POPIA

Definition

POPIA is South Africa's Protection of Personal Information Act 4 of 2013, fully enforceable since 1 July 2021 after a one-year compliance period. It sets eight conditions for lawful processing (accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data subject participation), establishes the Information Regulator as supervisory authority and requires every responsible party to register an Information Officer. Section 69 deals specifically with direct marketing by unsolicited electronic communications: it is prohibited unless the data subject has consented, or is an existing customer whose details were obtained in the context of a sale, for similar products, with a chance to opt out at collection and in every message. The Act also protects juristic persons.

What you need to know

For a brokerage the first question is which messages count as direct marketing. A premium-reminder, a request for a claim document or a renewal notice on an existing policy is servicing, governed by the general conditions of the Act. An offer of funeral cover, a retirement annuity or an add-on the client does not hold is direct marketing under section 69, and the brokerage needs either recorded consent or the existing-customer exemption, which only covers similar products.

The Information Regulator's enforcement has focused on unsolicited marketing, so the brokerage should be able to show, for each recipient, when and how opt-in was obtained and when any opt-out was recorded. A broker CRM that stores the WhatsApp opt-in flag and the marketing opt-out separately, and excludes opted-out clients from every campaign automatically, turns that into an ordinary control.

POPIA also interacts with FAIS record-keeping: advice given on WhatsApp must be retained for at least five years under the General Code of Conduct, so the firm needs a retention policy that satisfies both regimes. Read what a broker may send a client under POPIA for a message-by-message breakdown, and the compliance hub for related rules.

Concrete example

A Durban brokerage wants to offer gap cover to clients who hold medical-scheme advice with the firm. The compliance officer treats it as a similar product under the existing-customer exemption, checks that every recipient had an opt-out opportunity at onboarding, and adds "Reply STOP to opt out" to the template. Clients who reply STOP are flagged marketing opt-out in the CRM and still receive servicing messages about their existing cover.