Published Wednesday, 14 October 2026 | By Noleen Thompson, LadyBugz Marketing
I am not usually a follower of rules. But when it comes to spam calls and emails, I make an exception. As someone in marketing and sales, I hate those calls. I’ve been in this industry for almost 30 years, and I know how easy it was to spam people before POPIA. People are still doing what they want and aren’t worried about the consequences, even after I’ve told them how they will get penalised.
So here is the part I want every marketer to hear. Ignore it and it will cost you three times. Once under POPIA. Once under South Africa’s new National Opt-Out Registry. And once in your reputation. No regulator needs to send you a notice for that one.
Key Insights
- Three costs, not one: POPIA (the Protection of Personal Information Act) still governs consent for electronic marketing. The opt-out registry, run by the National Consumer Commission (NCC) under the Consumer Protection Act (CPA), adds a second set of rules and penalties. The third cost is your reputation.
- Cost 1, POPIA: The Information Regulator can issue administrative fines of up to R10 million, ignoring its enforcement notice is a criminal offence carrying up to 10 years in prison, and the people you market to can sue for damages.
- Cost 2, the registry: The National Consumer Tribunal can fine up to R1 million or 10% of annual turnover, whichever is greater. Marketers also pay to register, to renew every year and, from 2027, to clean their lists, possibly for every record each time (ENS via TechCentral).
- Cost 3, your reputation: Enforcement is public. The Information Regulator names organisations in its media statements, the NCC publicises Tribunal fines, and in Cisco’s 2024 survey 75% of consumers said they won’t buy from companies they don’t trust with their data.
- Consent may not save you: The NCC’s draft guidelines (Gazette 55465) say existing consent is invalid once someone registers a block.
- The clock is running: Register by December 2026. Cleaning is free until April 2027, and blocks take effect from May 2027.
What is South Africa’s National Opt-Out Registry?
It’s one national list where people can block direct marketing, run by the NCC and launched in Pretoria on 7 October 2026. Anyone who markets directly by phone, SMS, email or other electronic messages must register on it and check their lists against it every month, according to the NCC’s launch statement.
The right to block marketing has sat in section 11 of the CPA since 2011, but there was no working register until the CPA Amendment Regulations, 2026, gazetted in April by Trade, Industry and Competition Minister Parks Tau. The trigger is obvious enough:
What can ignoring POPIA and the opt-out registry cost you?
It costs you three times. A breach can trigger the Information Regulator under POPIA and the NCC under the CPA, two regulators and two sets of fines. The third bill comes from your market, when buyers stop picking up and stop trusting you.
| What can hit you | How much | Source |
|---|---|---|
| Layer 1: POPIA (Information Regulator) | ||
| Administrative fine | Up to R10 million | POPIA section 109 |
| Ignoring an enforcement notice (a criminal offence) | A fine, up to 10 years in prison, or both | POPIA sections 103 and 107 |
| Civil claim by the person or company you marketed to | Damages, including aggravated damages, with no need to prove intent or negligence | POPIA section 99 |
| Layer 2: CPA opt-out registry (NCC and National Consumer Tribunal) | ||
| Administrative fine | Up to R1 million or 10% of annual turnover, whichever is greater | CPA section 112 |
| Serious cases prosecuted | A fine or up to 12 months in prison | Bowmans, 13 October 2026 |
| Registration and renewal | R2,574 to register, R1,930.50 a year to renew (2026) | TechCentral, 8 October 2026 |
| Monthly list cleansing, from 2027 | 14c per entry in 2027, rising to 18c by 2029; possibly on the whole list (see below) | ENS via TechCentral; Bowmans |
| Layer 3: your reputation (the bill nobody invoices) | ||
| Being named in public | Regulator and NCC media statements name the organisations involved | Information Regulator; NCC |
| Buyers who walk away | 75% of consumers won’t buy from companies they don’t trust with their data | Cisco 2024 Consumer Privacy Survey (12 countries) |
| A spam label on your number | Truecaller tags a number as spam once enough of its users report it | Truecaller help centre |
| Fewer people answering | The share of spam calls answered fell from 10.2% to 7.8% in a year | Minister Tau, quoted by The Citizen |
| Wasted spend | Every bought list, dialler hour and campaign aimed at people who can now block you | Our view |
Watch that cleansing line. Bowmans, writing on Bizcommunity, reads the draft as charging R0.12 only per blocked name. TechCentral reports ENS’s warning that “the entire database” may attract the fee each time, which would put a million-record list at R140,000 a month in 2027.
And the Information Regulator isn’t bluffing. In February 2024, according to its own media statement, it issued its first enforcement notice over direct marketing, against a training company that kept emailing a person about its courses and webinars after they had asked to be removed. That’s ordinary B2B marketing behaviour, not a call centre scam. Werksmans reported in August 2026 that about 10% of the more than 3,800 complaints the Regulator received last year were about direct marketing. The Regulator also holds that phone calls count as electronic communication under POPIA, which the direct marketing industry disputes. If it’s right, cold calls need consent too.
Why is your reputation the third cost?
Because buyers notice, and fines are public knowledge. Every time I see a business bypass POPIA compliance, I don’t want to do business with them.
The regulators don’t keep names quiet either. That first direct marketing notice went to a training company, and the Regulator named the business in its own media statement, for anyone to read. The Regulator’s own media statements also name a national pharmacy group served with an enforcement notice in 2023, and two government departments fined R5 million each. On the CPA side, the NCC publishes statements on Tribunal rulings, like the R500,000 fine against a mobile network operator in February 2025 over a roaming dispute, reported by SAnews.
Your prospects can find all of this in one search. Phones remember too. Truecaller’s help centre explains that it marks a number as spam once enough of its users report it, so your sales line can be flagged before anyone hears your pitch.
In Cisco’s 2024 Consumer Privacy Survey of more than 2,600 people in 12 countries, 75% said they won’t buy from companies they don’t trust with their data. A fine is paid once. A spam reputation keeps costing you.
When does the opt-out registry start?
It has already started for marketers. From the NCC’s statement unless noted:
15 September 2026: Registration opens for direct marketers.
2 October 2026: Draft compliance guidelines published for comment (Gazette 55465). Still a draft.
December 2026: Registration closes (31 December, per Bowmans). After that, failing to register may itself break the CPA.
December 2026 to April 2027: Free list-cleaning period.
From May 2027: Registered blocks take effect, and lists must be cleaned every month before any campaign. A cleaned list is valid for 30 days (Bowmans).
Doesn’t consent protect me? And does this apply to B2B?
Not necessarily, and very probably yes.
Under POPIA’s section 69, electronic direct marketing already needs consent, unless the person is an existing customer being offered similar products with a way to opt out. The wording says “his, her or its” consent, so companies are covered. The NCC’s draft guidelines go further. As Werksmans summarises them, existing consent becomes invalid once someone registers a block. Werksmans thinks that’s flawed and it may change, but plan for it anyway.
Michalsons reports the draft covers calls, SMS, email, messaging applications (think WhatsApp) and online platforms. On B2B, the CPA gives “every person” the right to block marketing, and a company is a person. Nicolene Schoeman-Louw of SchoemanLaw argues on Bizcommunity that the 2026 rules reach B2B direct marketing. That’s one firm’s reading, not an NCC ruling, but I’d plan as if it holds.
LinkedIn? Nobody has ruled. My view: a post people choose to follow approaches nobody, but a cold sales DM (direct message) is close to a cold call. Our guide to permission-based marketing on LinkedIn shows how to start conversations without one.
What should B2B marketers do before December 2026?
Step 1: Register if you market directly. Use the “eServices & OORS” link on the NCC website.
Step 2: Find every list. CRM, email platform, event sign-ups, the spreadsheet on someone’s laptop.
Step 3: Prove consent or delete. Log where each contact came from, when, and what they agreed to. If you can’t show it, remove them. It stings for about a week.
Step 4: Test a cleanse while it’s free.
Step 5: Put it in your contracts. If an agency or call centre markets for you, agree in writing who cleans the lists, who keeps the records and who pays if it goes wrong.
Selling across borders? Our Global B2B Outreach Compliance Cheat Sheet puts POPIA next to GDPR and CAN-SPAM.
What works instead of cold outreach?
Marketing people ask for. Nobody blocks a newsletter they signed up for. One business outsourcing webinar we ran drew 784 registrations through organic LinkedIn, with no ad spend and no dialler. Every one of those people asked to hear from the host.
- Make your leaders visible with LinkedIn profile management.
- Run webinars that sell without selling, where registering is the consent.
- Start a LinkedIn newsletter on a personal profile.
- Pull it together in an organic B2B marketing strategy.
Frequently asked questions
How much can ignoring the opt-out registry and POPIA cost?
It costs you three times. Under POPIA, administrative fines of up to R10 million, up to 10 years in prison for ignoring an enforcement notice, and civil damages. Under the CPA, fines of up to R1 million or 10% of annual turnover, whichever is greater, plus registration, renewal and list-cleansing fees. And in your reputation, which no fine schedule covers.
How does ignoring POPIA hurt a business’s reputation?
Enforcement is public. The Information Regulator names organisations in its media statements and the NCC publicises Tribunal fines, so buyers can look you up. Numbers reported often enough get a spam label on Truecaller, and in Cisco’s 2024 survey 75% of consumers said they won’t buy from companies they don’t trust with their data.
Does the opt-out registry replace POPIA?
No. POPIA’s consent rules still apply. The registry is a second layer on top, with its own regulator and fines.
Can people block marketing on the registry today?
They can sign up on the NCC’s portal, but the NCC says blocks only take effect from May 2027.
Do B2B companies have to register as direct marketers?
If you promote your products or services directly to people or companies by phone, SMS, email or messaging apps, assume yes.
Does the registry cover email and WhatsApp?
The NCC named emails at its launch, and the draft guidelines include email, messaging applications and online platforms. Plan as if both are covered.
If someone gave us consent, can we still contact them after they register a block?
Under the NCC’s draft guidelines, no. Existing consent becomes invalid once a block is registered. The guidelines are still a draft.
Is the DMASA opt-out list the same thing?
No. The Direct Marketing Association of South Africa (DMASA) runs a separate industry list. According to Michalsons, the NCC has said it will only recognise its own registry when it enforces.
Editorial note: this article explains the law as reported on 14 October 2026 and isn’t legal advice, so check your own position with a legal adviser. The NCC’s guidelines are still in draft, and Bowmans notes that the CPA provision banning marketing to people with a registered block still has to be formally brought into force, so details and dates could move. We’ll update this page when the final guidelines are out.
A word over lunch
If we were sitting across a table, I’d say what I’ve said to plenty of people who didn’t listen. The rules were already there with POPIA. Now there’s a second regulator and a second bill, and the third bill, your name, was always there. Register, clean your lists while it’s free, and keep proof of every consent. Then put your effort into marketing people want to receive. It costs less, and nobody can block it.
Want to know how much of your pipeline depends on lists the registry could block? Book an audit, take the paid LinkedIn Assessment, or email noleen@ladybugz.co.za.
Noleen Thompson, LadyBugz Marketing
Keep reading
