Explainer
POPIA and Email Marketing: Who You May Email (2026)
What section 69 of POPIA allows: consent, the existing-customer rule, the one request you may send, what every email must carry, and what a breach costs.
Which of the people on your list may you email: customers from the till, enquiries from the website, cards collected at an expo, a spreadsheet somebody offered to sell you? POPIAThe Protection of Personal Information Act, South Africa's data protection law. It sets rules for how a business collects, stores and protects personal information about people, and the Information Regulator enforces it.What it means for your email listA customer who bought from you, and was offered an opt-out when you took their email address, may get your newsletter about similar products. An address from a list you bought may not be mailed at all. answers it in one section, section 69, and it is more practical than its reputation.
It does not require everyone to opt in. It requires you to know which of two doors each person came through.
The two groups you may email
First, people who consented. Someone who ticked a box on your website, signed up at the counter or replied yes to a request has given consent, and you may send them marketing email. Keep a record of when and how, because consent is only useful if you can show it.
Second, your own customers. Section 69 lets you market to a customer without separate consent, on three conditions: you got their details while selling them a product or service, you market only your own similar products or services, and they were given a free, simple chance to object when you took their details and are given one again in every email.
The lists a small business usually has, against section 69.
Which lists you may email under POPIA
| May you email it? | On what condition | |
|---|---|---|
| Newsletter sign-ups | Yes | Keep the record of the sign-up |
| Customers who bought | Yes, about similar products | They could opt out at the sale and on every email |
| Enquiries that never bought | Once, to ask for consent | Only if they have not refused before |
| Business cards from an event | Once, to ask for consent | Unless the card came with a clear yes |
| A bought or scraped list | No | None of these people is your customer or consented to you |
From the text of POPIA section 69. General information, not legal advice.
Two groups may be mailed, one may be asked once, and a list you bought fits none of them.
Everyone else: you may ask once
Section 69 allows one approach to a person whose consent you need and who has not refused it before, and that approach may only ask for consent. So a lead who enquired and never bought can get one email asking whether they want to hear from you. If they do not answer, that is not a yes, and a second request is not allowed.
Write that one email as a question, not a campaign. A clear subject, what they would receive and how often, and a button that records their answer. The Act says consent must be requested "in the prescribed manner and form", so if the list matters to your business, have the wording checked against the regulations once and reuse it.
What every marketing email must carry
Section 69 asks two things of every marketing email, whichever group it goes to: who it is from, meaning the business sending it or the one it is sent for, and an address or other contact detail where the reader can ask you to stop. An unsubscribe link does the second job, and every email platform adds one for you.
For customers the opt-out is also a condition of mailing them at all, so an email with a broken unsubscribe link does not only annoy people. It takes away the reason you were allowed to send it.
Making an existing list safe to use
If you already have a list and do not know which door everyone came through, these five steps sort it before your first campaign.
Split the list by where each address came from
Sign-ups, paying customers, enquiries and everything else. Your email platform can hold each as a tag or group.
Mail sign-ups and customers as normal
Customers only about your own similar products, with an unsubscribe link in every email.
Send enquiries one consent request
One email that asks, records the answer, and is never repeated to anyone who did not reply.
Delete what you cannot explain
An address whose origin you do not know, or that came from a bought list, is safer gone than mailed.
Turn on double opt-in for new sign-ups
The person confirms by clicking a link, which gives you a dated record of their consent.
Most email platforms support double opt-in and tags; the ranking below shows what each costs in rands.
What a breach can cost
You will read that a POPIA breach means a R10 million fine. The Act is more specific. A person who receives unwanted marketing can complain to the Information Regulator, which can investigate and issue an enforcement notice telling you what to change. Failing to comply with that notice is an offence, and section 109 lets the Regulator impose an administrative fine for an offence of up to R10 million.
The more immediate cost is your sending account. Email platforms suspend accounts that send to bought lists, because the complaints and bounces damage delivery for their other customers, so the business that buys a list usually loses its platform long before it hears from the Regulator.
The bottom line
POPIA lets a South African business email the people who asked to hear from it and the customers who bought from it, and asks for an honest opt-out every time. That covers most of the list a small business actually has.
If you are choosing where to send from, our ranking of seven email platforms prices each at 1 000 to 5 000 contacts, and the MailerLite vs Mailchimp comparison settles the choice most small businesses face first.
Questions people actually ask
Can I send marketing emails without consent in South Africa?
Only to your existing customers.Section 69 of POPIA allows marketing email to a customer about your own similar products or services if you got their details during a sale and they could opt out then and can opt out in every email. Everyone else needs consent, which you may request once.
Is it legal to buy an email list in South Africa?
You may not email it.The people on a bought list are not your customers and did not consent to hear from you, so section 69 of POPIA does not allow you to send them marketing email.
What must a marketing email contain under POPIA?
Section 69 requires the identity of the sender, or of the business the email is sent for, and an address or other contact detail where the recipient can ask for the emails to stop.What is the fine for breaking POPIA's direct marketing rules?
The Information Regulator can investigate a complaint and issue an enforcement notice.Failing to comply with a notice is an offence, and section 109 allows an administrative fine of up to R10 million for an offence under POPIA.
Does POPIA apply to business email addresses?
Yes.POPIA protects the personal information of juristic persons as well as individuals, and section 69 refers to data subjects of either kind, so a named address at a company is covered.
