On 15 April 2026, the Minister of Trade, Industry and Competition, Mpho Parks Tau, published the Consumer Protection Act Amendment Regulations, 2026 (Amendment Regulations), available here.
The Amendment Regulations provide for the operation of an opt-out registry in terms of section 11(6) of the Consumer Protection Act 68 of 2008 (CPA).
The Amendment Regulations came into effect immediately and are intended to curb unwanted direct marketing communications by allowing any person to register a pre-emptive block against any unwanted electronic communication that is primarily for the purpose of direct marketing (Unwanted Direct Marketing).
Simultaneously, the opt-out registry was established by the National Consumer Commission ( NCC) in terms of section 11(3) of the CPA and appears to be fully operational, accessible here (Opt-Out Registry).
Legislative amendments
The Amendment Regulations introduce two major changes to the Consumer Protection Act Regulations, 2011:
- A set of new and revised definitions
-
Provisions to establish the mechanism for the implementation of a consumer’s right to restrict Unwanted Direct Marketing under the CPA, including relating to the operation of the Opt-Out Registry.
Some of notable changes include:
- A new definition for ‘direct marketer’, being any person who engages in direct marketing;
- A new definition of ‘electronic communication recipient’, being a consumer who receives electronic communications from a direct marketer and who has registered a pre‑emptive block;
- A new definition for ‘cleansing’, which refers to the process by which a direct marketer removes from its database all consumers who have opted out of receiving electronic communications, thereby ensuring that such consumers are no longer contacted; and
-
A new definition for ‘pre‑emptive block’ as the registration of a block on the Opt‑Out Registry to prevent the receipt of unwanted electronic communications from direct marketers.
Notably, the amendments specifically refer to the registration of the pre-emptive block via the Opt-Out Registry as being applicable only to unwanted electronic communication. Electronic communication is broadly defined under the CPA and includes a wide range of communication by means of electronic transmission, including by telephone, fax, SMS, wireless computer access, email, or any similar technology of device.
Consequently, direct marketing by means other than electronic communications would not be subject to the pre-emptive block rights granted under the CPA.
Following these amendments, a consumer may now register with the NCC via the Opt-Out Registry site. They will then be placed on the Opt-Out Registry and have a pre-emptive block on Unwanted Direct Marketing communication.
The consumer must ensure that any information provided to the NCC is accurate and kept up to date. The Opt-Out Registry kept by the NCC must, at all times, except in the case of unforeseen technical interruptions, be accessible to all persons in South Africa to register a pre-emptive block.
A direct marketer must register as a direct marketer with the NCC via the Opt-Out Registry site, by paying the prescribed registration fee starting at ZAR 2 574 for 2026 and must renew its registration annually by paying the prescribed renewal fee starting at ZAR 1 930.50 for 2026. New tariffs relating to the filing fees structure for registration with the NCC and annual renewal fees will be published on a three-year cycle.
As part of its ongoing obligations, a direct marketer must:
- Not directly market any goods or services to any consumer who has registered a relevant pre-emptive block;
- Remove, from its database, all data of persons who have registered a relevant pre-emptive block by cleansing such database monthly on the Opt-Out Registry;
- Not contact any consumer for the purpose of direct marketing and promoting any goods and services unless such direct marketer has been registered as a direct marketer on the Opt-Out registry;
- Ensure that a consumer is able to identify its name, electronic address, physical address and contact number;
- Ensure that the information maintained on the Opt-Out Registry is up to date and is identifiable, even on public platforms;
- Not disseminate any electronic communication from a public platform where the originator of the electronic communication is unidentifiable; and
-
Ensure that any form of electronic communication transmitted to a consumer’s device is identifiable by the consumer.
Amendment Regulations and section 69 of POPIA
As section 69 of POPIA also regulates direct marketing by means of electronic communications, the Amendment Regulations will need to be considered against the background and requirements of POPIA.
Section 69(2) of POPIA provides that in circumstances of unsolicited electronic communications, a responsible party (defined in POPIA as a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information) may approach a data subject only once in order to request the consent of that data subject where:
- The data subject’s consent is required for the processing of their personal information for the purpose of direct marketing by means of electronic communication; and
- The data subject has not previously withheld such consent. This requirement does not apply to a data subject who is a customer of the responsible party and who meets the conditions of section 69(3), including that:
- The responsible party has obtained the contact details of the data subject in the context of the sale of a product or service;
- For the purpose of direct marketing of the responsible party’s own similar products or services; and
-
If the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of their electronic details at the time when the information was collected and on the occasion of each communication with the data subject for the purpose of marketing, if the data subject has not initially refused such use.
In other words, a direct marketer, who intends to directly market by means of electronic communication, may not process the personal information of a data subject for the purpose of direct marketing where such data subject (i) has withheld its consent or (ii) has objected to such processing.
While, at this stage, it is unclear whether a consumer’s registration to the Opt-Out Registry may be considered as a data subject withholding its consent in terms of section 69(2)(ii) of POPIA, it is clear that the Amendment Regulations and POPIA, as they relate direct marketing by electronic communication, must be read together and that direct marketers, where applicable, must ensure compliance with the requirements under section 69 of POPIA as well as refrain from directly marketing any goods or services to any consumer who has registered a relevant pre-emptive block with the NCC in terms of the Amendment Regulations.
The implications
With the Opt-Out Registry being fully operational, direct marketers must take steps now to register to ensure that they are fully compliant with the provisions of the Amendment Regulations. Any failure by a direct marketer to register with the NCC will prevent a direct marketer from contacting any consumer for the purpose of direct marketing and/ or promoting any goods and services by way of electronic communication.
Direct marketers should also take proactive steps to maintain an up-to-date internal direct marketing database, to ensure that all data of persons who have registered a relevant pre-emptive block are removed from such database and further that such data is cleansed monthly with the NCC.
Kate Beretta, partner; and John Paul Ongeso and Savanna Stephens, senior associates, Bowmans.
