The National Opt-Out Registry Is a Data Problem Before It Is a Marketing Problem

The National Consumer Commission has launched the National Opt-Out Registry, a free way for South Africans to block unwanted direct marketing, and anyone who calls, SMSes or messages people to sell them something must register and, from December, clean their list against it. For most South African businesses I think the registry is a data problem first, and many will learn that the first time they try to clean their list.

What does the national opt-out registry ask of a business?

The national opt-out registry obliges every direct marketer to register on the system and cleanse its contact list against it every month before running any campaign. Registration for marketers opened on 15 September 2026 and runs until December. Free list cleansing runs from December to April 2027, and consumers can already register blocks, though marketers only have to act on them once cleansing starts. According to TechCentral, Minister Parks Tau says the NCC will enforce it in full from 15 April 2027. The NCC says penalties go up to R1-million or 10% of annual turnover, whichever is greater.

The NCC cites Truecaller's 2026 South Africa Spam Report, which counted 17.47 billion spam calls to South Africans between January and June 2026, up 25.2% on the same period in 2025. Scam calls are in that total, so not all of it is direct marketing.

TechCentral reports that the NCC's draft compliance guidelines say historical or existing consent is invalid once a consumer registers a pre-emptive block. The draft is open for comment until 17 October and is not binding. Tau said the rule covers consent buried in old contracts' fine print.

Why is consent a database problem?

Consent is only useful to you if your own system can show who agreed, to what, and on which channel. That means consent has to be a field in your database, attached to a real person and a stated purpose. If your contacts live in spreadsheets, a WhatsApp group and an old CRM export, you cannot clean that list every month or prove anything about it. We wrote about deciding this before the data model exists in loyalty programmes that collect personal data under POPIA.

When we built a sports prediction and prize platform, we designed the data model so that consent was part of the record from the entry flow onward. The web app and a native WhatsApp flow both write to one PostgreSQL database that the client owns and can query directly. Entry has a mandatory POPIA consent step, and the profile stores it. The WhatsApp number is kept for one stated purpose only, winner notifications, and a user who skips giving a number just checks the leaderboard on the site. For the optional credit check, the credit bureau's own API refuses a lookup that does not carry an explicit consent flag, and support staff cannot read the credit data it returns at all. None of this was built for the registry. It just means the answer to "who agreed to what" sits in one place.

Retrofitting consent costs far more than designing it in, so it is one of the first things we pin down in any custom software development project that stores customer contacts.

What should you do before December?

Start by finding where your contact data actually lives, including the lists on staff phones. Then check that each record shows the consent behind it. Last, ask whether you could export that list and clean it every month without a week of manual work. If not, that is your project for the next two months, and it starts with how your lead generation captures people in the first place.

Know where the line sits. TechCentral notes that calls about an existing account, a delivery or a complaint are not affected, but a sales pitch added to a service call counts as direct marketing. Check the specifics with your attorney.

The registry will not hurt businesses that know their own data. It will hurt the ones whose customer list is a folder of exports nobody owns, and the first monthly clean will show it.