Five steps to ensure POPI compliance for direct marketing

The Protection of Personal Information Act 4 of 2013 (POPI) has now come into effect and it is important that South Africa businesses adhere to the new regulations. The use of personal information is everywhere and it’s almost impossible to do direct marketing without using personal information collected from customers, suppliers and employees. The POPI Act was designed to serve as one of the measures to protect consumers from direct marketing, regulating direct marketing via electronic communications and making it stricter.

Direct marketing is often favoured as a popular means of product marketing, especially for start-ups looking to grow their customer base. It is, however, often also a source of irritation for many consumers as suppliers are increasingly testing the boundaries of what is allowed.

Justine Krige, Director in the Corporate and Commercial practice at Cliffe Dekker Hofmeyr (CDH), says South African marketers need to do better to ensure that they are POPI compliant - whether it’s direct marketing by post, telephone, email or SMS.

Krige highlight five key ways to ensure that marketers do not cut corners:

1. Obtain consent

Direct marketing in any form of electronic communication including automated calling machines, faxes, SMSes and email is no longer allowed now that POPI has come into effect, unless the person has either given his/her consent to receive such electronic communication, or is an existing customer. Marketers can only send direct market electronically to a customer whose contact details were obtained through a sale of a product or service and for the purpose of direct marketing of similar products or services. The customer must be given a reasonable opportunity to object to the direct marketing at the time the personal information was collected and on every communication thereafter. In respect of direct marketing via telephone, post and in person, every person similarly has the right to refuse to accept the unwanted direct marketing and require the supplier to discontinue such activity.

2. Don’t forget the “unsubscribe” option

All electronic direct marketing communications must contain an “unsubscribe” option. Similarly, physical post boxes containing a direction that “no junk mail” will be accepted cannot be used for direct marketing. Companies need to manage their customer databases a lot more effectively – where, how and when was the personal information initially obtained; whether the person is an existing customer and which products or services they use; whether the person has consented to receiving direct marketing; and whether the person has unsubscribed from receiving direct marketing. In particular, companies need to adopt a vigilant approach in enforcing requests from consumers to discontinue any marketing activities.

3. Include the sender’s details

All communications for direct marketing purposes must contain the details of the identity of the sender or the person on whose behalf the communication has been sent, an address or other contact details to which the recipient may send a request that such communications was terminated.

4. Stick to permitted contact times

The POPI Act has now prescribed specific days and times of days for direct marketing, and businesses must not engage in any direct marketing directed to a consumer at home for any promotional purpose outside of these times. The prohibited times for contacting consumers at home (this includes via telephone, SMS or email) are as follows: Sundays or public holidays; Saturdays before 09h00 and after 13h00; and all other days between the hours of 20h00 and 08h00 the following day, unless the consumer has agreed otherwise.

“However, the responsibility is on the direct marketer to prove that the direct marketing communication was sent out within the prescribed period even if the consumer received the direct marketing outside of the prescribed times,” add Krige.

5. Beware the “cooling-off” period

Companies must remember that consumers have an entitlement under the CPA to cancel a transaction resulting from any direct marketing without reason or penalty by writing a notice to the supplier. This must be done within 5 days after the later of the transaction was concluded or the goods were delivered to the consumer.

Krige stresses that if South African marketers do not follow the law and the regulations outlined, the face getting heavy fines. “It is critical that marketers realise that POPI does not prohibit their direct marketing efforts, it does however mean that marketers are deliberate with their communications and they must ensure that the requisite approvals are in place from the consumer,” she concludes.