CDComplianceDesk
← All templatesStart free trial

Privacy and data

Direct Marketing Policy (South Africa)

An internal policy for how your business, its staff and any sales agents contact people for marketing: when consent is needed, what every message must include, how opt-outs are recorded and honoured, and how contact lists are sourced and kept.

Starting point, not legal advice. It is general information and not legal advice. Have it reviewed by a South African attorney before you rely on it. Status: compiled from public sources, not reviewed by a lawyer. Wording last checked 2026-11-01.

1. Fill in your details

2. Download

6 fields still empty. They show highlighted in the document so you can finish them in Word.

Sign up free to download

Already have an account? Log in.

Preview

Direct Marketing Policy

[Business name] (the "business") adopts this policy with effect from [Effective date]. It applies to every employee, director, contractor and sales agent who contacts people for marketing on the business's behalf.

1. Why this policy exists

1.1 The Protection of Personal Information Act 4 of 2013, the Consumer Protection Act 68 of 2008 and the Electronic Communications and Transactions Act 25 of 2002 limit how we may contact people for marketing. We follow them, and we treat a person's choice to stop hearing from us as final.

2. Who is responsible

  1. The Information Officer, [Information Officer] ([Information Officer email]), oversees this policy and answers questions about it.
  2. [Person responsible for marketing campaigns] approves every campaign before it starts and keeps the campaign record.
  3. Agents and contractors who contact people for us are acting for the business. The business is responsible for what they send, so they must follow this policy and are removed from campaigns if they do not.

3. When we may send electronic marketing

  1. We send marketing by email, SMS, WhatsApp or similar only to people who have given consent in the way the law and the Regulator's official form require, or to existing customers where the law allows it. The existing-customer exception applies only if we got their contact details in the course of a sale, we are marketing our own similar products, and they were given a chance to refuse at the time we collected their details and in every message after that.
  2. If a person has not given consent and is not an existing customer, we do not send them marketing. We may ask for consent once, in the way the law allows, and only if the person has not previously refused.
  3. A person who says no, unsubscribes or complains is added to our do-not-contact list and is not contacted again for marketing.
  4. Consent is specific. Consent to receive one thing is not consent to receive everything, and we do not bundle it into terms and conditions.

4. What every message must include

  • Who it is from (the business name) and how to contact us.
  • Why the person is receiving it, where that is not obvious.
  • A simple way to opt out that costs nothing: [How people opt out].
  • Only accurate claims. No false promises, no pressure, and no hiding that it is marketing.

5. Opt-outs

  1. An opt-out is recorded the same day it is received and applied to every list and every sender, including agents, within 2 day(s).
  2. We keep opt-out records permanently, because we need them to avoid contacting the person again. We keep only the details needed to do that.
  3. We do not ask people to give a reason, log in or pay to opt out.

6. Contact lists

  1. We record where each list came from, when, and on what basis we may use it. A list with no record of consent or source is not used for electronic marketing.
  2. We do not use scraped, harvested or unverified purchased lists. A list from another party is used only after the Information Officer approves the source and the consent it relies on.
  3. We keep marketing lists in the business's own systems, with access limited to those who need it. They are not copied to personal accounts or unsecured devices.
  4. People may ask what information we hold about them, correct it, or ask us to delete it. Those requests go to the Information Officer.

7. Records we keep

  • For each campaign: purpose, channel, list source, approver, date and the message sent.
  • For each person contacted on the basis of consent: who, when, how, the wording they agreed to, and the source.
  • For each opt-out: who, when, how and when it was applied.

8. Breaches of this policy

8.1 Anyone who sends marketing contrary to this policy must stop at once and tell the Information Officer. Serious or repeated breaches may lead to discipline for employees and to ending the agreement with a contractor or agent.

9. Review

9.1 The Information Officer reviews this policy every 12 months, and whenever the law, the Regulator's guidance or our marketing methods change.

When to use it

  • You send marketing emails, SMS or WhatsApp messages, or make marketing calls
  • Staff or independent sales agents contact prospects on your behalf
  • You are starting a campaign and want clear rules the whole team can follow

Before you use it

  • This is an internal policy, not the consent form. The Information Regulator publishes the official form for requesting consent to direct marketing (Form 4). Link to or use the current official form, and do not rely on a copy of ours
  • Check the rules for each channel you use. Email, SMS and WhatsApp are electronic communications. Calls and in-person approaches have their own rules
  • Agents who contact people for you are acting for you. Give them this policy and make it part of their agreement
  • Have an attorney review it before a large campaign, especially if you buy or rent lists

Related laws and frameworks

POPIACONSUMER PROTECTION ACTECTA

Sources

Keep this policy current and acknowledged

Store it in ComplianceDesk, track versions and collect staff acknowledgements.

Start free trial