South Africa’s 2026 amendments to the Consumer Protection Act regulations introduce a national opt-out registry for direct marketing. A consumer registers once and can block marketing from specific companies or from everyone. For businesses that market directly, this is less an update than a reset of how direct marketing is expected to work in South Africa.
What changed
The opt-out right has existed on paper for years, while enforcement depended on each consumer objecting to each company, one at a time. The registry replaces that with a single mechanism. Alongside it come transparency requirements, so every outreach attempt must clearly identify who is calling or writing, and penalties that reach R1 million or 10% of annual turnover. Direct marketing has moved from an etiquette question into a regulated compliance area.
What it asks of a business
The obligation is active rather than passive. A business must maintain its contact databases against the registry, which means knowing where every marketable record came from, when it was last checked, and whether the person behind it has opted out anywhere along the line. A list bought three years ago and mailed quarterly is now a liability with a spreadsheet attached.
The amendments also slot into an existing framework rather than replacing it. POPIA governs how personal information is collected and processed in the first place, while the CPA amendments govern the consumer’s right to say stop. A compliant operation needs both: lawful collection on the way in, and a working opt-out check on the way out.
The strategic read
High-volume, low-precision marketing gets more expensive under this regime, because every uninvited contact now carries regulatory risk as well as reputational cost. Permission-based, well-targeted communication gets comparatively cheaper. The businesses that win under the new rules are the ones that already know their data: where each consent came from, when it was given, and which records they may still touch.
- Audit the contact database before the next campaign rather than after the first complaint.
- Record consent as data, with a source and a date, rather than as a policy statement.
- Build the registry check into the campaign process itself, so no send can go out around it.
Unsure what the registry means for your database? Tell us what’s on fire