POPIA and loyalty marketing: what permission should your business record?

A customer wants a loyalty card. Your business wants to send promotions. Make the relationship between those two actions clear before the first message leaves the system.

South African businesses should apply current POPIA rules to the actual collection and communication process. A logo saying “POPIA compliant” cannot do that work for you.

Check your basis for marketing

The Information Regulator's April 2026 statement confirms two routes under section 69: consent, or the existing-customer exception where its conditions are met. Being absent from a pre-emptive opt-out register is not permission. A person who has not previously refused can be approached once to request consent in the prescribed way; that is not a licence to send repeated sales offers. ^[S11]

For the customer exception, contact details must have been obtained in the context of a sale, the marketing must concern the business's own similar products or services, and a free, uncomplicated opportunity to object must be provided at collection and with each marketing communication. The Regulator's guidance also includes push notifications among electronic methods. ^[S09]

Joining a scheme without a purchase does not establish that exception. Nor should installing a wallet pass be treated as proof of specific, informed marketing consent.

Keep a record that someone can explain

The 2025 amended regulations allow accessible methods of requesting consent and state that opting out does not constitute consent. They also require recording where consent is requested by telephone. ^[S10]

For a practical permission record, capture which business is named, the stated purpose, selected channels, the wording shown, the date and the customer's action. Have your Information Officer or adviser check that the process meets the applicable requirements. Keep loyalty-service notices distinguishable from promotional messages.

Imagine a hypothetical Ballito salon where a client agrees to email offers but declines SMS promotions. Staff should see and respect that choice. Moving the same sales pitch to another channel because the first one was declined is not a sensible workaround.

Test the exit as carefully as the signup

Send a test promotion to a staff account. Can the recipient identify the sender and find a working way to stop the messages? Does the objection prevent the next scheduled send? What happens to an already queued campaign or a list uploaded at another branch?

Assign somebody to check these steps and respond to privacy queries. Keep access proportionate to staff roles, decide how long records are needed and clarify the respective duties of your business and its service providers. Store only the data needed for the agreed purpose.

Futhi advertises messaging, segmentation and support for customer choice. ^[F02] Ask to see the actual controls, records and data-handling arrangements before launch. Then review the process with a qualified adviser for your circumstances. This article is operational guidance, not a finding that a particular programme complies with the law.

Customers should know what they joined and how to change their minds. Clear permission is part of a relationship worth keeping.