SMS Marketing Compliance South Africa: New Opt-Out Registry

If your business uses SMS to communicate marketing offers, promotions or other direct marketing messages, there is an important regulatory development you need to understand.

South Africa’s new National Consumer Commission (NCC) Opt-Out Registry introduces additional requirements for businesses conducting direct marketing and gives consumers a central mechanism for blocking unwanted electronic marketing communications.

The Consumer Protection Act Amendment Regulations, 2026 were gazetted on 15 April 2026, establishing the framework for the new Opt-Out Registry. The NCC has confirmed that direct marketers must register and maintain their marketing lists in accordance with the new requirements.

For businesses using SMS marketing, this means that database management and customer preferences need to become an even more important part of the campaign process.

But the new Registry does not replace the Protection of Personal Information Act (POPIA). Businesses still need to consider the rules governing electronic direct marketing under POPIA, including Section 69.

So, what exactly has changed, how does the new Registry work, and what should businesses using SMS marketing be doing now?

H2: What Is the New Direct Marketing Opt-Out Registry?

The Direct Marketing Opt-Out Registry is a national system established under the Consumer Protection Act to allow consumers to place a pre-emptive block on unwanted direct marketing communications.

The Registry is administered by the National Consumer Commission.

Consumers can use the system to restrict direct marketing communications, including electronic communications such as SMS and email. The NCC’s stated purpose is to provide consumers with a more effective way to control unwanted direct marketing.

The Registry is particularly significant because it moves beyond the traditional approach of asking individual businesses to stop sending marketing messages.

Instead, consumers have a central mechanism through which they can register their marketing preferences.

The NCC has indicated that consumers will be able to choose between broader and more specific blocking options, including blocking communications from particular marketers, industries or communication channels.

For businesses, this means that checking and maintaining marketing databases becomes an important part of responsible SMS campaign management.

H2: When Did the New Opt-Out Registry Come Into Effect?

The Consumer Protection Act Amendment Regulations, 2026 were gazetted on 15 April 2026 and came into effect on that date. The regulations established the framework for the Opt-Out Registry and introduced requirements for direct marketers. National Consumer Commission

The NCC initially indicated that registration of direct marketers and consumers would commence in July 2026.

Since then, the NCC has provided additional guidance around how the Registry is intended to operate in practice.

This means businesses that conduct direct marketing should not treat the Registry as a future issue. It is something that should already be considered when reviewing SMS marketing processes and databases.

H2: Who Does the Opt-Out Registry Apply To?

The requirements are relevant to businesses and organisations that conduct direct marketing.

The NCC defines direct marketing broadly as approaching a person, either in person or by mail or electronic communication, for the direct or indirect purpose of promoting or offering goods or services, or requesting a donation.

This can include marketing communications sent through:

SMS
Email
Telephone calls
Other electronic communication channels
Certain direct marketing activities involving donations

For an organisation using SMS to promote products, services, special offers or other commercial activities, the new requirements are therefore directly relevant.

The important distinction is between marketing communications and purely transactional or operational messages.

For example, an SMS confirming an existing appointment is different from an SMS promoting additional services to the customer. Businesses should consider the purpose of the communication when determining whether direct marketing rules apply.

H2: What Does the New Registry Mean for SMS Marketing?

The practical impact is straightforward:

Businesses need to know who is permitted to receive their marketing messages before sending them.

Under the new framework, direct marketers must register with the NCC and update their direct marketing lists to remove consumers who have opted out before marketing goods or services.

The NCC’s more recent guidance has also indicated that direct marketers will need to cleanse their databases monthly against the Registry. National Consumer Commission

For businesses sending SMS campaigns to thousands of contacts, this makes database management a critical part of the marketing process.

Before launching a campaign, businesses should consider:

Where did the contact details come from?
Was appropriate consent obtained where required?
Has the customer previously opted out?
Is the customer listed on the NCC Opt-Out Registry?
Has the database been cleansed against the Registry?
Is the sender clearly identifiable?
Does the message provide an appropriate way to stop future marketing?

The goal isn’t simply to send fewer messages. It is to ensure that marketing is sent to an appropriate audience using a properly managed database.

H2: How Does the NCC Registry Work With POPIA?

This is one of the most important aspects for businesses to understand.

The new NCC Opt-Out Registry does not replace POPIA.

The two frameworks address different areas of law, but both are relevant to direct marketing. POPIA Section 69

POPIA regulates the processing of personal information, while the Consumer Protection Act provides consumer protection requirements relating to direct marketing.

Section 69 of POPIA specifically deals with direct marketing by means of unsolicited electronic communications.

Under Section 69, electronic direct marketing is generally prohibited unless the relevant requirements relating to consent or the existing-customer exception are met.

This means businesses cannot simply assume that registering with the NCC gives them permission to send SMS marketing to any database.

POPIA requirements still need to be considered.

H2: What Does POPIA Section 69 Say About SMS Marketing?

POPIA Section 69 applies specifically to direct marketing through unsolicited electronic communications.

This includes channels such as:

SMS
Email
Certain electronic messaging channels

Where consent is required, the responsible party must be able to demonstrate that appropriate consent was obtained.

POPIA also provides a limited exception for existing customers where certain requirements are met, including circumstances where the contact details were obtained in the context of a sale and the marketing relates to the responsible party’s own similar products or services.

Customers must also have been given a reasonable opportunity to object to the use of their information for direct marketing.

The key point is that having someone’s mobile number does not automatically mean that you can send them marketing SMS messages.

Businesses need to understand the basis on which a person was added to the marketing database.

H2: Does an NCC Opt-Out Override Previous Consent?

This is an important development in the latest guidance.

The NCC has indicated that where a consumer registers a pre-emptive block on the Registry, that block should prevent the consumer from receiving electronic direct marketing, even where the consumer previously provided marketing consent.

In other words, businesses should not assume that an old consent record gives them permission to continue marketing to a consumer who has subsequently registered an applicable block.

The NCC’s current position is that a Registry block takes precedence over previous consent.

There are still legal questions around how all possible consent scenarios will operate in practice, and the NCC has acknowledged that some situations may need to be considered on a case-by-case basis.

For businesses, the safest practical approach is to treat a registered block as something that must be respected.

H2: What Is Database Cleansing?

Database cleansing means reviewing a marketing database and removing or suppressing contacts who should no longer receive direct marketing.

This can include people who:

Have withdrawn their consent
Have directly asked your business to stop marketing to them
Have registered a relevant block with the NCC
Should otherwise no longer be included in the marketing audience

The new regulations introduce a formal requirement for direct marketers to cleanse their databases against the Opt-Out Registry.

The NCC’s current guidance indicates that this cleansing will take place monthly and that cleansing fees will apply.

This is particularly important for businesses with large databases.

When managing large SMS databases, using a platform with built-in contact and opt-out management can help reduce manual administration and make it easier to keep campaign lists organised. WinSMS provides bulk SMS tools designed to help businesses manage contacts, campaigns and messaging activity from one central platform.

A list containing 10,000, 50,000 or 100,000 mobile numbers cannot simply be assumed to remain compliant forever. Customer preferences change, and databases need to be maintained accordingly.

H2: Why Businesses Should Maintain Their Own Opt-Out Records

The NCC Registry should not be treated as a replacement for your own internal opt-out process.

Businesses should continue maintaining their own records of customers who have asked to stop receiving marketing communications.

For example, if someone receives an SMS campaign and replies with a request to unsubscribe, that preference should be recorded and the number should be suppressed from future marketing.

A robust process should therefore include both:

Internal opt-out management + NCC Registry cleansing

This creates a more comprehensive approach to managing customer preferences.

WinSMS also provides opt-out functionality to help businesses prevent messages from being sent to recipients who have opted out through their WinSMS account. This can support your internal suppression process alongside the separate NCC Registry requirements.

It also reduces the risk of someone being added back into a marketing campaign after previously opting out directly with the business.

H2: Keep Clear Records of Consent

If your business relies on consent for SMS marketing, it is important to maintain appropriate records.

You should be able to establish:

When consent was obtained
How consent was obtained
What the customer agreed to receive
Which contact details were provided
Whether consent has subsequently been withdrawn

For example, simply having a spreadsheet containing thousands of mobile numbers does not establish where those numbers came from.

A better database structure records the source and status of each marketing contact.

This makes it easier to manage your campaigns and respond if a customer questions why they received a marketing message.

H2: Make Your SMS Sender Identity Clear

Compliance isn’t only about your database.

The SMS itself also needs to be transparent.

POPIA’s direct marketing provisions require electronic marketing communications to contain details identifying the sender or the person on whose behalf the communication was sent, along with an address or other contact details through which the recipient can request that communications stop.

Customers should therefore be able to identify which business sent the message.

For example:

WIN SMS: Summer Sale! Save 20% this weekend. Shop now: [link]. Reply STOP to unsubscribe.

The exact wording and opt-out mechanism will depend on your marketing setup, but the principle is simple: customers should know who is contacting them and how to stop future marketing communications.

H2: An Unsubscribe Option Is Not Your Entire Compliance Strategy

Including an unsubscribe option is important, but it shouldn’t be the only compliance measure a business has in place.

A properly managed SMS marketing process should look more like this:

Collect → Record → Verify → Cleanse → Send → Process Opt-Outs → Update

Each stage matters.

If a customer unsubscribes today but remains active in tomorrow’s campaign list, the unsubscribe mechanism hasn’t achieved its purpose.

Similarly, if a business has no record of where its customer database originated, it may struggle to demonstrate that the database was built and maintained appropriately.

H2: Practical Steps Businesses Can Take Now

Businesses using SMS marketing can start preparing by reviewing their existing processes.

H3: 1. Review Your Marketing Database

Identify where your contacts came from and determine whether you have appropriate records relating to consent, customer relationships and marketing preferences.

Don’t assume that every number in your CRM is automatically suitable for marketing.

H3: 2. Review Your Consent Process

Make sure your website forms, competitions, promotions, customer registrations and other lead-generation activities clearly explain when a person is agreeing to receive marketing.

Avoid relying on vague or unclear consent wording.

H3: 3. Maintain an Internal Suppression List

When a customer opts out, their number should be added to a suppression list so that it is excluded from future marketing campaigns.

This should be treated as an ongoing process rather than something handled manually each time a campaign is prepared.

H3: 4. Register as a Direct Marketer

The NCC has confirmed that direct marketers must register under the new framework. Registration, renewal and database-cleansing fees form part of the amended regulations.

Businesses should review the current NCC registration process and ensure that the appropriate person within the organisation is responsible for compliance.

H3: 5. Build Monthly Database Cleansing Into Your Process

The latest NCC guidance indicates that direct marketers will be required to cleanse their marketing databases against the Registry monthly.

This should become part of your regular marketing workflow.

Rather than cleansing a database only when there is a problem, make it a scheduled process.

H3: 6. Keep Evidence of Marketing Preferences

Maintain records showing how customers entered your database and whether they have subsequently changed their preferences.

This can include consent records, opt-out requests and relevant customer communications.

H3: 7. Review Your SMS Content

Make sure your messages clearly identify the sender and provide an appropriate method for recipients to stop receiving direct marketing.

Your marketing team should review SMS templates periodically to ensure that the information remains accurate.

H3: 8. Review Your Process Regularly

Compliance should not be treated as a once-off project.

Review your database, consent process, opt-out handling and campaign workflows regularly, particularly when regulations or NCC guidance change.

H2: What About Existing Customers?

Existing customer relationships can be particularly useful for marketing, but they don’t provide an unlimited exemption from the rules.

POPIA Section 69 contains a specific existing-customer exception, subject to certain requirements.

For example, the contact details must have been obtained in the context of a sale, the marketing must relate to the responsible party’s own similar products or services, and the customer must have been given a reasonable opportunity to object.

Businesses should therefore avoid assuming that anyone who has ever purchased something can automatically be included in every future SMS campaign.

The circumstances in which the information was collected and the customer’s marketing preferences still matter.

H2: What About B2B SMS Marketing?

Businesses that conduct business-to-business marketing should also review their processes carefully.

It can be tempting to assume that B2B communication automatically falls outside consumer protection and data protection requirements.

That is not necessarily the case.

The application of the CPA, POPIA and the new Opt-Out Registry can depend on the nature of the recipient, the communication and the information being processed.

Businesses conducting significant B2B direct marketing should therefore obtain appropriate legal advice rather than assuming that their campaigns are automatically exempt.

H2: How Can an SMS Platform Help?

Technology cannot make a marketing campaign legally compliant by itself. However, a properly configured SMS platform can make it easier to implement good database and communication practices. WinSMS provides a range of Bulk SMS tools for sending and managing campaigns, from its online SMS platform to developer integrations and APIs.

However, a properly configured SMS platform can make it easier to implement good database and communication practices.

Useful features can include:

Contact list management
Opt-out handling
Contact segmentation
Suppression of unsubscribed contacts
Campaign reporting
API integrations
Automated communications
Controlled access to customer databases

These features can reduce manual administration and help businesses manage large databases more consistently.

For WinSMS customers, SMS tools can form part of a broader marketing workflow that includes appropriate consent management, database maintenance and opt-out handling.

The responsibility for complying with applicable legislation remains with the business conducting the marketing.

H2: Compliance Doesn’t Mean Giving Up on SMS Marketing

Regulatory changes can sometimes make businesses nervous about using a particular marketing channel.

However, the introduction of stronger opt-out controls doesn’t mean that SMS marketing is no longer viable.

In fact, it can encourage businesses to improve the quality of their databases.

A database of 10,000 people who genuinely want to hear from your business can be considerably more valuable than a database of 100,000 people who don’t.

Better targeting can also improve campaign performance.

Choosing the right Bulk SMS provider can also make it easier to manage campaigns effectively, with the right tools, support and functionality for your business.

When businesses focus on relevant offers, appropriate consent, accurate records and customer preferences, SMS becomes less about sending the largest possible number of messages and more about reaching the right audience.

H2: SMS Marketing Compliance Checklist

Before sending your next marketing campaign, ask the following questions:

Do we know where our marketing contacts came from?
Do we have appropriate consent records where required?
Do we maintain an internal opt-out or suppression list?
Are customers who have opted out excluded from future campaigns?
Are we registered as a direct marketer where required?
Are we cleansing our database against the NCC Opt-Out Registry?
Are we following the required cleansing schedule?
Does our SMS clearly identify the sender?
Does our message provide an appropriate way for recipients to stop marketing communications?
Are we considering both the CPA and POPIA?
Do we regularly review our marketing database and processes?

If you cannot confidently answer “yes” to some of these questions, it may be worth reviewing your SMS marketing process before your next campaign.

H2: Frequently Asked Questions About SMS Marketing Compliance

H3: What is South Africa’s Direct Marketing Opt-Out Registry?

The Direct Marketing Opt-Out Registry is a system established under the Consumer Protection Act that allows consumers to register pre-emptive blocks against unwanted direct marketing communications. It is administered by the National Consumer Commission.

H3: Do businesses need to register with the NCC to conduct direct marketing?

The NCC has confirmed that direct marketers must register under the new regulations. The framework also provides for registration, renewal and database-cleansing fees.

H3: Does the NCC Opt-Out Registry replace POPIA?

No. POPIA continues to regulate the processing of personal information and contains specific provisions relating to electronic direct marketing. Businesses need to consider both POPIA and the Consumer Protection Act when conducting SMS marketing.

H3: Does an NCC opt-out override previous marketing consent?

The NCC’s current guidance indicates that a consumer’s registration of a relevant pre-emptive block should prevent electronic direct marketing, even where previous consent was provided. Businesses should therefore treat an applicable Registry block as taking precedence.

H3: How often do businesses need to cleanse their SMS marketing databases?

The NCC’s latest guidance indicates that direct marketers will need to cleanse their marketing databases against the Opt-Out Registry monthly.

H3: Can businesses still send SMS marketing to existing customers?

Potentially, yes, but existing-customer marketing is subject to the requirements of POPIA Section 69 and the applicable Consumer Protection Act requirements. Businesses should not assume that every existing customer can automatically receive marketing messages.

H3: Does an unsubscribe option make an SMS campaign compliant?

Not by itself. Businesses also need to consider consent, customer preferences, the NCC Opt-Out Registry, database cleansing, sender identification and other applicable requirements.

H3: What should businesses do if they are unsure whether their SMS marketing is compliant?

Businesses should review their database and marketing processes and obtain appropriate legal advice where necessary. Regulatory compliance can depend on how contact information was collected, the nature of the communication and the relationship with the recipient.

H2: Final Thoughts

South Africa’s new Direct Marketing Opt-Out Registry is an important development for businesses using SMS, email and other forms of direct marketing.

The key point for marketers is that database management now matters more than ever.

Businesses need to understand where their contacts came from, maintain appropriate consent and preference records, respect customer opt-outs, comply with the NCC’s Registry requirements and continue meeting POPIA’s requirements for electronic direct marketing.

The new Registry should therefore be viewed as part of a broader compliance framework rather than a replacement for the rules businesses already have to follow.

For SMS marketers, the practical approach is straightforward:

Build responsibly. Check regularly. Communicate transparently. Respect customer preferences.

When businesses follow these principles, compliance doesn’t have to come at the expense of effective SMS marketing. Instead, it can help create cleaner databases, more relevant campaigns and better relationships with customers.

This article is intended for general informational purposes only and does not constitute legal advice. The regulatory framework and NCC guidance may develop further, so businesses should verify the latest requirements and obtain professional legal advice regarding their specific marketing activities.

Choose a Bulk SMS Provider You Can Trust

Not all Bulk SMS providers are created equal. WinSMS has helped South African businesses communicate reliably for over 20 years with transparent pricing, no expiry on credits, local support, powerful SMS APIs, and flexible messaging solutions designed to scale with your business.

No contracts • No expiry • Local SA support

Supported Networks: Vodacom · MTN · Cell C · Telkom Mobile