When the Information Regulator investigates a complaint about your marketing or your data collection, the request is short: show me the consent. POPIA puts the burden of proving consent on the business, so “everyone on our list opted in” only counts if you can produce the record behind each name. Most businesses have a privacy policy that talks about consent and no data that evidences it.
What consent means in the Act
POPIA defines consent as a voluntary, specific and informed expression of will. Each word does work. Voluntary means the person could refuse without losing the service. Specific means it covers this use of this information, so a checkbox for delivery updates does not cover a newsletter. Informed means the person saw, at the time, what they were agreeing to. A record that proves consent therefore has to capture what the person was shown, because the wording is half the evidence.
The record that survives scrutiny
A defensible consent log is a table, one row per consent event, held wherever your customer data lives:
- Who: the data subject, tied to your customer record.
- When: a timestamp from the system, entered by no human hand.
- Where: the form, page or call script through which it was given.
- What was shown: the exact wording, or a version reference that resolves to the exact wording.
- What it covers: the purpose and the channels agreed to.
- Withdrawals: the same row structure, appended when the person opts out, because the history matters as much as the current state.
None of this needs new software. A consent table in the existing CRM or database, written by the forms that collect the consent, covers it. The one rule is that the record is created by the system at the moment of consent, because a spreadsheet reconstructed for the audit persuades nobody.
The afternoon test
Pick ten names from your marketing list and try to produce the six fields above for each. If it takes an afternoon, the system works. If it takes a project, the audit will go the same way, and the time to fix it is while the question is hypothetical.
Would your list pass the afternoon test? Tell us what’s on fire