May 1, 2026
For years, most South African businesses have treated POPIA as the beginning and end of marketing compliance. Get consent, keep your records, offer an opt-out, and you're covered. That assumption is now out of date.
In April 2026, a new set of regulations under the Consumer Protection Act quietly came into force and introduced something the country has never had before: a national NCC Opt-Out Registry for direct marketing, run by the National Consumer Commission. If your business sends marketing by SMS, email, WhatsApp, or phone, this affects you โ and not in a small way.
The catch is that almost nobody is talking about it yet, partly because the registration system for businesses only opens in July 2026. That gap between "the law exists" and "you can actually comply" is exactly where most companies are going to get caught flat-footed. This guide walks through what the registry is, who it applies to, what it'll cost, and the handful of things worth doing before the window opens.
Think of it as a national "do not contact" list with teeth. Consumers can register themselves on the registry to place what the regulations call a pre-emptive block โ a blanket signal that they do not want to receive direct marketing. Once someone is on that list, you are not allowed to market to them, full stop.
The part that trips people up is the second half. The registry isn't only for consumers. Businesses that do direct marketing have to register too, pay a fee, renew annually, and check their databases against the registry every month to strip out anyone who has opted out. It turns a one-time consent exercise into an ongoing, recurring compliance obligation.
The regulations took effect on 15 April 2026 with no transitional grace period built into the wording. The practical reality, though, is that the NCC has said registration for both consumers and direct marketers will only commence in July 2026. So while the law is technically live now, the clock that matters for your business effectively starts in July.
This is where a lot of business owners assume they're off the hook and are wrong. The definition is deliberately wide. A direct marketer is, in plain terms, anyone who approaches a person to promote or supply goods and services, or to ask for a donation, regardless of the channel they use.
That sweeps in far more than the obvious telemarketing call centres. If your business sends:
then you are a direct marketer under these rules. It doesn't matter whether you're a bank, a small e-commerce store, an insurer, a gym, or a non-profit chasing donations. The channel is irrelevant. The activity is what counts.
Once you accept that you're in scope, here's what's actually required of you.
You have to register before you can market. This is the one most people underestimate. Registration isn't a nice-to-have or a box-ticking exercise you can defer. Being unregistered means your outbound marketing is unlawful, even if every single contact on your list gave you textbook consent. Registration is the gate. No registration, no marketing.
Consent on its own no longer protects you. Under the old mental model, a clean consent record was your shield. Not anymore. If a person is on the opt-out registry, you have to remove them, no matter when or how they originally agreed to hear from you. Their registry entry overrides your consent record. This is the single biggest shift in thinking that the new rules demand.
You must cleanse your database monthly. At least once a month, you're required to check your marketing list against the registry and remove everyone who has placed a pre-emptive block. This applies across every channel without exception โ you can't cleanse your email list and forget about your SMS list. As you add new contacts or refresh data, the obligation repeats. Forever.
Every message has to identify you. Each electronic marketing communication must carry the marketer's name, an electronic address, a physical address, and a contact number. You also can't send from a platform where the originator can't be identified, which has real implications for how sender IDs and templates are set up.
The NCC has attached fees to all of this. Registration starts at roughly R2 574 for 2026, with annual renewal from around R1 930.50. Those are the fixed, predictable costs.
The one to watch is the database cleansing fee, because it's charged on a per-record basis and escalates over a three-year cycle. For a small list that's negligible. For a business sending to tens or hundreds of thousands of contacts every month, a per-record monthly charge stops being a rounding error and becomes a genuine line item in your marketing budget. There's also an open question, flagged by several legal commentators, about whether that fee applies to every record you submit for checking or only to the records that actually get matched and removed โ and the difference between those two interpretations is enormous at scale.
If you're tempted to treat this as low-risk, the enforcement provisions are worth reading twice. Non-compliance is a criminal offence that can carry a fine or imprisonment of up to 12 months. On top of that, the National Consumer Tribunal can impose an administrative fine of up to 10% of your annual turnover or R1 million, whichever is greater.
That "whichever is greater" phrasing is the dangerous bit for larger businesses โ 10% of turnover can dwarf a million rand very quickly.
A common misread is that the new registry replaces your existing privacy obligations. It doesn't. POPIA still applies in full. You still need a lawful basis to process personal information, you still need to honour the direct marketing consent rules in section 69, and a consent request under POPIA still can't be bundled with marketing content in the same message.
So as of mid-2026, South African marketers are working under two stacked regimes at once: POPIA on the data-protection side, and the CPA's opt-out registry on the consumer-protection side. Compliance now means satisfying both.
You can't register yet, but the worst thing to do is sit and wait. A few sensible moves while the window is closed:
Start by getting your data house in order. Make sure your marketing databases are clean, deduplicated, and structured in a way that lets you run a monthly suppression process without it becoming a manual nightmare. If your contacts are scattered across spreadsheets and three different tools, fix that first.
Map your channels honestly. List every way your business does outbound marketing โ SMS, email, WhatsApp, voice โ and remember that the monthly cleansing has to cover all of them, not just the obvious one.
Decide who owns this. If you use an outside platform or agency to send your marketing, work out now whether they register, whether you register, or both, and who is responsible for the monthly cleansing. Getting that clear before July saves a scramble later.
And keep your POPIA consent records tidy in the meantime, because they don't go away.
โ
Here's the honest truth about the monthly cleansing requirement: doing it by hand is going to be painful. Pulling your list, submitting it for checking, waiting for the results, removing the matches, and then doing the whole thing again next month across every channel โ that's a recurring drain on time, and it's the kind of manual process where mistakes quietly creep in and turn into compliance risk.
We didn't love that future, so we built something better.
Dripcel has developed a technology, currently in beta, that automates the entire NCC compliance verification process in real time. Instead of treating cleansing as a once-a-month chore you have to remember and run, our system checks contacts against the opt-out registry continuously, so anyone who has placed a pre-emptive block is suppressed automatically before a message ever goes out. No spreadsheets, no manual uploads, no praying you didn't miss a record. Compliance becomes something that just happens in the background while you get on with running your campaigns.
The goal is simple: make the new rules a non-event for our clients. You shouldn't need a compliance officer and a calendar reminder to send a marketing SMS legally. The platform should handle it for you.
It's in beta right now, and we're putting it through its paces ahead of the July registration window. If you want to be among the first to know when it goes live, join our mailing list โ we'll let you know the moment it's publicly available, along with a clear walkthrough of how to switch it on for your account.
โ
โ
When does the NCC Opt-Out Registry come into effect?
โThe regulations came into force on 15 April 2026, but registration for businesses and consumers only opens in July 2026. For practical purposes, July is the date that matters for your business.
Does the registry replace POPIA?
โNo. It works alongside POPIA. You still have to meet all of your existing data-protection obligations in addition to registering and cleansing against the opt-out registry.
I already have consent from all my contacts. Am I exempt?
โNo. If a contact has registered a pre-emptive block on the opt-out registry, you must remove them regardless of the consent you hold. Consent is no longer a complete defence.
How often do I have to cleanse my database?
โAt least once a month, across every marketing channel you use.
What happens if I don't comply?
โNon-compliance is a criminal offence carrying a fine or up to 12 months' imprisonment, plus a possible administrative fine of up to 10% of annual turnover or R1 million, whichever is greater.
This article is general information, not legal advice. The regulations are new and some operational details are still being clarified by the NCC, so check the current position with a qualified advisor before making compliance decisions for your business.
