The Information Regulator says telephone marketing is electronic communication under POPIA. The Law Reform Commission that drafted the Bill said live person-to-person calls fall under the ordinary Chapter 3 rules instead. Parliament then opened the Commission’s closed list of channels and tightened its stored-message definition in the same amendment. No reason for the change appears in the committee minutes. Two referrals to the Enforcement Committee put the question in issue.
The decision in brief
The issue. Section 69 of POPIA bars direct marketing by unsolicited electronic communication without consent, and turns on whether a live telephone call is an electronic communication as defined. No reported South African judgment decides it. The Regulator says it is, reasoning from VoIP packet storage. The drafting history is two-sided. The Law Reform Commission’s draft Bill used a closed list of four channels and said expressly that live person-to-person voice marketing calls fall under the ordinary Chapter 3 rules. Parliament then replaced that closed list with “any form of electronic communication”, while carrying across the Commission’s stored-message definition and tightening it. Two matters, MTN and OUTsurance, are before the Enforcement Committee.
Why it matters. The answer does not decide whether you may call. It decides which POPIA pathway you are on, and the pathways carry different conditions, different objection rights, and different evidence. If section 69 applies, outbound calling to non-customers has required consent since the compliance deadline of 1 July 2021, and the existing-customer exemption is narrower than most organisations assume. If it does not, the calling falls back into the ordinary Chapter 3 regime, where a lawful justification is still needed and the data subject has an absolute right to object under section 11(3)(b). The Consumer Protection Act registry regime sits alongside both, where the CPA itself applies.
Decision or next step. Establish which of the three pathways your outbound calling is actually on, and whether you can evidence it. Consent under section 69. The existing-customer exemption under section 69(3), which is narrower than it is usually treated as being. Or Chapter 3 justification with a working objection mechanism. Most calling programmes have never been mapped against any of them. Waiting for the interpretation to settle is itself a decision, and it is the one that accrues exposure if the Regulator’s reading prevails.
Who this is for
Legal · Privacy and Data Protection · Risk and Compliance
What each takes from it: Legal, the interpretive question and which reading is defensible. Privacy and Data Protection, whether the consent record for outbound calling exists and what it would have to show. Risk and Compliance, the exposure on each reading and whether the current programme survives the worse one.
What section 69 actually says
The dispute is not about section 69. It is about eleven words in section 1.
Law requires. Section 69(1) prohibits processing personal information for direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail, unless the data subject has consented or is a customer within section 69(3). Section 69(5) defines an automatic calling machine as one able to do automated calls without human intervention.
ITLawCo analysis. An agent dialling a number is therefore not operating an automatic calling machine. That conclusion is ours, not the statute’s, and it does not dispose of predictive, progressive or preview diallers. The statutory test is whether the machine is able to call without human intervention, not whether a human eventually speaks.
Law requires. Section 1 defines electronic communication as “any text, voice, sound or image message sent over an electronic communications network which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient”.
Law requires. Section 69(3) is narrower than it is usually treated as being. A responsible party may process a customer’s personal information for direct marketing only if all of the following hold: the responsible party obtained the contact details in the context of a sale of a product or service; the marketing is of that responsible party’s own similar products or services; and the data subject was given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, both at the time the information was collected and on the occasion of each subsequent marketing communication, unless the data subject initially refused.
Law requires. Section 69(4) requires that any communication for the purpose of direct marketing contain the identity of the sender or the person on whose behalf it is sent, and an address or other contact details to which a request to cease may be sent. The obligation is independent of consent.
ITLawCo analysis. Whether section 69(4) reaches marketing that falls outside section 69 is contested, and an earlier version of this note wrongly presented it as settled. The subsection says “any communication for the purpose of direct marketing”, which reads wider than the section it sits in. But that section is scoped to unsolicited electronic communications, and on the narrower reading of section 1 a live call is not one of those. We think the wider reading is the better one. It is not established.
ITLawCo analysis. The word own is why the group-company problem exists. A customer of one entity is not a customer of another, and the second entity’s product is not the first entity’s own product. Organisations relying on section 69(3) across a group are usually relying on something the subsection does not provide.
ITLawCo analysis. Two things in the section 1 definition pull against each other. The word voice is expressly in the list, which reads as though Parliament meant to catch voice. The storage qualifier that follows describes something a live call does not obviously do: a voicemail is stored until collected, and a conversation is ordinarily experienced as simultaneous transmission and reception.
ITLawCo analysis. The competing readings turn on what the qualifier attaches to. Read it as governing every item in the list, and a live call falls outside section 69 while voicemail drops inside it. Read it as describing transmission generally, and voice marketing is caught. The presence of voice does not settle it, because voicemail and recorded voice notes give the word work to do without reaching every live conversation. Nor does the presence of automatic calling machines in section 69(1), which transmit pre-recorded messages and may sit differently in the architecture.
ITLawCo analysis. The narrower reading is not a position invented by industry in response to the Regulator’s guidance. Burns and Burger-Smidt, in Protection of Personal Information: Law and Practice, note that section 1 of POPIA “refers to a telephone message sent out over an electronic network and not as such a telephone call”. That is a footnote rather than a worked construction. Its significance is that the reading was held in specialist commentary before the Guidance Note, and, as the drafting history below shows, it matches what the Commission proposed.
ITLawCo analysis · Open question. No reported South African judgment we have identified decides whether a live telephone call satisfies the section 1 definition. Absence of authority can never be established exhaustively, and the question remains genuinely unsettled.
ITLawCo analysis. The two provisions are also routinely merged, including in the commentary. The same text, discussing the section 1 definition, reasons that the listed forms are not a closed class “because of the word ‘including'”. There is no including in the section 1 definition. It is in section 69(1), which lists the means by which marketing may be carried out. The definition and the list do different work, and conflating them is how the storage qualifier disappears from the analysis.
The Regulator’s position, and how it is reasoned
The Regulator has a storage argument, and it is better than the one usually attributed to it.
Authority indicates. The Guidance Note on Direct Marketing, issued on 3 December 2024, lists telephone among the forms of unsolicited electronic communication at paragraph 4.1.2 and again at paragraph 7.1. Paragraph 7.1.1 records the Regulator’s view that telephone calling is electronic communication because the technology has become digital over time and predominantly uses VoIP. Paragraph 7.1.2 takes the further step: voice is encoded into a digital stream, divided into data packets, those packets are stored on the network, and they are then relayed to the recipient’s terminal equipment.
Authority indicates. The Guidance Note states that it is advisory in nature.
ITLawCo analysis. That is a storage argument, not merely a technology argument, and it should be stated at its strongest. It runs: the definition expressly includes a voice message; section 69(1) expressly includes automatic calling machines, so Parliament contemplated telephony; a modern call is packetised and those packets rest in network infrastructure; the definition prescribes no minimum duration and no requirement that retrieval be user-initiated; the packets remain in the network until the call is accepted and consumed. On that reading both limbs are satisfied.
ITLawCo analysis. The answer is not that a call involves no storage. It plainly involves buffering. The answer is that the definition does not ask whether a message passes through equipment capable of storing it. It asks for a message stored in the network or in the recipient’s terminal equipment until it is collected by the recipient. “Until collected” describes a message waiting in a retrievable form for a recipient who comes to get it. E-mail, SMS and voicemail work that way. A live conversation does not. The proposition is not that a live call involves no storage, which is what paragraph 7.1.2 disputes and what buffering concedes. It is that a live call is not ordinarily stored as a message awaiting collection by the recipient.
ITLawCo analysis. There is also a surplusage problem. Essentially every digital communication is buffered somewhere in transit. If transient buffering intrinsic to real-time transmission satisfies the qualifier, the qualifier classifies nothing, and Parliament’s words do no work. The narrower reading gives them work to do.
ITLawCo analysis · Open question. So the contest is not storage against no storage. It is whether transient storage intrinsic to real-time transmission satisfies a definition framed around storage until collection. That is the question a court will have to answer, and it is genuinely open.
Authority indicates. Advocate Pansy Tlakula has said the Regulator is firmly of the view that direct marketing by telephone constitutes electronic communication, and that the matter cannot go on forever and has to be settled by the courts.
Authority indicates. Two matters, MTN and OUTsurance, have been referred to the Enforcement Committee, and the Regulator says they raise the interpretation and application of section 69. A referral is not a finding. Roughly 10% of the more than 3,800 complaints received last year concerned direct marketing.
ITLawCo analysis. A referral is also not litigation, and the Enforcement Committee is not a court. Under sections 92 and 93 the Regulator may refer a completed investigation to the Committee, which makes a finding and a recommendation to the Regulator. The Regulator may then issue an enforcement notice under section 95. An authoritative interpretation of section 69 only arrives if one of these matters, or another, reaches a court on review or appeal. The question has been put in issue. It has not been set down.
ITLawCo analysis. Note what is not contested. The FT Rams Consulting matter concerned unsolicited e-mail marketing, and nobody argued that e-mail falls outside section 69. The R100,000 followed non-compliance with an enforcement notice rather than the contravention itself, which is worth stating precisely: the Committee does not impose fines, and non-compliance with an enforcement notice is separately an offence under section 103. Section 69 already bites where the channel is plainly a stored message, as it does for marketing over messaging platforms. The live call is the only channel where the definition does real work.
What the drafters did, and what Parliament changed
The Commission built a coherent architecture, and Parliament altered it. Stored and automated channels went under a special opt-in rule; live human telephony was left to the ordinary Chapter 3 rules. Parliament then opened the channel category, widened the network the definition refers to, and tightened the stored-message qualifier, all in the same amendment. The alteration is documented. No reason for it appears in the minutes.
Authority indicates. The Commission was transplanting Article 13 of Directive 2002/58/EC, and it recorded that article’s distinction. At paragraph 5.1.39 the Report sets out the opt-in standard for electronic mail, automatic calling machines and facsimile machines, and notes that “any message by electronic communications where the simultaneous participation of the sender and the recipient is not required is covered by this concept of electronic mail”. Storage until collection is the drafting proxy for that idea, not an incidental technical detail.
Authority indicates. The South African Law Reform Commission’s 2009 Report on Project 124 set out the proposed regime at paragraphs 5.1.55 to 5.1.59. The new position, it said, applied to automated calling machines, faxes, electronic mails and SMSs. Paragraph 5.1.58 then dealt with the rest: “For fixed and mobile person-to-person voice telephony marketing calls, other than via automated calling machines, the ordinary rules set out in Part A of Chapter 3 of the Bill above will apply.”
Authority indicates. Clause 66(1) of the Commission’s draft Bill prohibited direct marketing “by means of automatic calling machines, facsimile machines, SMSs or electronic mail”. A closed list of four channels. There was no umbrella category.
Authority indicates. The draft Bill contained no definition of “electronic communication” at all. It defined “electronic mail” as “any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient”.
ITLawCo analysis. The storage wording now doing the work in section 1 was drafted as the definition of electronic mail, and the concept it carried across was asynchrony. It sat alongside a closed list that did not include live calls, and a paragraph that sent live calls to Chapter 3 instead. The footnote to that paragraph points to the Consumer Protection Bill, which is where the Commission expected live calling to be dealt with.
Authority indicates. The Bill introduced in Parliament on 24 August 2009 as B9-2009 reproduced the Commission’s clause 66(1) without change, including the closed list of four channels and the stored-message definition of electronic mail. Parliament received the Commission’s scheme intact.
Authority indicates. The change was made in the Portfolio Committee’s technical working drafts during 2012. By the seventh working draft, on 18 June 2012, the drafter described the clause as prohibiting processing by means of any form of electronic communication, including automatic calling machines, SMS or e-mail. B9B-2009, published on 11 September 2012, then carried clause 69(1) in what became its enacted form, word for word: processing for direct marketing “by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited” unless the data subject consented or was a customer. Clause 1 defined electronic communication as a message “which is stored in the network or in the recipient’s terminal equipment until it is collected by the recipient”, and no separate definition of electronic mail survived.
Authority indicates · Open question. No reason for the broadening appears in the committee records we reviewed, which are the Portfolio Committee minutes published by the Parliamentary Monitoring Group. Those are summaries rather than transcripts. The drafter described the change. Nothing we found records why it was made, or says that live person-to-person calls were being brought in or kept out.
ITLawCo analysis. Parliament made three changes, and they do not all run the same way. It replaced a closed list of four channels with “any form of electronic communication, including” those same four, which is the move a drafter makes to catch what a list does not name. It replaced “a public communications network” with “an electronic communications network”, removing the limitation to public networks. Both of those widen the section. And it tightened the storage qualifier, from a message which “can be stored” to one which is stored, while moving that qualifier onto the term the new category uses. That narrows it.
ITLawCo analysis · Open question. Neither side takes a cheap win from this history, and the Commission’s intention does not dispose of it. Two of the three changes widen the section and one narrows it, so counting them settles nothing. What matters is that the narrowing change is attached to the defined term on which the whole broadened category now depends. The legal question is what significance the three changes, read together, have for live telephony. It is open.
ITLawCo analysis. The Report also records, at paragraph 5.1.73, that government’s strategy to promote call centres was put to the Commission in this context. The sequence is documented. The Report does not say that it explains paragraph 5.1.58, and we do not assert that it does.
How a court will have to frame it
This is not textual literalism against regulatory policy. Both sides have a legislative-history argument and a purposive one, and the weaker version of each is the one usually argued.
ITLawCo analysis. The Regulator’s best argument is not that policy has moved. A regulator cannot change the meaning of an enacted definition because the balance of convenience in 2026 differs from the balance in 2013. The stronger version has two limbs. The first is legislative history. Parliament had the Commission’s closed list before it, in a Bill it had received in exactly that form, and replaced it with an open one. A court is entitled to attribute consequence to a deliberate departure, and the orthodox question is what consequence. The second is purposive. South African interpretation is contextual and purposive; Parliament enacted technology-neutral language referring to an electronic communications network rather than a list frozen to the technology of the day; voice is expressly in the definition; section 69(1) already contemplates telephony through automatic calling machines; and communications technology has since converged on packet-switched transport. On that argument the words have not changed. The facts they apply to have.
ITLawCo analysis. The answer to the first limb is that Parliament made three changes, not one, and they do not point the same way. A deliberate-departure argument that counts the widening and passes over the narrowing is incomplete. The narrowing change governs the defined term the broadened category uses, which is where that argument has to be met.
ITLawCo analysis. The answer is that technological change can alter the facts to which a statute applies without dissolving the relationship the statute describes. The definition does not ask whether a message is stored. It asks for a message stored until it is collected by the recipient. Packet buffering exists so that real-time transmission can happen at all. It is not a message waiting for a recipient to come and get it. Reading it as one does not update the application of the words. It removes them.
ITLawCo analysis. Neither side can claim the statute’s purpose outright. Section 2 gives POPIA plural objects: giving effect to the right to privacy, subject to justifiable limitations aimed at balancing that right against other rights and at protecting important interests, including the free flow of information. A purposive argument that selects one object and ignores the balance is not a purposive argument.
ITLawCo analysis · Open question. So the question is narrow, genuinely hard, and about Parliament rather than about technology. What legal consequence should be attributed to a change Parliament made and never explained? Nothing in the reported authority we have identified answers it, and an organisation deciding what to do this quarter should assume it will stay unanswered for some time.
Winning the argument does not leave POPIA
This is the part the debate keeps skipping. If a live call is not an electronic communication, the calling does not become unregulated. It moves to a different POPIA pathway.
Law requires. The eight conditions for lawful processing in Chapter 3 apply to all direct marketing. Section 69 is superimposed where the marketing is by unsolicited electronic communication. Burns and Burger-Smidt state the relationship in exactly those terms.
Law requires. A responsible party still needs a justification under section 11(1). Consent is one of six. Depending on the facts a responsible party might rely on section 11(1)(f), the legitimate interests of the responsible party or a third party. Where consent is relied on, the responsible party bears the burden of proving it, which turns on how consent is captured and recorded.
Law requires. Section 11(3)(b) gives a data subject the right to object, at any time, to processing for direct marketing other than direct marketing by unsolicited electronic communication under section 69. Once that objection is made, section 11(4) means the responsible party may no longer process the information for that purpose.
ITLawCo analysis. That objection right is the sting in the narrower reading. An organisation that succeeds in placing live calls outside section 69 has not escaped consent into freedom. It has moved from a regime of prior permission into a regime of lawful justification plus an objection that stops processing the moment it is exercised, and it now needs a mechanism to receive, record and honour objections across every calling list.
Law requires. Where the numbers were not collected from the data subject, section 12 governs collection from another source, section 18 governs notification, and purpose specification constrains further processing. Buying or enriching a calling list raises those conditions whether or not section 69 applies.
ITLawCo analysis. Section 57 prior authorisation is not triggered by ordinary outbound calling. It can be triggered where unique identifiers are processed for a purpose other than the one for which they were collected and with the aim of linking the information to information processed by other responsible parties. Identity resolution and list enrichment across data held by different responsible parties are where that question arises.
The consumer protection regime runs in parallel
A third regime sits alongside both POPIA pathways, where the Consumer Protection Act itself applies.
Law requires. The Consumer Protection Act Amendment Regulations, 2026, made under section 120(1)(a) read with section 11(6) of the Consumer Protection Act 68 of 2008, commenced on 15 April 2026 with no transitional period. They replace the voluntary industry arrangement with a Commission-administered regime. No direct marketer may contact a consumer unless registered on the opt-out registry. Registration renews annually and the marketer must cleanse its database against the Commission’s records monthly. Consumers may lodge a pre-emptive block.
Law requires. Registration costs R2,574.00, annual renewal R1,930.50, and cleansing R0.12 per data entry.
Law requires. The CPA does not apply to every calling programme. Section 5(2)(b) excludes a transaction where the consumer is a juristic person whose asset value or annual turnover equals or exceeds the threshold, currently R2,000,000.
ITLawCo analysis. So the registry regime applies independently of how section 69 is interpreted, but not independently of the CPA’s own scope. For business-to-business calling above that threshold, the CPA may not apply at all, while POPIA still governs the personal information of the individuals being called.
ITLawCo analysis. These are separate regimes with different triggers and different remedies. A marketer that registers and cleanses monthly has complied with those registry obligations. It has not thereby complied with the CPA as a whole, which carries other direct marketing rules, and it has not obtained consent or established a Chapter 3 justification, which is what POPIA requires on either pathway.
ITLawCo analysis. What the section 69 question decides is not which statute governs. POPIA governs the processing either way. It decides which POPIA direct-marketing pathway applies, what conditions attach to it, whether the data subject holds the section 11(3)(b) objection right, what the responsible party must be able to evidence, and what enforcement route follows. The CPA is an additional regime where its own scope is satisfied, not the fallback source of all regulation if section 69 falls away.
Authority indicates. The Regulator addressed the relationship directly in a media statement of 21 April 2026. Its position is that the two regimes protect different people: the registry protects consumers who register a pre-emptive block, and POPIA protects those who do not, because consent must still be obtained. Advocate Tlakula put it as “by merely opting-out, a data subject cannot be regarded as having given consent”.
The decision frame
| Layer | For an organisation running outbound calling |
|---|---|
| Legal position | Unsettled as to which POPIA pathway applies. Section 69 requires consent, subject to the customer exemption in section 69(3), which is narrower than it is usually treated as being. If live calls fall outside section 69, Chapter 3 applies with a section 11(1) justification and the section 11(3)(b) objection right. Section 69(4) sender identification probably applies on either reading, though that is our reading rather than settled law. The CPA registry regime applies where the CPA applies. |
| Operational implication | Three control sets, not two. Consent capture and records. Or lawful-justification records plus a working objection mechanism that stops processing on request. Plus registry, monthly cleanse and block suppression where the CPA applies. |
| Decision | Which pathway the programme is actually on, and whether the organisation can evidence it. Where the exposure is material, at what level that risk is accepted. |
| Action | Confirm registration and monthly cleansing, which are live today and do not depend on the interpretation. Then map each calling list to a pathway and test whether the conditions for that pathway are met. |
| Evidence | Registry registration and cleansing records. Per list: the pathway relied on, and either the consent record or the section 11(1) justification. The objection mechanism and its log. Sender identification and cessation contact details in the call script. The record of who accepted any residual risk. |
ITLawCo recommends. Start with the section 69(3) claim, because it is the one most often asserted and least often established. Every element must hold. Paragraph (a): the contact details were obtained by that responsible party in the context of the sale of a product or service. Paragraph (b): the marketing is of that responsible party’s own similar products or services. Paragraph (c): the data subject was given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, both at the time the information was collected and on the occasion of each subsequent communication.
ITLawCo recommends. Where the calling programme is material to revenue, the residual risk should be accepted at the level authorised to accept a legal and compliance risk of that size, and the acceptance should be recorded. Whether that is the board depends on your delegation framework, not on anything in POPIA.
Where this stops being generic
The general position above holds where outbound calling is made by human agents to consumers, on lists the organisation controls, for its own products.
Organisation-specific analysis becomes necessary where any of the following is true.
- The CPA’s own application is in doubt, which for business-to-business calling above the section 5(2)(b) threshold it often is.
- Calling is done by an outsourced provider. Whether that provider is an operator depends on whether it determines any purpose or means of its own, and outsourcing does not move the responsible party’s section 69 obligations onto whoever makes the call.
- Lists are acquired from a third party, where the collection conditions in sections 12 and 18 and the original purpose all have to be worked through.
- Dialling is automated in some part of the workflow. Whether section 69(5) is engaged turns on whether the machine can call without human intervention, and predictive, progressive and preview diallers do not all answer that question the same way.
- The existing-customer exemption is relied on across a group, where the word own in section 69(3)(b) is doing work against you.
- Unique identifiers are being linked to data held by other responsible parties, which raises section 57.
- A complaint has already been lodged, where the question stops being programme design and becomes a specific exposure.
None of this means an organisation outside those categories has nothing to do. Registration, cleansing, a genuine customer relationship and a similar product get you some of the way. They do not by themselves establish section 69(3), which has conditions about how the opportunity to object was given, nor section 69(4), nor a Chapter 3 justification if the narrower reading prevails. The distinction worth drawing is between a programme that can be tested against a known pathway and one that has never been mapped to any.
Sources relied on
- Protection of Personal Information Act 4 of 2013, s 1 definitions of “electronic communication” and “direct marketing”; ss 2, 11(1), 11(3)(b), 11(4), 12, 18, 57(1)(a), 69(1), (3), (4) and (5), 92, 93, 95 and 103.
- Consumer Protection Act 68 of 2008, ss 5(2)(b), 11(6) and 120(1)(a).
- Consumer Protection Act Amendment Regulations, 2026, GN R7380, commenced 15 April 2026.
- South African Law Reform Commission, Report on Project 124: Privacy and Data Protection, August 2009, paras 5.1.39, 5.1.55 to 5.1.59 and 5.1.73, and the draft Bill at clause 66 and the definition of “electronic mail”.
- Protection of Personal Information Bill B9-2009, as introduced, 24 August 2009, clause 66(1) and the definition of “electronic mail”.
- Protection of Personal Information Bill B9B-2009, as presented by the Portfolio Committee on Justice and Constitutional Development, 11 September 2012, clause 69(1), (3), (4) and (5) and the clause 1 definition of “electronic communication”.
- Portfolio Committee on Justice and Constitutional Development, committee records: sixth working draft, 28 March 2012; seventh working draft, 18 June 2012; and clause-by-clause deliberations, 27 August 2012.
- Bill versions and dates, B9-2009 through B9B, B9C and B9D to Act 4 of 2013.
- Information Regulator, Guidance Note on Direct Marketing in terms of the Protection of Personal Information Act 4 of 2013, 3 December 2024, paras 4.1.2, 7.1, 7.1.1 and 7.1.2. Advisory in nature. Information Regulator, Guidance Notes
- Information Regulator, media statement on the published Gazette of the Consumer Protection Act Amendment Regulations, 21 April 2026. Media statement
- Information Regulator media briefing, 31 August 2026, on the referral of MTN and OUTsurance to the Enforcement Committee. Information Regulator, videos
- Y Burns and A Burger-Smidt, Protection of Personal Information: Law and Practice, 2nd ed, LexisNexis, 2023, ch 13.
- Consumers urged to join Opt-Out Registry, South African Government News Agency.
Notice
This Field Note is general information on South African law, current as at 27 September 2026. It is not legal advice and should not be relied on as advice on any particular set of facts. The central question it addresses is unsettled, and the position may change.
