POPIA — POPIA Guidance Note: Guidance Note on Direct Marketing in Terms of POPIA (current version dated 3 December 2024) (source: https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf)
Guidance Note on Direct Marketing 1
Guidance Note on
Direct Marketing
In terms of the Protection Of Personal
Information Act 4 Of 2013 (POPIA)
Guidance
Note on Direct
Marketing
in terms of the Protection of Personal
Information Act 4 of 2013 (POPIA)
Contents
Definitions 4
1. Introduction 5
2. Purpose 5
3. Legislative Framework 5
4. Direct Marketing and the types of direct marketing in terms of POPIA 9
5. Direct marketing other than direct marketing by means of unsolicited electronic 10
communications
6. Objection in terms of section 11 (3)(b) of POPIA 13
7. Direct marketing by means of unsolicited electronic communication in terms of 14
section 69 of POPIA
8. Registering a pre-emptive block in terms of section 11 of the Consumer 17
Protection Act 68 of 2008
9. Compliance with the eight conditions for the lawful processing of personal 17
information
10. General guidance regarding sharing of personal information and automated 22
decision-making
11. Legal effect of the Guidance Note 22
12. Contact details 23
13. Reference List 24
4 Information Regulator SA
Definitions.
Automatic calling means a machine that is able to do automated calls without human intervention where the
machine term is used in section 69(1) of POPIA.
Consent means any voluntary, specific and informed expression of will in terms of which
permission is given for the processing of personal information.
Data subject means the person to whom personal information relates.
Direct marketing means to approach a data subject, either in person or by mail or electronic
communication, for the direct or indirect purpose of –
(a) promoting or offering to supply, in the ordinary course of business, any goods or
services to the data subject; or
(b) requesting the data subject to make a donation of any kind for any reason.
Electronic means any text, voice, sound or image message sent over an electronic communications
communication network which is stored in the network or in the recipient’s terminal equipment until it is
collected by the recipient.
Information matching means the comparison, whether manually or by means of any electronic or other device,
programme of any document that contains personal information about ten or more data subjects with
one or more documents that contain personal information of ten or more data subjects,
for the purpose of producing or verifying information that may be used for the purpose of
taking any action in regard to an identifiable data subject.
Lead generation means to seek contact details to use for direct marketing purposes, for example, from
the individuals who buy products and services or who show interest or support a cause;
or from third parties who sell or rent lists of contact details; or from publicly available
sources.
This information could be sought to reach potential new customers (e.g. obtaining contact
details of people with which no prior relationship exists); to find new contact details for
existing customers (e.g. adding new contact channels for them); or to profile customers
(e.g. analysing their behavioural characteristics to find out their preferences).1
Processing means any operation or activity or any set of operations,
whether or not by automatic means, concerning personal information, including—
(a) the collection, receipt, recording, organisation, collation, storage, updating or
modification, retrieval, alteration, consultation or use;
(b) dissemination by means of transmission, distribution or making available in any
other form; or
(c) merging, linking, as well as restriction, degradation, erasure or destruction of
information.
Public body means any department of state or administration in the national or provincial sphere
of government or any municipality in the local sphere of government; or any other
functionary or institution when—
(i) exercising a power or performing a duty in terms of the Constitution or a
provincial constitution; or
(ii) exercising a public power or performing a public function in terms of any
legislation.
Public record means a record that is accessible in the public domain, and which is in the possession of
or under the control of a public body, whether or not it was created by that public body;
1 Information Commission Officer (ICO) Direct Marketing Detailed Guidance (referred to herein as ICO Direct marketing
Guidance) 05 December 2022 - 1.0.822 at 36.
Guidance Note on Direct Marketing 5
1. Introduction
1.1 The Information Regulator (Regulator) is established as a juristic person in terms of section 39 of the
Protection of Personal Information Act 4 of 2013 (POPIA). POPIA gives effect to the constitutional
right to privacy, by safeguarding personal information when processed by the responsible party,
subject to justifiable limitations that are aimed at (i) balancing the right to privacy against other
rights particularly the right of access to information; and (ii) protecting important interests, including
the free flow of information within the Republic and across international borders; regulates the
manner in which personal information may be processed by establishing conditions, in harmony with
international standards, that prescribe the minimum threshold requirements for lawful processing
of personal information while providing persons with rights and remedies to protect their personal
information from the processing that is not in accordance with POPIA.
1.2 Chapter 3 of POPIA provides for the conditions for lawful processing of personal information. The
processing of personal information of data subjects for the purpose of direct marketing must comply
with the eight (8) conditions for lawful processing of personal information.
1.3 This Guidance Note provides guidance to the responsible parties on how personal information should
be processed in compliance with the eight (8) conditions for lawful processing of personal information.
Therefore, this Guidance Note assists in the interpretation of POPIA in relation to direct marketing as
defined in POPIA.
2. Purpose
2.1 The purpose of this Guidance Note is to guide the responsible parties on how to comply with POPIA
when processing personal information of data subjects for direct marketing by means of unsolicited
non-electronic communications in terms of sections 11 and unsolicited electronic communications in
terms of section 69 of POPIA.
3. Legislative Framework
The following non exhaustive list of provisions in POPIA apply to the processing of personal
information in respect of direct marketing:
3.1 Section 3(2): Application
(a) “This Act applies, subject to paragraph (b), to the exclusion of any provision of any other
legislation that regulates the processing of personal information and that is materially
inconsistent with an object, or a specific provision, of this Act”.
(b) “If any other legislation provides for conditions for the lawful processing of personal
information that are more extensive than those set out in Chapter 3 of POPIA, the extensive
conditions prevail”
6 Information Regulator SA
3.2 Section 5: Rights of the data subject
3.2.1 “A data subject has the right to have his, her or its personal information processed in
accordance with the conditions for the lawful processing of personal information as referred to
in Chapter 3, including the right—
(e) to object to the processing of his, her or its personal information—
(i) at any time for purposes of direct marketing in terms of section 11(3)(b); or
(ii) in terms of section 69(3)(c);
(f) not to have his, her or its personal information processed for purposes of direct marketing by
means of unsolicited electronic communications except as referred to in section 69(1);
(h) to submit a complaint to the Regulator regarding the alleged interference with the protection
of the personal information of any data subject or to submit a complaint to the Regulator in
respect of a determination of an adjudicator as provided for in terms of section 74”.
3.3 Section 11: Consent, Justification and Objection
3.3.1 Section 11(1)(a) - “Personal information may only be processed if the data subject or a
competent person where the data subject is a child consents to the processing”;
3.3.1 Section 11(1)(b) - “Processing is ncessary to carry out actions for the conclusion or
performance of a contract to which the data subject is party”,
3.3.1 Section 11(1)(c) - “Processing complies with an obligation imposed by law on the responsible
party”,
3.3.1 Section 11(1)(d) - “Personal information may only be processed if the processing protects a
legitimate interest of the data subject”;
3.3.1 Section 11(1)(f) - “Personal information may only be processed if processing is necessary
for pursuing the legitimate interests of the responsible party or of a third party to whom the
information is supplied”.
3.3.1 Section 11(2)(a) - “The responsible party bears the burden of proof for the data subject’s or
competent person’s consent as referred to in subsection (1)(a)”.
3.3.1 Section 11(3)(a) - “A data subject may object, at any time, to the processing of personal
information in terms of subsection 11(1)(d) or (f)”.
3.3.1 Section 11(3)(b) - “A data subject may object, at any time, to the processing of personal
information for purposes of direct marketing other than direct marketing by means of
unsolicited electronic communications as referred to in section 69”.
3.3.1 Section 11(4) - “If a data subject has objected to the processing of personal information
in terms of sections 11(3), the responsible party may no longer process the personal
information”.
Guidance Note on Direct Marketing 7
3.4 Section 18: Notification of the data subject
3.4.1 Section 18(1) - “If personal information is collected, the responsible party must take
reasonably practicable steps to ensure that the data subject is aware of—
3.4.2 Section 18(1)(a) - the information being collected and where the information is not collected
from the data subject, the source from which it is collected;
3.4.3 Section 18(1)(b) - the name and address of the responsible party;
3.4.4 Section 18(1)(c) - the purpose for which the information is being collected;
3.4.5 Section 18(1)(d) - whether or not the supply of the information by that data subject is
voluntary or mandatory;
3.4.6 Section 18(1)(e) - the consequences of failure to provide the information;
3.4.7 Section 18(1)(f) - any particular law authorising or requiring the collection of the information;
3.4.8 Section 18(1)(g) - the fact that, where applicable, the responsible party intends to transfer the
information to a third country or international organisation and the level of protection afforded
to the information by that third country or international organisation;
3.4.9 Section 18(1)(h) - any further information such as the—
(i) recipient or category of recipients of the information;
(ii) nature or category of the information;
(iii) existence of the right of access to and the right to rectify the information collected;
(iv) existence of the right to object to the processing of personal information as referred to in
section 11(3); and
(v) right to lodge a complaint to the Information Regulator and the contact details of the
Information Regulator, which is necessary, having regard to the specific circumstances in
which the information is or is not to be processed, to enable processing in respect of the data
subject to be reasonable”.
3.4.10 Section 18 (2) - The steps referred to in subsection (1) must be taken—
3.4.11 Section 18 (2)(a) - “if the personal information is collected directly from the data subject,
before the information is collected, unless the data subject is already aware of the information
referred to in that subsection; or
3.4.12 Section 18 (2)(b) - in any other case, before the information is collected or as soon as
reasonably practicable after it has been collected”.
3.4.13 Section 18 (3) - “A responsible party that has previously taken the steps referred to in
subsection (1) complies with subsection (1) in relation to the subsequent collection from
the data subject of the same information or information of the same kind if the purpose of
collection of the information remains the same”.
3.4.14 Section18 (4) - “It is not necessary for a responsible party to comply with subsection (1) if—
(a) the data subject or a competent person where the data subject is a child has provided
consent for the non-compliance;
(b) non-compliance would not prejudice the legitimate interests of the data subject as set out in
terms of this Act;
8 Information Regulator SA
(c) non-compliance is necessary—
(i) to avoid prejudice to the maintenance of the law by any public body, including the prevention,
detection, investigation, prosecution and punishment of offences;
(ii) to comply with an obligation imposed by law or to enforce legislation concerning the collection
of revenue as defined in section 1 of the South African Revenue Service Act, 1997 (Act No.
34 of 1997);
(iii) for the conduct of proceedings in any court or tribunal that have been commenced or are
reasonably contemplated; or
(iv) in the interests of national security;
(d) compliance would prejudice a lawful purpose of the collection;
(e) compliance is not reasonably practicable in the circumstances of the particular case; or
(f) the information will—
(i) not be used in a form in which the data subject may be identified; or
(ii) be used for historical, statistical or research purposes”.
3.5 Section 69 Direct marketing by means of unsolicited electronic
communications.
3.5.1 Section 69(1) – “The processing of personal information of a data subject for the purpose
of direct marketing by means of any form of electronic communication, including automatic
calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject —
(a) has given his, her or its consent to the processing; or
(b) is, subject to subsection (3), a customer of the responsible party”.
3.5.2 Section 69(2)(a) – “A responsible party may approach a data subject—
(i) whose consent is required in terms of subsection (1)(a); and
(ii) who has not previously withheld such consent, only once in order to request the consent of
that data subject”.
3.5.3 Section 69(2)(b) – “The data subject’s consent must be requested in the prescribed manner
and form”.
3.5.4 Section 69(3) – “A responsible party may only process the personal information of a data
subject who is a customer of the responsible party in terms of subsection (1)(b)—
(a) if the responsible party has obtained the contact details of the data subject in the context of
the sale of a product or service;
(b) for the purpose of direct marketing of the responsible party’s own similar products or services;
and
(c) if the data subject has been given a reasonable opportunity to object, free of charge and in a
manner free of unnecessary formality, to such use of his, her or its electronic details—
Guidance Note on Direct Marketing 9
(i) at the time when the information was collected; and
(ii) on the occasion of each communication with the data subject for the purpose of marketing if
the data subject has not initially refused such use”.
3.5.5 Section 69(4) “Any communication for the purpose of direct marketing must contain—
(a) details of the identity of the sender or the person on whose behalf the communication has
been sent; and
(b) an address or other contact details to which the recipient may send a request that such
communications cease”.
3.5.6 Section 69(5) ‘‘Automatic calling machine, for purposes of subsection (1), means a machine
that is able to do automated calls without human intervention.
4. Direct Marketing and the types of direct marketing in terms of
POPIA.
4.1 POPIA draws a distinction between two types of direct marketing namely:
4.1.1 Direct marketing other than by means of unsolicited electronic communication in
terms of section 11 of POPIA. 2
Examples of this type of direct marketing include:
(i) Direct marketing by means of post or hand-delivered mail;
(ii) In person;
(iii) Letterbox drops distributed to an identified address in a specific area.
4.1.2 Direct marketing by means of unsolicited electronic communication in terms of section
69 of POPIA.
Examples of this type of direct marketing include direct marketing by means of:
(i) Telephone;
(ii) Automatic calling machines;
(iii) Facsimile machines;
(iv) SMSs; or
(v) E-mail.
2 These include direct marketing by using means that are non-electronic communication.
10 Information Regulator SA
5. Direct marketing other than direct marketing by means of
unsolicited electronic communications.
Where direct marketing communication is by non-electronic means, the responsible party may be
able to process personal information for direct marketing without obtaining consent from the data
subject. This is possible where the responsible party relies on section 11(1) (d or (f) as justification for
dispensing with the consent required in terms of section 11(1) (a); in these instances, the responsible
party will need to first identify the legitimate interest of the data subject, the responsible party or third
party (whichever is applicable).
5.1 Legitimate interest as justification for lawful processing of the personal
information.
Legitimate interest is not defined in POPIA. The term “legitimate” is defined as “able to be defended
with logic or justification”3 while “interest” is defined in this context as “the advantage or benefit of
someone”.4 To be considered legitimate, the interest must be lawful.5 In application to the direct
marketing context, a legitimate interest provides justification that is to the advantage or benefit of a
data subject, responsible party or third party which can be defended or validated.
The reliance on legitimate interest as a legal justification is not automatic. The onus is on the
responsible party to justify the use of legitimate interests as the relevant basis for the processing of
personal information.
5.1.1 Protection of the legitimate interest of a data subject as justification for lawful
processing of the personal information of a data subject.
Before adopting legitimate interest as justification for the processing of personal information
of data subjects, the responsible party must have regard to whether the processing will
protect the legitimate interests of the data subjects. It is not sufficient that the processing will
be of benefit to a data subject.
Responsible parties may not use the legitimate interest as a basis where the data subjects
are likely to view the processing as pervasive, disruptive, intrusive”6 and generally not
acceptable to the recipient.
5.1.1.1 Examples of processing that protects a legitimate interest of the data subject (the list
is non-exhaustive)-
(a) Direct marketing will be in the interest of the data subject where he/she/it will receive “money-
off products” (discount);
(b) The responsible party approaches the data subjects with the product or service that is likely
to be of interest to that data subject, based on the historical information regarding buyer
behaviour of the data subject.
3 Concise Oxford English Dictionary Eleventh Edition revised, 2006, Soanes C, and Angus Stevenson. Oxford University
Press.
4 As above
5 Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC/844/14/
EN WP 217, adopted on 9 April 2014.
6 Gbadamosi A, Contemporary issues in Marketing,2019, SAGE publishing, at 242
Guidance Note on Direct Marketing 11
(c) Historical information is created in instances where the data subject logs into a company’s
website to browse its range of products, and the data subject completes an online enquiry
form asking for more details about a product or range of products. Legitimate interest is
created as there is an expectation by the data subject to have the personal information
processed for the purpose related to their interaction with the company. 7
5.1.2 Processing in pursuance of the legitimate interest of the responsible party.
Personal information may in terms of section 11(1)(f) be processed if the processing is
necessary for pursuing the legitimate interests of the responsible party or of a third party to
whom the information is supplied.
5.1.2.1 Examples of processing that pursues the legitimate interest of responsible parties are
not limited to the following:
(a) to increase sales,8
(b) to persuade a data subject to purchase, 9
(c) to ‘educate the data subjects about products’10
(d) ‘profiling data subjects to target direct marketing’. 11
5.2 The Legitimate Interest Assessment (LIA).12
To rely on legitimate interest as a lawful basis for processing personal information for direct marketing
purposes, the responsible party must undertake the following three (3) stage assessment:
5.2.1 The first assessment relates to the purpose test that helps to objectively identify a
legitimate interest and that requires the following related considerations to be made by
the responsible party:-
(a) What is the purpose of processing personal information of data subjects?
(b) What is the benefit to be derived from the processing?
(c) What is the interest (benefit) of the responsible party or of any third party in the processing?
(d) Is the processing not in conflict with the interests of society?
(e) What will be the consequences for the responsible party if the processing does not proceed?
(f) Is the processing compliant with a legislation, by-law, rule or policy?13
7 ICO Direct Marketing Guidance) at 42
8 Information Commissioner’s Office (ICO), General Data Protection Regulations (GDPR) UK (ICO Legitimate Interest
Guide)
9 Gbadamosi A, Contemporary issues in Marketing,2019, SAGE Publishing at 309
10 Gbadamosi A, Contemporary issues in Marketing,2019, SAGE Publishing, at 30
11 ICO Legitimate Interest Guide) at 28
12 The Information Commissioner’s Office (ICO), General Data Protection Regulations (GDPR) UK https://ico.org.uk/for-
organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/how-do-we-apply-legitimate-interests-
in-practice/ (How do we apply legitimate interests in practice?) accessed 15.09.2024 and 11.10.2024
13 Article 29 Data Protection Working Party; Opinion 06/2014 on the notion of legitimate interests of the data controller under
Article 7 of Directive 95/46/EC Adopted on 9 April 2014, at 58 (Article 29 WP)
12 Information Regulator SA
5.2.2 The second assessment relates to the necessity test to consider the connection
between the processing and the interests pursued as well as purpose stated in the
first test above.14 The responsible party should determine aspects not limited to the
following:
(a) Is the processing of personal information necessary to achieve the specified purpose?
(b) Is the processing proportionate to what the responsible party is trying to achieve with the
processing purpose?
(c) Can the processing never proceed with less personal information processed or with no
processing of personal information at all?
(d) Is the processing method (including method of communication) the least intrusive method
(approach) available to achieve the specified purpose?
5.2.3 The third assessment relates to the balancing test.
The responsible party should balance the legitimate interest of that responsible party against
the interests and rights of the data subject. The rights of the data subjects will override the
interests of the responsible party or a third party. 15 In the balancing test, the responsible
party should determine factors not limited to the following:
(a) the nature of the personal data it wants to process and whether the processing involves
any type of personal information that falls under the special personal information in terms of
section 27 (1) of POPIA e.g. (biometric information, health information, genetic information)
or the processing personal information is related to children and minors. There are stricter
requirements for the processing of the latter type of personal information.
In addition to the preceding considerations in (a) to (c), the responsible party should
ask the following questions
(i) Is the personal information such which data subjects are likely to consider as ‘private’?
(ii) Is the personal information about the data subjects in their personal or professional
capacity?16
(a) the reasonable expectations of the data subject who will be affected by the processing and
(b) the likely impact of the processing on the data subject and whether any safeguards can be
put in place to mitigate the negative impacts.
5.2.4 When to conduct the assessment on legitimate interest.
The responsible party must conduct the legitimate interest assessment before commencing
with the processing activity as the result of the assessment will help to identify and to confirm
whether the legitimate interest can be a lawful basis for the processing.
5.2.5 Consequence of not meeting all the criteria in the LIA.
The responsible party who fails to establish a legitimate interest for the processing of
personal information will not have established a lawful basis for such processing and will be
in breach of POPIA.
14 ICO Legitimate Interest Guide at 28
15 ICO Legitimate Interest Guide at 38
16 ICO Legitimate interests assessment (LIA) template, LIA template 20180319 , v1.0
Guidance Note on Direct Marketing 13
6. Objection in terms of section 11 (3)(b) of POPIA.
6.1 Objection at any time.
The data subject who has received direct marketing messages through mail or post or in person, from
the responsible party that relied on the legitimate interest justification in terms of section 11(1)(d) or (f)
may in terms of section 11(3) (b) of POPIA, at any time, object to this type of direct marketing.
6.2 Manner of objection.
The data subject who wishes to object must lodge the objection on the prescribed Form 1 provided
for in the Regulations Relating to Protection of Personal Information POPIA (made in terms of section
112(2) of POPIA) 17 or any form which is substantially similar to Form 1. The submission of the
form must be free of charge and must be made readily accessible to a data subject. Submit means
submit18 by:-
(a) data message;
(b) electronic communication;
(c) registered post;
(d) electronic mail;
(e) facsimile; and
(f) personal delivery.
These methods of submission do not exclude any other method that achieves the purpose of enabling
the data subject to object to the processing for purposes of direct marketing. This form may be
obtained from the website of the Regulator by accessing the below link:
Form-1-Objection-to-the-processing-of-personal-information.pdf (inforegulator.org.za)19
6.3 Processing after objection must stop.
Where the data subject has objected to the processing of personal formation for the purposes of
direct marketing in terms of section 11(3)(b) of POPIA, the responsible party must in terms of section
11(4) not contact the data subject again. If the responsible party is relying on legitimate interests for
direct marketing purposes, and the data subject objects, the processing must stop.20
6.4 Database of objections
The responsible party must compile and maintain a database of all data subjects who have objected
to direct marketing through the means contemplated in paragraph 6.2 above and must not contact the
data subjects who are in the database.
17 Regulations Relating to Protection of Personal Information (POPIA), 2018. (POPIA Regulations)
18 Regulation 1 of the POPIA Regulations.
19 https://inforegulator.org.za/popia-forms / . Link tested to be functional on 14.11.2024
20 ICO Legitimate Interest Guide at 46.
14 Information Regulator SA
7. Direct marketing by means of unsolicited electronic
communication in terms of section 69 of POPIA.
7.1 Methods of direct marketing by means of unsolicited electronic communication
are not limited to the following:
(a) Telephone;
(b) Email;
(c) Short Message Service (SMS);
(d) Automatic calling machines; or
(e) Facsimile machines (fax);
(f) Push notification;21
(g) Direct messaging in Instagram or LinkedIn;22
(h) Use of cookies.23
7.1.1 It is the view of the Regulator that telephone calling is electronic communication by virtue
of telephone communications technology having become digital over time. Telephone calls
predominantly use VoIP (Voice over Internet Protocol) which is packet-switched telephony
rather than the public-switched telephony previously used for analogue communication.
7.1.2 The analogue voice is encoded into a digital stream that is divided into small data packets
which are labelled according to their order. These voice data packets are transmitted using
real-time protocols during a telephone call are stored on the network. The voice data packets
are re-assembled to match the original order of transmission, error correction is applied
to digital data stream to compensate for the delay caused by packet re-assembly and
finally relayed to the recipient’s terminal equipment to be decoded into analogue voice for
consumption upon the recipient’s acceptance of the call.
7.2 Unsolicited electronic communication where a data subject is not a customer.
7.2.1 The responsible party who intends to use unsolicited electronic communication to send
a direct marketing message to a data subject who is not their customer, must obtain the
consent of such a data subject before sending the communication as stipulated in section
69(1)(a) of POPIA. This means that the first communication which the responsible party
sends to the data subject must be a communication requesting consent of the data subject to
market their goods, or services or to request a donation.
7.2.2 The responsible party who wants to send direct marketing communication by means of
unsolicited electronic may approach the data subject only once for the purpose of obtaining
the consent of such data subject and can only approach the data subject who has not
previously withheld consent as stipulated in section 69(2)(a)(i) and (ii) of POPIA.
21 Stadler E, Over-thinking POPIA, Juta and Company 2022 at 477
22 Stadler E, Over-thinking POPIA, Juta and Company 2022 at 477
23 Information Commissioner’s Office, Guide to Privacy and Electronic Communications Regulations (PECR) 2018 (ICO-
PECR, 2018), at 31 -36 and Opinion, 2, 2010, Working, Party, online, behavioural, advertising, wp171.
Guidance Note on Direct Marketing 15
7.2.3 The responsible party who wishes to obtain consent of the data subject must obtain the
written consent by making use of Form 4 which has been prescribed by the Regulator or in
any form which is substantially similar to this Form 4 and in manner that may be expedient,
free of charge and readily accessible to the data subject by “data message; electronic
communication; registered post; electronic email; facsimile and personal delivery” 24. Form 4
can be obtained from the Information Regulators’ website on this link - Form-4-Application-for-
the-consent-of-a-data-subject-for-the-processing.pdf (inforegulator.org.za).25
7.2.4 It is important to note that this form requires:
(a) a data subject to consent to receive direct marketing messages through unsolicited electronic
communication,
(b) the responsible party to specify the goods or services he, she or it intends to market to the
data subject through unsolicited electronic communication. This will enable the data subject to
give voluntary, specific, and informed consent.
(c) a data subject to specify the method of communication which the responsible party can use
to send the communication to him or her. The responsible party must adhere to the method
chosen by the data subject to send him or her direct marketing messages.
7.2.5 The responsible party who uses methods of communication such as a fax machine, a SMS or
an email can use an electronic version of Form 4 to obtain consent of a data subject, as long
as it contains all the information prescribed in that form. The form can contain the words “I
give my consent” and “I do not give my consent” at the end. A data subject can choose “I give
my consent” to give consent or “I do not give my consent” to withhold consent.
7.2.6 The responsible party who uses a telephone to obtain consent must read out the contents of
Form 4 to the data subject to obtain his or her consent. The telephone call must be recorded.
7.2.7 The responsible party who uses an automatic calling machine must ensure that the recorded
message that they use to obtain consent of a data subject contains all the information in
Form 4 and that it enables a data subject to provide all the required information, including the
choice to “I give my consent” and “I do not give my consent”. A data subject’s response must
be recorded.
7.2.8 In terms of section 11 (2) (a) of POPIA, the responsible party bears the onus of proving
that a data subject gave consent to receive direct marketing messages through unsolicited
electronic communication.
7.2.9 A data subject who has given consent to receive direct marketing messages by means
of unsolicited electronic communication can withdraw his, her or its consent at any time.
However, the direct marketing messages received before the withdrawal of consent will not
be affected.26
24 Regulation 1 of the Regulations Relating to Protection of Personal Information (POPIA), 2018.
25 https://inforegulator.org.za/popia-forms / Link tested to be functional on 14.11.2024
26 Section 11(2) (b) of POPIA.
16 Information Regulator SA
7.3 Where the data subject is a customer of the responsible party.
The responsible party can send direct marketing messages through unsolicited electronic
communication only to a data subject who is its customer as required by section 69 (3):
7.3.1 If the responsible party has obtained the contact details of a data subject in the context of a
sale of a product or service, for example, a data subject opens an account at a retail store
which sells clothing, and the responsible party records her contact details for the purpose of
opening the account.
7.3.2 For the purpose of direct marketing of a responsible party’s similar products or services,
for example, in a clothing retail store, similar products include shoes, belts etc. A funeral
insurance cover will not constitute a similar product.
7.3.3 If the data subject has been given a reasonable opportunity to object, free of charge and in a
manner free of unnecessary formalities, to such use of his, her or its electronic details-
(i) At the time the information was collected,
Example,
At the time of opening a credit account at a clothing retail store, a responsible party can ask a
data subject if they “do not give consent” (object) to receiving direct marketing messages of similar
products or services through electronic communication. If they “do not give consent” (object), the
responsible party cannot send them direct marketing messages; and
(ii) On the occasion of each communication with a data subject for the purpose of marketing if a
data subject has not initially refused such use.
Example,
If a data subject had given consent to receive direct marketing messages of similar products or
services through electronic communication when he or she opened an account, such data subject
must be given an opportunity to object on each occasion she receives such a message. It is important
to note that a data subject who was not asked whether she consented to receiving direct marketing
messages at the time of opening an account cannot be deemed to have given her consent since
consent means a voluntary, specific and informed expression of will in terms of which permission is
given for the processing of personal information. Therefore, silence cannot mean consent.
7.3.4 Any communication sent by the responsible party for the purpose of direct marketing (in
terms of both section 11 and section 69 of POPIA) must contain the following information as
stipulated in section 69 (4) of POPIA:
7.3.4.1 details of the identity of the sender or the person on whose behalf the communication has
been sent; and
7.3.4.2 an address or other contact details to which the recipient may send a request that such
communications cease.
7.3.5 The responsible party must compile and maintain a database of data subjects who have
withheld their consent in terms of section 69(2)(a)(ii) and data subjects who have objected in
terms of section 69 (3)(c) of POPIA.
Guidance Note on Direct Marketing 17
8. Registering a pre-emptive block in terms of section 11 of the
Consumer Protection Act 68 of 2008.
8.1 Section 11 of the Consumer Protection Act 68 of 2008 (CPA) makes provision for the establishment
of the registry in which any person may register a pre-emptive block against any electronic
communication that is intended for the purposes of direct marketing of goods or services.
8.2 POPIA requires that responsible parties must in terms of section 69(1)(a) of POPIA obtain consent.
Section 69(2)(a) of POPIA requires the responsible party to contact the data subject only once in
order to obtain such consent, provided that the data subject has not previously withheld such consent.
8.3 A responsible party cannot therefore contact a data subject, who has not registered a pre-emptive
block direct marketing messages by means of unsolicited electronic communication, without having
obtained their consent.
8.4 In other words, even if a data subject has not registered a pre-emptive block, a responsible party must
still comply with the requirements in section 69(1) and (2) of POPIA before sending a data subject
direct marketing messages through unsolicited electronic communication. A responsible party cannot
therefore contact a data subject for purposes of direct marketing simply because they (data subject)
have not registered a pre-emptive block.
9. Compliance with the eight conditions for the lawful processing
of personal information
A responsible party who processes personal information for purposes of direct marketing must comply
with all the conditions for the lawful processing of personal information some of which have been
discussed herein below. All other relevant sections of POPIA must be complied with.
9.1 Collection directly from the data subject - Section 12(1) of POPIA
9.2 In terms of section 12(1) of POPIA, personal information must be collected directly from the data
subject.
9.3 Collecting directly from the data subject will provide opportunity to the responsible party to obtain
consent from that data subject where the data subject is approached for the first time for direct
marketing purposes.
Examples of collection directly from the data subject other than by means of electronic
communication are not limited to the following:
(i) In person: The responsible party collects personal information during a consultative meeting
with a client.
(i) By mail: A data subject responding to promotional mail or catalogue by signing up for further
supply of products promoting subscriptions for further supply of print catalogue.
18 Information Regulator SA
Examples of collection directly from the data subject by means of electronic communication:
(i) The responsible party contacts the data subject through telephone to collect the personal
information directly from the data subject.
Examples of collection directly from the data subject by both electronic means and in person:
(i) The data subject provides their personal information when signing up to take advantage of
the offers or discount vouchers (for example, for shopping or dining).
(ii) The data subject provides contact details when signing up for catalogues that market
products.
9.4 Collection of personal information from other sources - Section 12 (2) of POPIA.
The responsible party can collect personal information about the data subject from another source
if the data subject has consented to such collection or if the personal information is contained in or
derived from a public record or has deliberately been made public by the data subject or collection of
the information from another source would not prejudice a legitimate interest of the data subject; in
terms of section 12(2)(a),(b) and (c) of POPIA respectively.
9.4.1 Personal information is obtained from other sources if the information is contained in or
derived from a public record (viz, a record that is accessible in the public domain and which
is in the possession of or under the control of a public body, whether or not it was created by
that public body) or has deliberately been made public by the data subject.
9.4.2 The responsible party may in terms of section 12(2)(b) collect personal information of a data
subject from another source where the data subject has consented to the collection of the
information.
9.4.3 The information may in terms of section 12(2)(c) of POPIA be collected from another source if
such collection would not prejudice a legitimate interest of the data subject.
9.4.4 To confirm that such collection would not prejudice a legitimate interest of the data subject,
the legitimate interest assessment discussed above will be applicable in this instance.
9.4.5 Information may in terms of section 12(2)(d)(v) of POPIA be collected from another source if
the collection is necessary to maintain the legitimate interests of the responsible party or of a
third party to whom the information is supplied.
9.4.6 A necessity test must be conducted as in 5.2.2 above to confirm the processing of personal
information is necessary to maintain the interest of the responsible party or third party; (the
legitimate interest assessment discussed above will be applicable in this instance)-
Example of collection of personal information contained in or derived from a public record27:
(not limited to the following):-
(i) Personal information published in a public register “collected under a statutory authority and
to which a right of public access is authorised by law”. The source must be a record under
the control of a public body such as the personal information that is stored in the deeds office
register that allows deeds search in terms of the Deeds Registries Act, 2013.28
27 Section 1 of POPIA defines ‘‘public record as “a record that is accessible in the public domain and which is in the
possession of or under the control of a public body, whether or not it was created by that public body”.
28 https://www.gov.za/services/services-residents/place-live/get-deeds-registry-information; Section 7 of the Deeds
Registries Act, 1937 (Act 47 of 1937) Link tested to be active on 14 November 2024
Guidance Note on Direct Marketing 19
Examples of personal information deliberately made public by the data subject:
(i) Contact details of an estate agent on ‘for sale’ signs.
Examples of personal information collected from another source to maintain the legitimate
interests of the responsible party or of a third party to whom the information is supplied are
limited to the following:
(i) List and databases such as direct mail and email lists. These lists can be sourced within the
country and across the borders of a country. 29
9.5 Collection for specific purpose - Section 13 of POPIA.
9.5.1 A responsible party must in terms of section 13 (1) of POPIA, collect information for a specific,
explicitly defined and lawful purpose related to a function or activity of a responsible party.
9.5.1.1 A responsible party must make it clear and must specify that the purpose of collecting
personal information of the data subject is for direct marketing.
9.5.1.2 The lawful purpose for direct marketing must relate to the definition of direct marketing in
terms of section 1 of POPIA which is to approach a data subject, either in person or by mail or
electronic communication, for the direct or indirect purpose of—
(i) promoting or offering to supply, in the ordinary course of business, any goods or services to
the data subject; or
(ii) requesting the data subject to make a donation of any kind for any reason.
Examples of collection for direct purposes of direct marketing.
(i) Direct mail sent to an identified data subject suggesting an offer of a discounted price on the
product if the data subject purchases within a certain time period.
(ii) A responsible party may share samples of products with data subjects to promote or
introduce a new brand of a product 30 with the view that when the data subject is interested,
he/she will make a purchase.
Examples of collection for indirect marketing purposes
(i) Indirect marketing purposes mainly relate to marketing communication31 to raising or
increasing awareness about products or services of the responsible party and or to the
responsible party seeking to build relationships with new customers or to retain existing ones
or for brand marketing (viz boost knowledge of a company or products’ name etc.).33
29 https://www.frescodata.com/mailing-lists-and-email-lists-by-countries/south-africa/
30 Gbadamosi A, Contemporary issues in Marketing,2019, SAGE Publishing.
31 Above at 309 “on marketing communication tools”
32 https://ahrefs.com/blog/indirect-marketing/accessed 15.4.24.
33 Gbadamosi A, Contemporary issues in Marketing,2019, SAGE Publishing, at 726.
20 Information Regulator SA
9.5.2 Section 13(2)
A responsible party must take steps in accordance with section 18 (1) (discussed herein below) to
ensure that the data subject is aware of the purpose of the collection of the information where the
personal information is collected from other sources and not directly from the data subject, unless the
exceptions provisions of section 18(4) are applicable. To ensure that the data subject is aware of the
purpose for processing the information, the responsible must ensure that the notification that meets
the requirements set in section 18(1) of POPIA) is made readily accessible to the data subject.
9.6 Further processing to be compatible with purpose of collection - Section 15 of
POPIA.
9.6.1 Section 15(1) on further processing of personal information.
Further processing of personal information must be in accordance or compatible with the
purpose for which it was collected, the purpose which must be compliant with section 13. The
responsible may further process the personal information of a data subject direct marketing
purposes if section 15(2) or section 15 (3) of POPIA is adhered to.
Example of marketing not related to the original purpose.
(i) ‘A customer applied for a credit card from a bank and consented to the use by the bank of
their personal information for marketing its banking-related products and services. A new
consent has to be obtained if the bank later intends to transfer the customer’s personal data
to the bank’s subsidiary for the latter’s direct marketing of its insurance products’ 34
9.6.2 In terms of section 15(3), the further processing of personal information is not
incompatible with the purpose of collection if -
(a) the data subject or a competent person where the data subject is a child has consented to the
further processing of the information;35 or
(b) the information is available in or derived from a public record or has deliberately been made
public by the data subject.36
(c) the information is used for historical, statistical or research purposes and the responsible
party ensures that the further processing is carried out solely for such purposes and will not
be published in an identifiable form.37
Example of direct marketing not related to the original purpose.
(i) ‘A customer provided his/her personal information to the responsible party for joining its
customer loyalty scheme in order to enjoy discounts and other benefits for purchases made
at the responsible parties grocery stores. For the transfer of the personal data to other
companies which belong to the same responsible parties [group of companies] for direct
marketing purposes, the customer’s written consent is required’. 38 The company would be
34 Office of the Privacy Commissioner for Personal Data, Hong Kong, Guidance on Direct Marketing, April 2023 (referred to
hereafter as OPCPD Guidance on Direct Marketing, 2023) at 19.
35 Section 15 (3) (a)
36 Section 15 (3) (b)
37 Section 15 (3) (c)
38 OPCPD Guidance on Direct Marketing, 2023) at 19
Guidance Note on Direct Marketing 21
processing the same information for a purpose different to the original purpose. The example
applies also to the use of information for telemarketing where this was not the original
purpose for which the personal information was collected.
9.7 The responsible party must take reasonably practicable steps to ensure that the
data subject is aware of the processing of their personal information in terms of
Section 18:
9.7.1 In terms of section 18(1) of POPIA, if personal information is collected about the data subject,
the responsible party must take reasonably practicable steps to ensure that the data subject
is aware of the amongst others, information being collected and where the information is not
collected from the data subject, the source from which it is collected.
9.7.2 Steps taken to ensure that the data subject is aware of such collection may include making a
privacy notice available and accessible to data subjects.
9.7.3 A privacy notice of the responsible party should align with the method of communication used
to communicate to the data subject for direct marketing purposes.
Examples of notification to the data subject in accordance with the method of communication:
(i) For in person direct marketing: privacy information may be explained or provided verbally.
(ii) For print/mail communication: information ‘leaflets or infographics’39 can be used to provide
relevant privacy information to data subjects.
(iii) For email communication: a brief message to explain how your personal information will be
used for marketing;
(iv) For electronic communication (viz mobile or SMS): in [telemarketing] where text messages
are limited to 160 characters, the data subject may be provided with a short notice and a
website address or another source where the data subject may access all the essential
information.40
9.7.4 It is key that the responsible party must be open and transparent about its direct marketing
practices when communicating the information, required in section 18(1) to the data subject.
9.7.5 Section 18(1)(h)
‘The responsible party must also take reasonably practical steps to make the data subject is
aware of any further information among others as the existence of the right to object in the
prescribed manner provided for in terms of section 11(3)(a) and the right to lodge a complaint
to the Information Regulator and the contact details of the Information Regulator, which is
necessary, having regard to the specific circumstances in which the information is or is not to
be processed, to enable processing in respect of the data subject to be reasonable’.
39 Stadler E. Over Thinking POPIA , at 332
40 Federation Of European Direct And Interactive Marketing: European Code Of Practice For The Use Of Personal Data In
Direct Marketing Electronic Communications Annex (FEDMA Code) at 6
22 Information Regulator SA
10. General guidance regarding sharing of personal information and
automated decision making
10.1 Lead generation is not defined in POPIA.41 However, it is a direct marketing practice that involves
collecting personal information in terms of section 12(1) and (2). Leads are identified through the
various ways not limited to “sign-up forms, pop-ups, landing pages, and social media posts”.42 These
methods of identifying leads enable the collection of personal information and the generation of lists
of contact details of data subjects. Where the responsible parties share the contact details of data
subjects with other responsible parties and where third parties sell or rent lists in the context of direct
marketing, this is deemed as further processing, and such processing must comply with section 15 of
POPIA. Further, this processing must also comply with section 18 of POPIA.
10.2 Profiling is not defined in POPIA, however the data subject has the right not to be subject, under
certain circumstances, to a decision which is based solely on the basis of the automated processing
of his, her or its personal information intended to provide a profile of such person as provided for in
terms of section 71. 43
10.3 Processing personal information to generate leads may entail collecting and collating large amounts
of information about data subjects necessitating the use of automated processes. Section 71 (1) of
POPIA restricts automated decision making to the extent that:
10.3.1 a data subject is subject to a decision which results in legal consequences for him, her or it,
or the processing affects them to a substantial degree; and
10.3.2 the decision is based solely on the basis of the automated processing of personal
information; and
10.3.3 the processing is intended to provide a profile of such person relating to but not limited to
performance at work, or his, her or its credit worthiness, reliability, location, health, personal
preferences or conduct.
10.3.4 The conditions in 10.3.1 -10.3.3 above must all be present for section 71 (1) to be invoked.
10.4 Compliance with the conditions for lawful processing of personal information while processing
personal information for the purposes of lead generation, profiling, information matching programme
and automated decision-making, is expected of the responsible party. Non-compliance will be deemed
to be in breach of POPIA.
11. Legal effect of the Guidance Note.
The Guidance note is advisory in nature. Accordingly, the Guidance Note shall not be construed to
limit or restrict the Information Regulator’s administration and enforcement of POPIA.
The provisions of POPIA and the Regulations will prevail over the Guidance Note in the event of any
inconsistency. The Guidance note should be read in conjunction with other Guidance Notes issued by
the Information Regulator. This Guidance note does not constitute legal advice.
41 In terms of the Lead Generation - A beginner’s guide, lead generation is the process of triggering interest in the product
or service in order to drive individual leads to buy. Leads can be acquired from a variety of sources.
42 Lead Generation - A beginner’s guide, at 1, https://www.zoho.com/marketinghub/
43 Section 5 of POPIA
Guidance Note on Direct Marketing 23
12. Contact details
12.1 Physical Address
JD House, 27 Stiemens Street, Braamfontein,
Johannesburg,
2001.
12.2 Postal Address
P.O Box 31533, Braamfontein,
Johannesburg,
2017
12.3 Telephone Numbers
Tel: +27 10 023 5200
Toll Free: +27 80 001 7160
12.4 Complaints and enquiries
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
24 Information Regulator SA
13. Reference List:
13.1 Legislation:
1. Protection Of Personal Information Act No 4 of 2013, Department of Justice and Constitutional
Development, South Africa
2. Regulations to the Protection Of Personal Information Act No 4 of 2013 (2018) Government Gazette
No. 42110, Notice NO. R. 1383, Department of Justice and Constitutional Development, South Africa
13.2 International Guidelines:
3. Information Commission Officer (ICO) Direct marketing Data Protection Act Privacy and Electronic
Communications Regulations Direct marketing 2018.03. 06 Version: 2.3 at (referred to herein as ICO
Direct marketing Regulations). (pink)
4. Information Commission Officer (ICO) Direct Marketing Detailed Guidance (referred to herein as ICO
Direct marketing Guidance) 05 December 2022 - 1.0.822 (pink)
5. Information Commission Officer (ICO) Guide to the Privacy and Electronic Communications
Regulations 09 May 2018 - 2.4.962 (referred to herein as ICO PECR). (blue)
6. European Commission-Article 29 Data Protection Working Party 844/14/EN WP 217; Opinion 06/2014
on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC/844/14/
EN WP 217, Adopted on 9 April 2014.
13.3 Books:
7. Brian Thomas FIDM and Matthew Housden MIDM, Direct Marketing in Practice Published in
association with The Institute of Direct Marketing published 20II by Routledge New York, NY 10017,
USA. ISBN-13: 978-0-7506-2428-2 Thomas B. FIDM and Housden M. www.theidm.com .
8. Mullinm Roddy (R), Direct Marketing: A Step-by-Step Guide to Effective Planning and Targeting Series
Editor, Publication date: 2002.
9. Stadler, E; Hattingh, IL; Esselaar, P; Boast, J. Year Published: 2021. Edition. 1st Edition.
Other sources
10. Federation Of European Direct and Interactive Marketing: European Code Of Practice For The Use Of
Personal Data In Direct Marketing Electronic Communications Annex (FEDMA Code).
13.4 Internet sources
9. http://www.associatedcompliance.co.za/AC_Manual_2013/19_Advertising/Advertising%20and%20
Direct%20Marketing%20AC%20Note%20Jun%202013.pdf 11 October 2024.
10. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/
how-do-we-apply-legitimate-interests-in-practice/ accessed 11 October 2024.
11. https://open.lib.umn.edu/principlesmarketing/ accessed 11 October 2024.
Guidance Note on Direct Marketing 25
Trespass Act, 1959
