Is cold email legal in South Africa?

What POPIA section 69 actually says

Section 69(1) of the Protection of Personal Information Act prohibits processing someone’s personal information for direct marketing by any form of electronic communication, including email and SMS, unless that person has given consent or is already your customer.

Section 69(2) adds the part that surprises people: you may approach someone whose consent you need only once, and only to request that consent, in the prescribed manner and form. The Regulator’s Guidance Note on Direct Marketing spells it out: your first message to a non-customer must be a request for consent, using Form 4 or an electronic version of it.

So the classic cold email, a pitch plus “worth a quick chat?”, sent to someone who has never heard of you, is exactly what the section is written to stop.

It’s not just email: calls and LinkedIn count too

The Regulator’s guidance lists the methods it considers electronic communication for direct marketing. The list isn’t limited to email:

• Telephone calls (the Regulator’s view is that calls are now digital, so they count)
• SMS
• Email
• Direct messages on Instagram or LinkedIn
• Automatic calling machines and push notifications

That closes the loophole a lot of people relied on: “we don’t email, we just phone” and “it’s only a LinkedIn message.” Neither gets you around section 69, on the Regulator’s reading.

Existing customers, and the B2B question

Section 69(3) allows marketing to existing customers, with conditions: you got their details in the context of selling them something, you’re marketing your own similar products or services, and they had a reasonable, free chance to opt out when you collected the details and in every message since.

And B2B? Some lawyers argue that section 69 was modelled on European rules that only protect individuals, so emails to companies have more room. Others point out that POPIA protects juristic persons, meaning companies, as data subjects too. Until a court or the Regulator settles it, the safe assumption is that section 69 applies to your B2B emails as well. If you want to rely on the narrower reading, get a lawyer’s opinion in writing first.

Every direct marketing message, whatever the basis, must say who it’s from and give an address or contact details where the person can ask you to stop (section 69(4)).

Buying a list doesn’t buy you consent

The guidance also covers lead generation: when lists of contact details are shared, sold or rented for direct marketing, that’s further processing, and it has to comply with POPIA’s other sections too. A purchased database of “10,000 verified South African decision-makers” comes with the same section 69 problem, plus a few new ones.

The Regulator has issued enforcement notices over direct marketing complaints, and it publishes them on its website. This isn’t a theoretical risk.

Cold email to the US works differently

Most of the cold email I run goes to buyers in the US and Canada, and the US rules are built differently. Under CAN-SPAM, commercial email doesn’t need prior consent, but it must not mislead, must include a valid postal address and must offer a clear way to opt out, honoured within 10 business days. The FTC’s compliance guide notes the law makes no exception for business-to-business email.

That’s one reason South African firms selling abroad do well with outbound: the time zone works in your favour, and the rules allow it when done properly. For the MedSpa DR campaign, for example, the emails went to med spa owners in Texas, Arizona and California. If your buyers are overseas, outbound lead generation is still very much on the table.

What I’d do this week

If your buyers are in South Africa, stop treating cold email as your main channel. Put the effort where buyers come to you: SEO and your Google Business Profile, referrals, events and a website that turns visits into inquiries. Someone searching for what you sell has already invited you in.

If you do want to approach local prospects electronically, send one short, honest consent request in the prescribed form, keep a record of the answer, and never approach someone who has already said no. Then get your legal adviser to check the wording.

If your buyers are in the US or Canada, outbound can work well from here (how to get clients in the USA from South Africa). I set it up from separate, authenticated sending domains, with every reply answered fast. My Cape Town lead generation page covers how I split the two markets.