Consider all your communications against the definition of Direct Marketing.
Direct Marketing is defined very broadly under POPIA (see the full definition under the "Law" tab in this section.
If you are "directly or indirectly" promoting anything, then it is direct marketing.
It does not only apply to "mass mailers"; one-on-one communication can qualify as direct marketing, including requests to "make a donation of any kind".
If the communication is sent using "electronic means" and is "unsolicited" then Section 69 applies.
Remember that POPIA applies to juristic persons, so promotional communication sent to a company could also fall under the requirements of section 69.
Do you really have consent?
Section 69 has set a very high standard for what is considered adequate consent under POPIA.
If the contact is your customer but you are promoting someone else's products or services; or if the contact is not your customer, you probably don't have adequate consent.
Customers are bit more tricky. Can you prove that, at the time of the sale, your customer was told they would be receiving the direct marketing and that they were given the chance to object at that point? If not, then assume you do not have adequate consent.Defintion POPI Section 1
‘direct marketing means to approach a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of – (a) Promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or (b) Requesting the data subject to make a donation of any kind for any reason.'
POPIA Section 69 Direct marketing by means of unsolicited electronic communications
S69(1) The processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject— (a) has given his, her or its consent to the processing; or (b) is, subject to subsection (3), a customer of the responsible party.
S69(2) (a) A responsible party may approach a data subject— (i) whose consent is required in terms of subsection (1)(a); and (ii) who has not previously withheld such consent, only once in order to request the consent of that data subject. (b) The data subject’s consent must be requested in the prescribed manner and form.
S69 (3) A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)— (a) if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service; (b) for the purpose of direct marketing of the responsible party’s own similar products or services; and (c) if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details— (i) at the time when the information was collected; and (ii) on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.
S69 (4) Any communication for the purpose of direct marketing must contain— (a) details of the identity of the sender or the person on whose behalf the communication has been sent; and (b) an address or other contact details to which the recipient may send a request that such communications cease.
S69(5) ‘‘Automatic calling machine’’, for purposes of subsection (1), means a machine that is able to do automated calls without human intervention.
Regulation 6 Request for data subject's consent to process personal information
A responsible party who wishes to process personal information of a data subject for the purpose of direct marketing by electronic communication must in terms of section 69(2) of the Act submit a request for written consent to that data subject on Form 4.
(FORM 4 is defined in the Regulation)
