POPIA and bulk SMS: the rules for South African businesses in 2026

Updated 19 October 2026 · 7 min read

This guide explains the rules in plain language, based on the laws and regulations listed at the end. It isn't legal advice, so check anything important with a lawyer.

Service messages vs marketing

Most of the rules below are about direct marketing. POPIA defines it as approaching someone to promote or offer goods or services, or to ask for a donation. Messages that serve an existing relationship, like a reminder or an order update, aren't marketing.

If a message mixes service and marketing, treat the whole message as marketing.

When you need consent (POPIA section 69)

Section 69 of POPIA covers direct marketing by electronic communication, and it names SMS. You may send a marketing SMS to someone in only two situations:

1. They gave consent. Consent must be voluntary, specific and informed. A box they tick themselves counts. A pre-ticked box, or silence, doesn't.
2. They're an existing customer. You got their number when they bought something from you, you're marketing your own similar products or services, and you gave them a chance to opt out when you collected the number and in every message since.

You may ask someone who isn't a customer for consent once. The POPIA regulations prescribe a form for that request (Form 4). Whatever their answer, you may not ask again.

What every marketing SMS must include

POPIA requires every direct marketing message to include who it's from, or on whose behalf it's sent, and a way for the recipient to ask you to stop. On SMS, that means starting with your business name and ending with something like Reply STOP to opt out. When someone opts out, stop marketing to them straight away.

The 2026 Consumer Protection Act regulations add that people must be able to identify your business name, electronic address, physical address and contact number. Fitting all four into one SMS leaves little room for your offer, so one practical approach is to put your name and a number or website in the SMS and keep your full details on that website. Check with a legal adviser that this works for your business.

When you may send marketing SMS

The Consumer Protection Act regulations set the days and times when direct marketing may reach consumers:

The limits fall away only if the consumer agreed to other times. A message counts as on time if you sent it within the allowed hours, even if it arrives later, but you must be able to prove when you sent it, so keep your send reports.

The NCC opt-out registry (new in 2026)

Amendments to the Consumer Protection Act regulations took effect on 15 April 2026. They set up a national opt-out registry, run by the National Consumer Commission (NCC), where consumers can block direct marketing. For anyone who markets by SMS, that means:

• Register as a direct marketer. Registration opened on 15 September 2026 and runs until December 2026. The fee is R2,574, then R1,930.50 a year to renew.
• Clean your list every month. Before a campaign, check your list against the registry and remove anyone who blocked marketing. The cleaning fee is R0.12 for each record that has to be removed, and cleaning is free from December 2026 to April 2027.
• Consumer blocks start in May 2027. From then, people can register a block, and you may not market to them.
• Fines are serious. Breaking the rules can lead to administrative fines of up to R1 million or 10% of annual turnover, whichever is greater.

The NCC hadn't confirmed every date when we wrote this, so check its announcements before you rely on them.

How to collect opt-in consent

• At the till: a slip or tablet form with the person's name, number and a box they tick themselves.
• On your website: a form with an unticked checkbox and a clear sentence about what you'll send.
• On order or membership forms: a separate tick box for SMS marketing, apart from the terms and conditions.
• By SMS: if someone texts you first asking to join, keep that message as your record.

Keep a record of each consent: who agreed, when, how, and what they agreed to receive.

Handling STOP replies

When someone replies STOP, or asks you to stop in any other way, take them off your marketing lists straight away and keep them off. In your Bulk SMS Direct portal, STOP replies go on an opt-out list that you use to keep those numbers out of marketing sends.

An opt-out from marketing covers marketing. Service messages, like appointment reminders, can carry on, so keep your reminder list and your marketing list separate.

Penalties

POPIA is enforced by the Information Regulator, which can impose administrative fines of up to R10 million. The Consumer Protection Act is enforced by the National Consumer Commission, and the National Consumer Tribunal can impose fines of up to R1 million or 10% of annual turnover, whichever is greater.

Checklist

• Separate service messages from marketing messages.
• Get consent before marketing to anyone who isn't an existing customer.
• Start every marketing SMS with your business name.
• End every marketing SMS with Reply STOP to opt out.
• Send marketing on weekdays from 08:00 to 20:00 and Saturdays from 09:00 to 13:00, unless people agreed to other times.
• Register on the NCC opt-out registry by December 2026 if you do direct marketing.
• Clean your marketing list against the registry every month.
• Keep records of consent and of when you sent each campaign.

Questions

Sources

• POPIA section 69: direct marketing by electronic communication
• CPA regulations: prohibited times for contacting consumers
• National Consumer Commission: opt-out registry launch
• ENSafrica: the 2026 CPA amendment regulations
• Bowmans: the NCC opt-out registry
• Michalsons: registry fees and timeline
• Information Regulator