SA Opt-Out Registry: Consent & CRM

South Africa’s National Opt-Out Registry is changing the operational conversation around direct marketing. For a business owner, it may sound like a regulatory change. For a marketing manager, CRM administrator or customer experience team, it raises a more practical question: can your business reliably honour a customer’s communication preferences across every system that holds their details?

On 7 October 2026, the National Consumer Commission (NCC) announced the registry’s launch under the Consumer Protection Act. The phased rollout affects direct marketers, while consumers’ ability to register pre-emptive blocks is scheduled to become available from May 2027. The registry is not a replacement for existing privacy law, and it would be misleading to suggest all its features are already operational. See the NCC’s official rollout announcement for the dates and obligations.

Beyond the legal details is a lasting customer-experience lesson: being able to send a message is not the same as having a good reason—or the appropriate permission—to send it.

Why a national opt-out system matters

The scale of unwanted communication helps explain the initiative. The NCC cited Truecaller’s 2026 South Africa Spam Report, which estimated 17.47 billion spam calls received in South Africa during January–June 2026, a 25.2% rise compared with the same period of 2025. That is an industry estimate quoted by the regulator, not an independently audited count of every call. Even so, the issue is familiar to almost any customer who has repeatedly been contacted about something they never asked to hear about.

For responsible marketers, the answer is not simply to send fewer messages. It is to understand who wants to receive which messages, keep the record accurate, and make opting out straightforward. A useful marketing contact is a relationship, not merely a row in a spreadsheet.

What has actually changed—and when?

The NCC has outlined a staged implementation, rather than a single date on which every process becomes mandatory or available.

Registration phase: The system opened for direct marketer registration on 15 September 2026, with the registration period running through December 2026 according to the NCC’s October announcement.
Preparation and cleansing phase: From December 2026 to April 2027, the NCC says direct marketers can practise cleansing their marketing lists at no cost during the transition, helping businesses prepare for integrations and suppression checks.
Consumer blocking phase: From May 2027, the NCC plans for registered consumers to be able to record pre-emptive marketing blocks. Businesses should monitor official guidance for operational details.
Ongoing requirements: The NCC says direct marketers must register and cleanse their lists monthly before direct marketing campaigns, under the applicable framework.

The practical implication in November 2026 is preparation: identify marketing lists, understand the registration process, document consent and objections, and monitor the NCC’s published guidance. The NCC’s explanation of the amended regulations is a useful starting point, alongside the government’s launch statement.

The registry and POPIA are not the same thing

South African businesses must distinguish between the Consumer Protection Act’s opt-out framework and the Protection of Personal Information Act (POPIA). POPIA’s section 69 regulates unsolicited electronic direct marketing and generally requires consent unless a relevant existing-customer exception applies. The Consumer Protection Act provides separate rights relating to unwanted direct marketing and the registry.

An unsubscribe or objection is not a blanket retroactive permission to continue contacting a person. Likewise, the existence of a customer record does not automatically establish that every promotional message across email, SMS, messaging applications and telephone channels is permitted. The precise treatment depends on the circumstances, communication channel and applicable law.

The Information Regulator and the NCC are the appropriate primary sources for authoritative updates. Businesses with specific compliance obligations should obtain legal guidance rather than relying on a marketing article as a legal opinion.

The hidden CRM problem: fragmented preferences

Consider a hypothetical South African retailer. Its website contact form adds enquiries to a spreadsheet; an email platform holds the newsletter subscribers; a separate CRM manages leads; and a customer-service team follows up through messaging. A customer clicks ‘unsubscribe’ in an email, but a manually imported CSV still contains their details. A later campaign is launched from a different system.

No employee necessarily intended to disregard the customer’s choice. The failure happened because the systems did not share a reliable, current communication-preference record.

The same fragmentation can cause the opposite problem: a customer who willingly signed up for product updates may miss a relevant message because records were imported without their consent history. Data quality is therefore both a protection issue and a customer-experience issue.

A practical six-step communication-preference workflow

A workable process should be understandable to marketing, service, sales and IT teams—not hidden in one person’s knowledge of a particular platform.

1. Collect: Ask clearly what type of communication a person is agreeing to. Separate marketing choices from necessary order or service updates.
2. Record: Keep the source, date, channel, wording and scope of consent where relevant. Avoid treating an unlabelled checkbox as sufficient evidence.
3. Synchronise: Determine which system is the authoritative source for marketing preferences and how connected tools receive updates.
4. Verify: Before a campaign, check eligibility and applicable suppression requirements, including registry cleansing when the relevant processes apply.
5. Respect: Process opt-outs promptly, stop disallowed communications and distinguish marketing from legitimate operational notifications.
6. Review: Test the workflow, keep useful audit records and revisit how it behaves when a customer changes their preferences.

Conceptual workflow connecting permission collection, preference records, suppression checks and respectful customer messages. — A consent process is only reliable when the customer’s preference follows the record through every relevant system.

What should South African businesses audit now?

A simple readiness review can surface weaknesses well before a campaign. Start with a real journey: a person signs up, receives a message, changes a preference and later asks to stop all promotional contact. Can the team demonstrate exactly what happens at each step?

List your data sources. Include website forms, customer databases, CRM records, email platforms, spreadsheets, messaging tools and external agencies.
Identify a preference owner. Assign responsibility for maintaining suppression lists and resolving contradictory records.
Map channels. A choice about a newsletter is not necessarily a choice about SMS, WhatsApp or telemarketing.
Inspect old contact imports. Look for records without known acquisition sources or permission history.
Test unsubscribe handling. Verify that a preference change reaches each platform used for marketing.
Review vendors. Ask what external marketing or lead-generation partners do when contacts opt out.
Prepare for NCC requirements. Check registration and cleansing guidance against the current official timetable.
Keep a clear escalation path. Customer complaints and unclear consent records should be reviewed, not ignored.

How to measure better communication without guessing

Permission-based communication is not automatically more profitable, and the new registry does not guarantee better conversion rates. But a business can measure whether its processes are becoming more reliable. Useful internal indicators include the percentage of records with a known consent source, the time taken to honour an unsubscribe, the number of suppressed contacts accidentally re-imported, complaint frequency and deliverability trends.

Campaign teams can also monitor engagement, conversions and retention among appropriately opted-in audiences. The value lies in comparing the right groups over time and avoiding causal claims that cannot be supported.

This connects to a broader point from our guide to turning customer data into better experiences: the quality of an organisation’s customer relationships depends on how accurately information is maintained and how consistently teams act on it.

The better question is not ‘How many contacts do we have?’

It is ‘How confident are we that our contact records reflect what people actually want?’ That shift matters for marketing operations, compliance planning and brand trust.

South Africa’s National Opt-Out Registry should prompt teams to build clearer consent collection, accurate cross-channel preference records and reliable suppression processes. Businesses do not need to wait until the final rollout phase to improve those fundamentals.

Editorial note: This article is general information as at 3 November 2026, not legal advice. Regulations, draft guidelines and implementation procedures may evolve. Confirm requirements directly with the NCC and qualified advisers before making compliance decisions.