Direct marketing by means of unsolicited electronic communications
(1) The processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject— (a) has given his, her or its consent to the processing; or (b) is, subject to subsection (3), a customer of the responsible party.
(2) (a) A responsible party may approach a data subject— (i) whose consent is required in terms of subsection (1)(a); and (ii) who has not previously withheld such consent, only once in order to request the consent of that data subject. (b) The data subject's consent must be requested in the prescribed manner and form.
(3) A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)— (a) if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service; (b) for the purpose of direct marketing of the responsible party's own similar products or services; and (c) if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details— (i) at the time when the information was collected; and (ii) on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.
(4) Any communication for the purpose of direct marketing must contain— (a) details of the identity of the sender or the person on whose behalf the communication has been sent; and (b) an address or other contact details to which the recipient may send a request that such communications cease.
(5) ‘‘Automatic calling machine’’, for purposes of subsection (1), means a machine that is able to do automated calls without human intervention.
What this means for your estate
- Levy reminders, security notices, and AGM notifications are operational communications, not direct marketing, this section is about promotional content (clubhouse bookings, estate-run services, third-party offers), and the two get confused often enough to be worth distinguishing clearly in your own comms policy.
- Subsection (2)(a) sets a hard limit worth knowing: you may only ask a non-consenting resident for marketing consent once, repeated “would you like to opt in?” prompts after a first refusal are themselves a contravention.
- The existing-customer exception (subsection (3)) is narrow, it only covers marketing your own similar products/services to people who already have a relationship with you, and only if they were given a clear opt-out both at collection and on every subsequent message.
PopiGuard's communication tools separate operational notices from marketing sends, and track consent status so the single-ask rule in subsection (2)(a) isn't accidentally broken.
Sometimes, section 69(3) allows marketing an existing customer with the responsible party's own similar products or services, provided the contact details came from a prior sale and the customer was given a free, no-hassle chance to opt out, both at collection and on every subsequent marketing contact.
Once. Section 69(2)(a) allows only a single approach to request consent from someone who hasn't already withheld it, repeated unsolicited requests for consent are not permitted.