Servicing a policy and marketing a new one are not the same under POPIA section 69. A practical guide for South African brokers messaging clients on WhatsApp.
Ask a compliance officer whether the brokerage may WhatsApp its clients and you will usually get a nervous "it depends". That is the right answer, but it is not a useful one. Under the Protection of Personal Information Act, the answer turns on a single distinction: is this message servicing a policy the client already holds, or is it marketing something they do not? Get that distinction straight and most of the day-to-day questions answer themselves.
Nothing in POPIA stops a broker from contacting a client about the client's own policy. Telling someone their debit order failed, sending a renewal schedule, confirming a claim reference or asking for an outstanding document is processing personal information to perform the mandate the client gave you. It has a lawful basis, it is expected by the client, and the Policyholder Protection Rules positively require the brokerage to communicate clearly with policyholders.
Marketing is different. Offering funeral cover to a motor-only client, promoting a new short-term product or running a campaign across the book is direct marketing, and direct marketing by electronic communication is the specific subject of section 69 of POPIA. WhatsApp is an electronic communication. So is SMS, so is email, and the Information Regulator has confirmed that telephone calls fall in the same category.
Section 69 does not ban marketing. It sets out two routes, and a set of conditions that apply either way.
| Route | What it requires | Typical brokerage case |
|---|---|---|
| Consent | Prior consent from the person, voluntary, specific and informed. You may approach someone once to request it; if they refuse, that is final. | A prospect who filled in a web form but has not bought anything. |
| Existing customer | Contact details obtained in the context of a sale, marketing limited to the brokerage's own similar products or services, and a reasonable opportunity to object — both when the details were collected and in every message. | An existing motor client offered household cover by the same brokerage. |
| Both routes | The sender must be identified and the message must give an address or route to opt out. | Every marketing template the brokerage sends. |
The Information Regulator's Guidance Note on Direct Marketing, issued in December 2024, tightened how these conditions are read — particularly the requirement that the objection route be offered with each communication and honoured across the business. Two consequences matter for a brokerage. First, "similar products or services" is narrower than "anything we are licensed to sell". Second, an opt-out captured by one representative must stop messages from all of them, which is only realistic when preferences live on a shared client record rather than in individual phones.
| Message | Servicing or marketing | What you need |
|---|---|---|
| Your premium collection failed | Servicing | Mandate to service the policy; clear, plain language |
| Renewal terms for your policy | Servicing | Same. Keep the upsell out of this message. |
| Documents needed for your claim | Servicing | Same. Mind what the client sends back (see below). |
| We now also do funeral cover | Marketing | Consent, or the existing-customer route with an objection option |
| Campaign to a purchased lead list | Marketing | Consent, which a purchased list almost never gives you |
| Referral request to a client's contacts | Marketing to a third party | You have no basis to message a person who never gave you their details |
Brokerages often assume that because WhatsApp required an opt-in, POPIA is satisfied. It is not. Meta's opt-in is a platform rule about who a business may send templates to. POPIA consent is a legal standard about a specific purpose. A client who agreed to receive policy documents on WhatsApp has not thereby consented to a product campaign. In practice the brokerage needs one consent record with a purpose attached to it — service messages, marketing messages, or both — and the ability to show which applied at the time a given message was sent. Our setup guide for a brokerage WhatsApp number covers where in the onboarding flow to capture it.
WhatsApp threads accumulate more personal information than most brokerages realise: identity documents, bank letters, medical notes attached to a claim, photographs of an accident scene with third parties in them. POPIA's conditions apply to all of it. Three habits keep this manageable:
Compliance here is mostly an evidence problem. When the Information Regulator, the FSCA or an unhappy client asks, the brokerage needs to show what was sent, to whom, by which representative, on what basis, and what the client's stated preference was at the time. That is a record-keeping question before it is a legal one, and it is the reason personal handsets fail: the evidence walks out with the person. A shared inbox tied to client records keeps the consent status, the message history and the opt-out in the same place — and the same structure serves the FAIS record-keeping obligations that already apply to advice.
Servicing communication about a policy the client holds is not direct marketing under section 69, so the consent regime for marketing does not apply. You still need a lawful basis for processing under POPIA and, separately, the client must have opted in for WhatsApp's business platform to deliver your message.
Possibly, via the existing-customer route in section 69, provided you obtained their details in the context of a sale, the product is a similar one of your own, and you gave them a reasonable opportunity to object when you collected the details and again in the message itself. Anything outside that needs consent.
Stop processing their information for direct marketing, record the objection immediately, and make sure the record is visible to every person who could message them. Keep a suppression record so a future campaign cannot reinstate them.
Treat it as unusable for electronic direct marketing. Consent under POPIA must be specific and informed, and consent given to a list vendor is not consent given to your brokerage. It also damages your number's quality rating faster than anything else.
No. Kenya's Data Protection Act and Nigeria's Data Protection Act create their own regimes, supervised by their own authorities, with different rules on consent and direct marketing. A brokerage operating across borders should map each country's requirements rather than exporting a South African policy.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
A representative leaves under a cloud. Section 14 of the FAIS Act tells a brokerage what to do, in what order, and inside which deadlines to notify the FSCA.
What the FAIS General Code of Conduct requires of an FSP advising clients on WhatsApp: the five-year rule, electronic records, FSCA inspections and the Ombud.
NIC licensing, the Data Protection Act 2012 and MTN MoMo: how Ghanaian insurance brokers run compliant WhatsApp conversations and collect premiums.
