NCC Opt-Out Registry Guidelines draft: what direct marketers should take from them

On 2 October 2026 the National Consumer Commission published draft Guidelines for Compliance with Opt-Out Registry Regulations, with 15 days for comment. They are useful on one question, when a call is not direct marketing at all, and unreliable on several others. They quote a statutory prohibition that has not been brought into force, state the cleansing fee on a different basis from the Regulations, and take a consent position the Regulations do not clearly support. Use them as evidence of how the Commission intends to enforce, not as a statement of the law.

The decision in brief

The issue. The Guidelines explain how the Commission reads section 11 of the Consumer Protection Act and the Consumer Protection Act Amendment Regulations, 2026. They are a draft, issued as a non-binding opinion. Several statements in them do not match the Act or the Regulations they explain.

Why it matters. Compliance teams will build controls from this document, and the Commission is likely to rely on it in enforcement. Where it departs from the Regulations, a marketer that follows it may still be in breach, or may pay for controls the law does not require. Depending on the block rate, the fee basis alone can change the cost of monthly cleansing by an order of magnitude.

Decision or next step. Build controls from the Regulations, and use the Guidelines to understand enforcement intent. Adopt their reading on ordinary business calls and on suppression rather than deletion. Do not adopt their statements on the fee, the consent position, or the status of section 11(4)(b)(ii) without checking them against the primary text. Comments close on 17 October 2026, which is a Saturday, so submit by Friday 16 October.

Who this is for

Legal · Privacy and Data Protection · Risk and Compliance

What each takes from it: Legal, where the Guidelines depart from the Act and the Regulations, and what to say in a comment. Privacy and Data Protection, how the registry regime sits beside POPIA and what the Commission does with submitted databases. Risk and Compliance, what cleansing actually costs, and which exposures are settled and which rest on contested readings.

What the Guidelines actually say

The mechanics track regulation 4(7) closely, and the purpose test is genuinely useful.

Authority indicates. The Commission issued the Guidelines under section 96(b)(i) of the CPA. On its draft, a direct marketer must register on the Opt-Out Registry before conducting direct marketing and renew annually (paras 6.1 to 6.3). Each month in which it intends to market, it submits the list of consumers it intends to contact, pays the cleansing fee, and receives back those who have registered a block against it (paras 7.1 to 7.3). It removes them from its marketing lists and identifies itself in every direct marketing communication (paras 7.3, 11.1 and 11.2). Consumers may register general, specific or sector-specific blocks, and marketers must apply each exactly as scoped (paras 8 to 10).

The Guidelines present the regime as cross-sector and apply it across electronic channels, including call centres, agencies and robocalls, and a principal stays responsible when a third party markets for it (para 5, FAQ 14). Political campaigning for votes is ordinarily outside, but soliciting donations may not be (FAQ 16). A non-profit is not excluded by its status (FAQs 17 to 19).

The most useful part is the purpose test. Section 11(1) reaches communications primarily for the purpose of direct marketing, and the Commission treats ordinary business engagements as outside the registry regime even where the consumer has a block: enquiries, existing orders and accounts, delivery and appointments, support, complaints, returns, warranties and performance of an existing contract (paras 14 and 15, FAQs 2 to 4). A sales pitch added to such a call is direct marketing for that part (para 16.1, FAQ 5).

ITLawCo analysis. That gives call centres a workable line: classify each call by its purpose, and script the point where service ends and selling begins. It is a CPA test only. POPIA defines direct marketing by direct or indirect purpose, and section 69 has no “primarily” qualifier, so a service call carrying an upsell may be outside the registry regime and still be direct marketing under POPIA for the upsell. The same applies on messaging platforms, which paragraph 3.5 names expressly.

The Guidelines also read regulation 4(7)(i) sensibly. The regulation says to remove “all data” of blocked persons from the database. The Guidelines treat that as removal from marketing lists (para 7.3), which is the only workable reading: deletion would destroy customer records and the suppression record needed to honour the block. Suppress, do not delete.

Where the Guidelines depart from the law

The Commission’s approach has a coherent rationale, but on several points it states as settled what the Act and Regulations do not support.

The Commission’s case is strongest when put this way. A registry only works if a block means what it says. Consumers should not have to police which marketers hold old consents, and marketers should not be able to manufacture fresh ones to defeat a block. One clear prohibition, a simple monthly cycle and a fee that falls on the marketers whose lists hit blocks are easy to administer and easy to explain. On that view, precision about commencement and consent is secondary to making the system work.

ITLawCo analysis. The objective is right. The difficulty is that the Guidelines tell readers the law is clearer than it is, on points where a marketer that follows them may be exposed, or may plan on the wrong numbers.

Law requires. Section 11(4)(b)(ii) of the CPA prohibits directing direct marketing to a person who has registered a relevant pre-emptive block. Schedule 2 item 4 keeps it inoperative until the Minister declares a date by notice in the Gazette, after the Commission has established the registry and, for a registry the Commission established itself, the Minister has received an independent auditor’s advice on its capacity. Regulation 4(7)(h), in force since 15 April 2026, separately prohibits direct marketing to a consumer who has registered a relevant block.

ITLawCo analysis · Open question. We have identified no notice under Schedule 2 item 4 as at 2 October 2026, yet the Guidelines quote section 11(4) as operative and do not mention item 4. The statutory prohibition is uncommenced; the regulatory prohibition is operative. Whether section 11(6) supports a regulation imposing the duty Parliament deferred is a real question of interpretation and validity. The question could arise on a referral of the alleged prohibited conduct to the Tribunal under section 73, or in proceedings on a compliance notice. Honour blocks in the meantime.

Authority indicates. Historical consent becomes invalid once a consumer registers a block, and fresh consent does not override a block unless the consumer removes it (paras 12.2 and 12.3, FAQ 11).

ITLawCo analysis. Three corrections follow. Nothing in section 11 makes consent invalid; the defensible proposition is that consent cannot be relied on to market contrary to an effective relevant block. The trigger is effectiveness, which regulation 4(3)(d) sets at 30 days after registration. And regulation 4(3)(g), which survives the 2026 amendments, still relieves a marketer from presuming a block for existing clients who expressly consented. The better reading confines it to the presumption where block status is unknown, leaving regulation 4(7)(h) to govern a block actually registered. A block should also bar the once-only approach under section 69(2) of POPIA to request consent, which is the practical core of paragraph 12.3. None of this removes the need to capture and record consent properly for POPIA.

The remaining departures are set out below. The fee basis is the costliest.

ITLawCo analysis. On a database of 100,000 numbers with 5% blocked, the Guidelines’ basis gives a monthly cleanse of R600. Annexure N gives R12,000, or R144,000 a year before the annual increases.

What applies whatever the final text says

The Regulations govern, including their defects, and POPIA runs alongside on every reading.

Several problems originate in the Regulations and the prescribed forms. Some can be mitigated in implementation, because the forms need only correspond substantially to Annexures O and P; defects in the legal text itself need regulatory amendment. The consumer block form in Annexure O has no field for the scope of a block, so the general, specific and sector blocks in paragraphs 8 to 10 have no prescribed mechanism. It asks for gender, marital status, citizenship and maiden name, which matching a block does not need, and it cannot be completed by a juristic person. The marketer form in Annexure P asks for a company registration number, VAT number, B-BBEE certificate and tax clearance, which a sole proprietor, non-profit trust, political party or foreign marketer cannot supply as designed. Regulation 4(7)(j) still bars every unregistered marketer from direct marketing.

Law requires. Regulation 4(7)(c) requires a marketer to ensure that an “electronic communication recipient” can identify it, and regulation 1(2) defines that term as a consumer who has registered a pre-emptive block. Regulation 4(2) still says a “no adverts” sign satisfies regulation 4(1)(b), which the 2026 amendments rewrote to mean registering a block.

ITLawCo analysis. Read literally, the identification duty is owed only to people who should not be contacted; paragraph 11.2 sensibly extends it to every communication, and POPIA section 69(4) imposes its own duty anyway. The postal mechanism is therefore internally incoherent. Section 11(1)(c) covers any approach other than in person, which reaches post. The 2026 amendments define a pre-emptive block as a block against unwanted electronic communication, yet Annexure O still collects a physical address. The Guidelines’ definition of direct marketing omits post altogether.

For a marketer, the two regimes are cumulative. Registration and cleansing do not establish a POPIA justification or satisfy section 69, and a POPIA consent or the section 69(3) customer route does not bypass an effective block. Live calls show the gap most clearly: the CPA’s definition of electronic communication names telephone, so a block reaches them, while whether section 69 does is contested, as we set out in our Field Note on section 69 and telephone marketing. The Information Regulator’s position, in its April statement, is that opting out is not consent and that POPIA protects consumers without a block. At its 31 August 2026 briefing it announced the referral of two direct marketing matters to its Enforcement Committee.

ITLawCo analysis · Open question. The largest POPIA question is the Commission’s own processing. On the Guidelines’ proposed cleansing model, a marketer submits to the Commission each month the prospect list it intends to use. Regulation 4(10) limits use to operating the registry and restricts disclosure, and regulation 4(3)(f) limits the output to whether a block exists. The Guidelines do not say how long submitted lists are kept, whether output is a yes or no flag per entry, what security protects a national store of prospect lists, or what regulation 4(10)(c) verification discloses to other organs of state. A marketer’s own POPIA assessment needs those answers.

The decision frame

ITLawCo recommends. Start with the fee basis, because it is the figure most often assumed and least often checked. Budget cleansing on every entry submitted, at the Annexure N rate for the year, not on the entries found to be blocked. Then decide how often you need to cleanse, because each cleanse is charged on the whole list.

Where this stops being generic

The general position above holds where a marketer promotes its own goods or services to individual consumers, on lists it controls.

Organisation-specific analysis becomes necessary where any of the following is true.

• The campaign is business-to-business. Section 5(1)(b) applies the CPA to promotion unless the goods or services could not reasonably be the subject of a transaction to which it applies, and section 5(2)(b) excludes qualifying transactions, so the promotion, the offering and any resulting transaction are classified separately.
• The marketer cannot complete Annexure P as designed: a sole proprietor, non-profit, political party or foreign entity.
• The marketer is a financial services provider or insurer, where any CPA exclusion turns on whether the specific activity is regulated under financial sector law.
• Calls are made by an outsourced provider, where the principal keeps its registry obligations and its position as responsible party.
• The organisation relies on existing-client consent under regulation 4(3)(g), where the Guidelines and the Regulations do not line up.
• Service, retention or collections calls carry a sales component, where the CPA purpose test and POPIA’s definition diverge.
• A complaint has already been lodged with the Commission.

Registration, a monthly cleanse and a suppression list get you part of the way. They do not establish that a campaign is in scope or out of it, that a call is an ordinary business engagement, or that a consent may be relied on. Those turn on classification and evidence, which belong in a data protection programme that can be tested rather than in the registry account.

Sources relied on

1. National Consumer Commission, draft Guidelines for Compliance with Opt-Out Registry Regulations, GN 7981, GG 55465, 2 October 2026, paras 2 to 19 and Annexures A to C. Draft, for comment.
2. Consumer Protection Act 68 of 2008, s 1 definitions of “direct marketing” and “electronic communication”; ss 5(1)(b), 5(2)(b), 11(1) to (6), 73, 96(b)(i), 100, 110(2), 112 and 120(1)(a); Schedule 2 item 4.
3. Consumer Protection Act Amendment Regulations, 2026, GN R7380, GG 54521, 15 April 2026, including Annexures N, O and P.
4. Consumer Protection Act Regulations, 2011, as amended, reg 1(2) and reg 4(1), (2), (3)(d) to (h), (7), (10) and (11).
5. Protection of Personal Information Act 4 of 2013, ss 10 and 69(2) to (4).
6. Information Regulator, media statement on the Consumer Protection Act Amendment Regulations, 21 April 2026.
7. E van Eeden and J Barnard, Consumer Protection Law in South Africa, 2nd ed, LexisNexis, 2017, ch 7, ch 13 and ch 17 (S Papadopoulos). Law stated as at 31 August 2017.