On 9 October 2026, Minister Parks Tau held a media briefing on the National Opt-Out Registry system. The briefing contained no new announcements. Instead, it gave a short overview of how the Registry will work, set out the key dates, and explained how section 69 of the Protection of Personal Information Act (POPIA) works alongside the direct marketing provision in section 11 of the Consumer Protection Act (CPA). Here are the key points you need to know.
Direct marketers, the clock is ticking. You must register on the national Opt-Out registry system before December 2026.
Important dates regarding the national opt-out registry system
- 15 September to December 2026. Direct marketers must register. Failing to register after this window will contravene section 11 of the Consumer Protection Act 68 of 2008 (CPA).
- December 2026 to April 2027. This period will be a five-month free cleansing period. During this time, marketers can test their systems and cleanse their lists at no cost.
- From 15 April 2027, the National Consumer Commission (NCC) starts full enforcement.
What should you as a direct marketer do?
- Register on the Registry by the given timelines. An unregistered marketer may not contact any consumer for the purpose of direct marketing.
- Cleanse lists against the Registry every month before running any campaign.
- Make every communication traceable, with the marketer’s name, address, and contact number. No hidden numbers.
- Register under your CIPC-registered name. The NCC has noticed many marketers registering under trading names.
What should you as a consumer do?
Consumers can block a specific marketer or all direct marketing from all industries by signing up at www.thencc.org.za. Importantly, a consumer should note that a block overrides consent given earlier in any form. This includes consent even in contract fine print. Furthermore, registration for consumers will not be instant. This is because the NCC has to verify ID numbers with Home Affairs.
Information Regulator stresses POPIA still applies
The Information Regulator also spoke during the media briefing and stressed that the CPA regulations must be read with section 69 of the Protection of Personal Information Act 4 of 2013 (POPIA). Electronic direct marketing still needs prior consent, unless the person is an existing customer under section 69(3). This protection covers consumers who haven’t registered, and those who have blocked only certain marketers. Complying with the CPA doesn’t excuse non-compliance with POPIA.
Additionally, the NCC will handle complaints from consumers with a general block. The Information Regulator will handle POPIA-based complaints, including those from consumers without a registered block.
Lastly, the Information Regulator noted that the Registry collects a lot of personal information. The Regulator had engaged the NCC on this because it believes some of that information should not be collected, and the two bodies appear to have reached some agreement on the issue. She urged the NCC to guard the Registry and put adequate security measures in place to protect its integrity and confidentiality, pointing out that the Regulator has received about 3,000 data breach notifications since the start of the year.
Earlier, in response to a question about the NCC’s capacity to run the Registry, the Acting Commissioner said the system does not need people watching over it 24 hours a day. The NCC will work with several partners, and “South Africans should rest assured that this is a system. It’s technology here at play”. He added that the system has been tested to handle very high volumes.
Penalties for not registering on the national Opt-Out registry system
The National Consumer Tribunal may impose administrative fines of up to R1 million or 10% of annual turnover, whichever is greater (section 112 of the CPA). The Minister also warned brands that use agencies and call centres: “It is your brand that’s on the line”
Political parties
The NCC’s view is that contacting voters to campaign is not direct marketing, but asking for donations may be. They clarified this question and other questions in their 2026 guidelines for compliance with Opt-Out registry regulations. The Information Regulator added that parties must obtain voter contact details lawfully, may not buy them, and may not share them for micro-targeting or polling without consent.
Action you can take
- Understand the media briefing better by watching it on youtube.
- Know what actions you must take by reading the requirements on our NCC opt-out registry post.
- Read our summary of the key points in the 2026 guidelines on complying with the Opt-Out Registry regulations.
- Make sure that your direct marketing is lawful by working through our principled direct marketing module.
