South Africa’s Opt-Out Registry: This Is An IT Project, Not Just A Legal One

South Africa’s National Consumer Commission Opt-Out Registry will change how organisations manage direct marketing. For businesses, the key point is simple: compliance cannot be achieved by only updating a privacy policy or marketing terms. It requires changes to technology, data and operational processes.

The Registry does not replace POPIA

An important point is that the Registry and POPIA operate alongside each other. POPIA regulates when personal information may be processed for electronic direct marketing, including the circumstances in which consent is required and the limited ability to approach certain existing customers. The CPA regime adds another layer: a consumer may exercise a pre-emptive block against direct marketing through the Registry. This means an organisation should not assume that because it has a valid POPIA basis for sending a marketing communication, it is necessarily free to send it.

In practical terms, organisations should treat these as two pronged test:

1. POPIA: are we legally permitted to use this person’s personal information for this direct-marketing communication? and
2. CPA/Registry: has the consumer exercised a pre-emptive block that prevents us from marketing to them?

If either response produces a “no”, the marketing activity should not proceed.

What should organisations be doing now?

• Map your marketing data: Identify everywhere marketing contact information sits — CRM systems, marketing platforms, call centres, apps, loyalty programmes, WhatsApp environments, spreadsheets and third-party databases. You cannot reliably suppress marketing if you do not know where the data is.
• Build a central suppression process: Registry information needs to work alongside POPIA consent records, unsubscribe requests, channel preferences and existing do-not-contact lists. The objective should be simple: once someone should not receive direct marketing, that instruction must flow across every relevant system and channel.
• Automate cleansing where possible: For organisations with significant marketing volumes, Registry cleansing should not depend on someone manually comparing spreadsheets. Build cleansing into the marketing-data process and retain evidence that it occurred.
• Put a gate before every campaign before marketing is released, the organisation should effectively run both tests: “Does POPIA permit this communication?” and “Is this person clear of an applicable CPA pre-emptive block?” This is particularly important where multiple business units, platforms or external agencies conduct marketing (see also our previous article in relation to unique identifiers under POPIA).
• Deal with third parties: Lead generators, call centres, marketing agencies and database providers need to be brought into the compliance framework. Contracts should address cleansing, suppression, audit rights, evidence and responsibility for non-compliance.
• Contracting third parties: where the organisation seeks to appoint a third party to assist with any services related to meeting the regulatory imperative, ensure that a proper contract is concluded between the organisations and third party, including in the event of future system errors etc that could lead to regulatory sanction
• Assign ownership and test: Legal, Privacy, Marketing, IT, Data and Compliance may all have roles, but someone must own implementation. Then test the process. Can a blocked consumer still receive marketing through another channel, legacy database, subsidiary or external agency?
• Don’t wait for the first complaint: The organisations best prepared for the Registry will not necessarily have the longest direct-marketing policies. They will be the organisations whose systems actually prevent prohibited marketing from being sent.

The time to prepare is now. Organisations conducting direct marketing should establish an Opt-Out Registry Readiness Project bringing Legal, Privacy, Marketing, IT and Data together. Start with three things: map the marketing data, integrate the POPIA and CPA compliance gates, and implement an effective pre-campaign suppression process.

The legal requirements may be fairly straightforward. Making them work together across the organisation is the real challenge.