South African Rules on Unsolicited Communication

South Africa has more than one piece of legislation that touches on unsolicited electronic communication, commonly referred to as spam. This page gives a general overview of the relevant frameworks. It is not legal advice, and anyone with a specific legal question about spam or direct marketing should consult a qualified professional or the relevant regulator directly.

The Electronic Communications and Transactions Act

The Electronic Communications and Transactions Act (ECT Act) contains provisions addressing unsolicited commercial communications sent electronically. Among other things, it has historically required that senders of unsolicited commercial communications give recipients the option to opt out of receiving further messages, and that repeated messages be avoided once a recipient has indicated they do not wish to receive them. The Act also addresses consumer protection in electronic transactions more broadly, covering areas such as disclosure requirements for online sellers.

The Protection of Personal Information Act (POPIA)

POPIA is South Africa's main data protection law and has significant relevance to unsolicited marketing communications. Under POPIA, personal information, which includes details such as a name, email address or phone number, may generally only be processed for direct marketing purposes with the consent of the person concerned, subject to certain limited exceptions.

POPIA introduced stricter requirements around direct marketing by electronic communication compared to earlier rules, generally requiring that organisations obtain consent before sending marketing messages by email, SMS or similar electronic means, except in narrow circumstances such as an existing customer relationship where the sender obtained the contact details in the context of a sale, and gives the recipient a reasonable opportunity to opt out at the time of collection and with every subsequent communication.

Your Rights Under POPIA

POPIA gives individuals a number of rights regarding their personal information, including the right to request that an organisation stop using their information for direct marketing, and the right to lodge a complaint with the Information Regulator if they believe their information has been processed unlawfully, including being used to send unwanted marketing without a lawful basis.

The Information Regulator

South Africa's Information Regulator is the body responsible for overseeing compliance with POPIA. It accepts complaints from members of the public who believe an organisation has processed their personal information unlawfully, which can include sending direct marketing without proper consent or failing to honour an opt out request. Details of how to lodge a complaint are published on the Information Regulator's own official channels, which is the appropriate place to look for up to date, authoritative guidance on the complaints process.

Reporting Spam and Scam Messages

Beyond formal legal complaints, there are several practical reporting channels worth knowing about:

Mobile network operators generally accept reports of spam SMS messages or spam calls, often through a short code or dedicated reporting number published by the operator
Email providers almost always include a built in option to mark a message as spam or phishing, which both protects your own inbox and contributes to broader filtering improvements
Banks typically have dedicated channels for reporting phishing messages that impersonate them, since these are often used in active scam campaigns targeting many customers at once
WhatsApp allows users to report and block contacts directly within the app, which the platform uses to identify and act against accounts engaged in bulk unsolicited messaging

When reporting a suspected scam message, it is generally advisable not to click any links or reply to the sender first, since doing so can sometimes confirm that your number or address is active and in use.

A General Caution

Laws and regulatory contact details can change over time, and enforcement approaches evolve. For the most current and authoritative information on your rights and how to exercise them, it is best to refer directly to the Information Regulator and to the specific service providers involved, such as your bank, mobile network or email provider, rather than relying solely on general overviews like this one.