications.

The Information Regulator explains that direct marketers generally need the data subject's consent or must meet the specific existing-customer exception in section 69(3).

The regulator's statement is available in its official media statement on the CPA amendment regulations.

The registry and POPIA therefore address related but distinct requirements.

Businesses should not interpret the new system as permission to contact anyone who has not yet registered a block.

3. Understand which marketing activities need attention

Direct marketing is not limited to one communication channel.

The Information Regulator's guidance note describes direct marketing as approaching a person in person, by mail or by electronic communication to promote or offer goods or services, or to request a donation.

Its guidance on POPIA section 69 identifies electronic channels including:

• Telephone calls.
• Automatic calling machines.
• Fax.
• SMS.
• Email.

The NCC's registry announcement describes calls, SMSes and other electronic communication.

A business should therefore review its marketing activities across the channels it actually uses.

For example:

The purpose of this review is to identify where personal information is used for direct marketing and which processes need to change.

A business should not assume that a campaign is outside the rules simply because it is sent through a different platform.

4. Build a complete picture of your marketing database

Before preparing for list cleansing, understand where the business's contact information is stored.

A small business may have customer details in several places:

• A spreadsheet maintained by the owner.
• A CRM system.
• An accounting or invoicing platform.
• An email marketing platform.
• A bulk SMS provider.
• A website enquiry database.
• A sales team's mobile phones.
• A third-party agency's campaign list.

If these systems are not coordinated, an opt-out request recorded in one place may not reach the other systems.

This creates a practical risk: a customer may ask the business to stop marketing to them, but a separate employee or agency may continue using an older list.

Create an inventory that identifies:

• The system holding the contact information.
• The business purpose for which it is used.
• The communication channels associated with it.
• The person responsible for the system.
• The source of the contact information.
• The applicable consent or other lawful basis.
• How objections and opt-outs are recorded.
• Whether the list is shared with an external provider.

The inventory does not need to be complicated.

A spreadsheet can be a useful starting point for a small business, provided it is maintained and access is controlled.

5. Separate marketing consent from customer information

One of the most common database-management mistakes is treating every customer contact detail as permission to send promotional messages.

A person may provide a telephone number because they need a quotation, delivery update or support response.

That interaction does not automatically mean that the business can use the number for every future marketing campaign.

POPIA section 69 provides specific requirements for direct marketing through unsolicited electronic communication.

The Information Regulator's guidance explains that a business may rely on the existing-customer exception only where the relevant conditions are met.

These include:

• The contact details were obtained in the context of a sale of a product or service.
• The marketing concerns the business's own similar products or services.
• The customer was given a reasonable opportunity to object when the details were collected.
• The customer is given an opportunity to object in each subsequent marketing communication if they have not initially refused.

Where consent is required, it must be obtained in the appropriate manner.

The regulator also explains that a business may approach a person once to request consent where the statutory conditions are met and the person has not previously withheld it.

This is not a general permission to repeatedly contact people who have not agreed to receive marketing.

Review the Information Regulator's Guidance Note on Direct Marketing when reviewing these requirements.

6. Create a central suppression process

A suppression list records contact details that must not be used for certain marketing activities.

It may include people who have:

• Unsubscribed from email marketing.
• Asked to stop receiving promotional SMS messages.
• Objected to direct marketing.
• Registered a relevant pre-emptive block.
• Withdrawn previously given consent.

The business should have a consistent process for recording and applying these instructions.

For example, if a customer objects to receiving promotional messages, that instruction should not remain only in the inbox of the employee who received it.

It should be reflected in the appropriate marketing systems.

The process should also prevent old lists from being imported again without checking current suppression records.

A central process helps avoid situations where the same customer receives an email from one system after opting out through another.

Be careful about deleting all information associated with an opt-out.

A business may need a minimal record of the objection so that it can continue respecting the person's choice. The way this information is retained should be considered in light of POPIA's requirements for lawful processing, data minimisation and retention.

The business should avoid retaining unnecessary personal information merely because it is easier than maintaining a controlled suppression process.

7. Prepare for monthly list cleansing

The NCC says direct marketers must cleanse their lists monthly before running a direct marketing campaign.

This makes list cleansing an operational process rather than an occasional administrative task.

A business should decide who will perform the check, how the result will be recorded and how the cleansed list will reach the people or systems responsible for sending campaigns.

A practical process could look like this:

Step 1: Identify the campaign

Record the campaign name, intended audience, communication channel and planned date.

Step 2: Prepare the recipient list

Identify the records that will be used for the campaign and confirm their source.

Step 3: Review internal objections

Check the business's own unsubscribe and suppression records.

Step 4: Complete the applicable registry cleansing process

Follow the current NCC procedure for checking and cleansing the list.

Step 5: Apply the results

Ensure that blocked contacts are excluded from the campaign.

Step 6: Record the outcome

Keep an appropriate record of the date, list version, process followed and result.

Step 7: Send only the approved campaign

Ensure that the final recipient list is the one that passed the checks.

The NCC's phased rollout provides a preparation period for businesses to understand the cleansing process and prepare to interface with the system.

The exact technical workflow should follow the Commission's published instructions rather than assumptions based on another marketing platform.

8. Review external marketing providers

Many small businesses use third parties for campaign execution.

These may include:

• Bulk SMS providers.
• Email marketing platforms.
• Call centres.
• Marketing agencies.
• Lead-generation companies.
• CRM and customer-management providers.

Outsourcing a campaign does not remove the need to understand how the contact information is handled.

Ask each provider:

• Where does the recipient list come from?
• Who is responsible for its accuracy?
• How are objections and opt-outs recorded?
• How is the NCC cleansing process handled?
• Can the provider supply evidence of the cleansing process?
• How are campaign lists protected?
• How are outdated or unnecessary records removed?
• What happens when the business ends the contract?

Review the contract or service agreement to establish the responsibilities of each party.

Do not assume that a provider's existing database or registration automatically makes every client campaign compliant.

The business should understand which entity is registering, which lists are being checked and how the results are applied.

9. Update campaign templates and employee procedures

A compliant process can still fail when employees use outdated templates or manual lists.

Review the communication templates used by the business.

Under POPIA section 69(4), electronic direct marketing communications must contain the identity of the sender or the person on whose behalf the communication is sent, together with an address or other contact details to which the recipient can send a request that the communication cease.

Ensure that the business's marketing templates contain the appropriate identification and contact information.

Also review:

• Unsubscribe instructions.
• Customer objection procedures.
• Sales scripts.
• Call-centre instructions.
• Campaign approval processes.
• Staff access to marketing lists.
• Procedures for importing new contacts.
• Training for employees who collect customer details.

Employees should know the difference between recording a customer enquiry and adding someone to a marketing database.

A clear procedure reduces the risk of staff making inconsistent decisions.

10. Keep evidence of marketing decisions

A business should be able to explain where a contact came from and why it was included in a campaign.

This does not mean retaining every piece of personal information indefinitely.

It means maintaining appropriate records that support accountability.

Depending on the business and its processes, useful records may include:

• The source of the contact information.
• The date and method of consent where consent is required.
• The relevant customer relationship where the existing-customer exception is used.
• The date an objection was received.
• The date a contact was suppressed.
• The campaign for which a list was prepared.
• The date the NCC cleansing process was completed.
• The identity of the person approving the campaign.
• The external provider involved.

Access to these records should be restricted to people who need them.

The business should also define how long the records are retained and when they are reviewed or securely disposed of.

11. What this means for smaller South African businesses

A small business does not need a large marketing department to prepare for the registry.

It does need a clear process.

Consider a service business that promotes its offerings to customers in Maboloka, Soshanguve, Centurion and surrounding areas.

It may have contact details collected through website enquiries, WhatsApp conversations, previous customers and local campaigns.

If each source is maintained separately, the business may struggle to apply customer objections consistently.

A practical starting point is to bring the lists into a controlled system, identify the source and purpose of each contact, and establish one process for recording marketing preferences.

The business can then prepare its campaign workflow for the NCC cleansing process.

This is useful even when the business sends only occasional promotional messages.

A small database can still contain outdated details, withdrawn permissions and records that should not be used for marketing.

12. A practical preparation checklist

Use this checklist to review your current direct marketing operations:

• Identify every system containing marketing contacts.
• Identify all channels used for direct marketing.
• Confirm the source of each contact list.
• Review the applicable consent or lawful basis.
• Separate customer-service records from marketing preferences.
• Create a central process for recording objections.
• Prevent suppressed contacts from being re-imported.
• Identify external agencies and campaign providers.
• Review provider responsibilities and contracts.
• Follow the NCC's current registration instructions.
• Prepare for the December 2026 to April 2027 cleansing phase.
• Establish a monthly pre-campaign cleansing procedure.
• Update marketing templates and contact details.
• Train employees who collect or use customer information.
• Keep appropriate evidence of campaign preparation.
• Review the process whenever a new channel or provider is introduced.

Marketing assessment:

If your business uses several marketing channels or maintains multiple customer lists, start with a Mogen assessment to review your current digital business setup.

Frequently asked questions

Is the National Opt-Out Registry already fully operational?

No. The NCC has announced a phased rollout. Direct marketer registration opened on 15 September 2026 and runs until December 2026. The list-cleansing phase is planned for December 2026 to April 2027, with consumer pre-emptive blocking expected from May 2027.

Does a business have to register as a direct marketer?

The NCC states that direct marketers must register with the system. Businesses conducting direct marketing should review the Commission's current registration instructions and complete the applicable process within the published phase.

Does the registry replace POPIA consent requirements?

No. The Information Regulator has explicitly stated that POPIA compliance remains mandatory whether or not a consumer has registered a pre-emptive block. POPIA section 69 continues to regulate direct marketing through unsolicited electronic communication.

Does the registry only apply to telephone calls?

The NCC describes the registry in terms of calls, SMSes and other electronic communication, and its launch statement also refers to emails. Businesses should review all the channels they use and follow the NCC's published guidance.

Can I market to an existing customer?

POPIA section 69(3) provides a specific existing-customer exception subject to conditions. These include how the contact details were obtained, the similarity of the products or services being marketed and the customer's opportunity to object. A business should not assume that every previous customer can automatically receive every promotional message.

What happens during the cleansing phase?

The NCC has announced a five-month period from December 2026 to April 2027 during which direct marketers can cleanse their lists at no cost and prepare to interface with the system. Businesses should follow the Commission's current technical instructions.

Digital marketing:

Visit the Mogen promotions page to review currently published offers before planning your next digital marketing project.

Conclusion

South Africa's National Opt-Out Registry is an important development for businesses that use direct marketing.

The rollout gives marketers time to review their registration, customer databases, campaign processes and relationships with external providers.

The most important preparation is to stop treating marketing lists as static spreadsheets that can be reused indefinitely.

Businesses need to know where their contact information comes from, why it is being used, how objections are recorded and how those decisions are applied before campaigns are sent.

The registry does not replace POPIA. It adds another requirement to an environment where responsible direct marketing already depends on respecting customer choices and handling personal information appropriately.

Start by understanding your current lists and channels. Then follow the NCC's registration and cleansing instructions, document the process and make sure everyone involved in marketing understands their responsibilities.

Sources

• National Consumer Commission: Launch of the National Opt-Out Registry
• National Consumer Commission: Regulations to Curb Spam Calls
• Information Regulator: Statement on the Consumer Protection Act Amendment Regulations 2026
• Information Regulator: Guidance Note on Direct Marketing under POPIA
• South African Government: Consumer Protection Act 68 of 2008