Course overview

This course examines the application of the Protection of Personal Information Act 4 of 2013 (POPIA) to marketing activities in South Africa. It distinguishes between direct and indirect, electronic and non-electronic marketing, while integrating insights from the Information Regulator's December 2024 guidance note and April 2025 amendments. Participants will explore lawful processing conditions, consent mechanisms, opt-out procedures, exceptions, and data subject rights, equipping them with practical knowledge for ethical and compliant marketing strategies.

Course objectives

Participants will obtain an understanding of:

1. Define Key Concepts: Articulate POPIA's purpose, definitions of marketing categories, and foundational principles like processing limitation and openness.
2. Identify Prohibitions and Lawful Bases: Recognize restrictions on marketing and apply bases such as consent, legitimate interests, and contractual necessity.
3. Manage Consent and Opt-Outs: Implement procedures for obtaining explicit consent and handling objections, including 2025 updates for SMS/WhatsApp.
4. Navigate Exceptions: Understand exemptions for certain marketing activities and their practical implications.
5. Ensure Compliance Responsibilities: Fulfill obligations for transparency, documentation, and security in marketing operations.
6. Uphold Data Subject Rights: Apply the 11 rights under Section 5, linking them to marketing scenarios.

Course outline

Participants will learn about:

Module 1: POPIA Fundamentals

Act's Purpose: Safeguarding privacy while balancing business needs.
Marketing Definitions: Direct vs. indirect, electronic vs. non-electronic.

Module 2: Lawful Processing and Prohibitions

Eight Conditions: Focus on purpose specification, openness, and direct marketing (Section 69).
Prohibitions: Restrictions on unsolicited communications and data misuse.

Module 3: Consent and Opt-Out Mechanisms

Explicit Consent: Requirements, withdrawal, and 2025 amendments (SMS/WhatsApp, updated forms).
Opt-Out Procedures: Handling objections and ceasing marketing activities.

Module 4: Lawful Bases and Exceptions

Bases for Processing: Consent, legitimate interests, and contractual necessity.
Exceptions: Scenarios exempt from standard rules, with practical examples.

Module 5: Compliance Responsibilities

Regulator Guidance: Insights from 2024 note on direct marketing.
Documentation and Security: Maintaining records and ensuring ethical data handling.

Module 6: Data Subject Rights in Marketing

Data Subject Rights: Notification, access, objection, deletion, and refusal of marketing.
Practical Implications: Linking rights to marketing scenarios and empowerment.