Authored by Rosalind Lake.

South Africa’s direct marketing landscape changed significantly in April 2026 when the Consumer Protection Act Amendment Regulations (the Regulations) came into effect. The most important development is that the National Consumer Commission (NCC) will be running an opt-out registry that requires payment, and registration by direct marketers and allows consumers to block unwanted marketing communications before they even arrive

For businesses engaged in direct marketing, this means complying with new registration requirements with the NCC and ongoing payment and compliance obligations. Here’s what you need to know.

  1. Does this apply to your business?

The short answer: it depends on who you’re directly marketing to.

The CPA’s direct marketing rules apply when you’re directly marketing goods or services to individual consumers or to small juristic businesses with annual turnover or assets below R2 million. If you’re marketing exclusively to large corporates exceeding this threshold, you may fall outside the CPA’s scope – though you’ll still need to comply with POPIA and other industry-specific laws.

Financial services regulated under sector-specific legislation (such as the Financial Sector Regulation Act and FAIS) are excluded from the CPA’s scope.

  1. What is a pre-emptive block 

It is prohibited under the CPA to contact any consumer who has opted out of receiving direct marketing. However, that preference is usually only expressed after you have already been in touch with that consumer. A pre-emptive block changes this dynamic by allowing consumers to register their preference before any marketing contact occurs.

The opt-out registry will be operated through the NCC’s eServices platform. Registration is expected to open in July 2026, with the system anticipated to be fully operational by September 2026. The registry will allow consumers to register a block to prevent any unwanted electronic communication from direct marketers.

To register a pre-emptive block, consumers must complete a form on the NCC’s eServices platform which requires personal details including identity or passport number, full names, physical address, and contact information. Consumers must provide accurate information and ensure their details on the opt-out registry remain up to date. 

Once a consumer has registered a pre-emptive block, direct marketers are prohibited from directly marketing any goods or services to that consumer. The Regulations impose strict obligations on direct marketers: they must remove from their databases all data of persons who have registered a pre-emptive block by cleansing such data monthly with the NCC for a fee, and they may not contact any consumer for direct marketing purposes unless registered as a direct marketer on the opt-out registry.

  1. What you’ll need to do

If the Regulations apply to your business, here are your key obligations. Note that while the Regulations are already in force (from 15 April 2026), certain obligations can only be performed once the NCC’s eServices platform becomes operational:

  • Register with the NCC before conducting any direct marketing to consumers. Registration opens in July 2026 via the NCC eServices portal, with an initial fee of R2,574. The fee structure is prescribed in the Regulations. Note: While this obligation exists now, registration can only be completed once the portal opens in July 2026.
  • Renew your registration annually (R1,930.50 per year)
  • Check your databases monthly against the opt-out registry to remove consumers who have registered a pre-emptive block. You have to pay 12 cents per record. Information on how to use the opt-out registry will be available on the NCC website. Note: This obligation applies once the registry is operational (expected September 2026).
  • Clearly identify yourself in all marketing communications, including your name, physical address, electronic address and contact number. This obligation is already in force.
  • Never contact consumers who have registered a pre-emptive block. This prohibition will apply once consumers are able to register on the opt-out registry (expected from July 2026).

  1. Don’t forget about POPIA, etc

    The CPA isn’t the only legislation governing direct marketing. POPIA applies more broadly and takes an opt-in approach for anyone other than existing customers, meaning you need express consent in the prescribed format before sending electronic marketing to potential new customers. Even if your business falls outside the CPA’s scope, POPIA still applies.

Other legislation such as the insurance industry’s policyholder protection rules may apply.

  1. The consequences of non-compliance

    Beyond formal penalties (including potential fines and imprisonment of up to 12 months for non-compliance with NCC compliance notices), businesses face significant reputational risks. 

    Consumer complaints about unsolicited marketing have increased significantly. In an era of active social media commentary, the reputational damage from poor marketing practices can far outweigh regulatory penalties.

  2. Start preparing now 

    With registration opening in July 2026 and the system expected to be fully operational by September 2026, now is the time to act. Here are the steps you should take:

    1. Audit your current marketing practices to determine whether the CPA, POPIA, or both apply to your activities.
    2. Monitor NCC communications and register on the platform. You will need to identify a relevant contact person.
    3. Develop systems to cleanse your databases monthly against the opt-out registry.
    4. Review your marketing templates and communications on all platforms to ensure you clearly identify your business.
    5. Review your direct marketing consent and opt out management processes to accommodate the pre-emptive block database cleansing requirements.  
    6. Train your marketing and sales teams on the new requirements.

    The Regulations represent a significant shift in how businesses can approach direct marketing in South Africa. Early preparation will help you avoid enforcement action and protect your reputation. A comprehensive direct marketing policy and implantation plan is recommended. 

    If you need assistance reviewing your direct marketing practices or preparing for registration, please contact the Deneys Cybersecurity, Data Privacy and AI team.