Form 4-get-it (Developments in the law relating to direct marketing)

By Dérick Swart, Mari Louw & Erin Botha on 8 March 2024

On the 27th of February 2024, the South African Information Regulator, established in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA"), issued its first enforcement notice in relation to unsolicited direct marketing.  The notice was announced in a media statement by the Regulator and sheds light on the Regulator's view of how POPIA is to be complied with in this context.

What does POPIA say about unsolicited direct marketing?

Direct marketing by means of unsolicited electronic communication is regulated by section 69, read with Regulation 6 of POPIA.  These provisions essentially provide that a non-customer may be approached once for consent to receive direct marketing, which consent must first be secured before such marketing may commence.

Section 69(2) of POPIA further provides that this consent must be requested and obtained "in the prescribed manner and form".  The word "prescribed" is defined in the definitions section as "prescribed by regulation or by a code of conduct".

Regulation 6 then proceeds that such consent must be sought and obtained on "Form 4".  Form 4 calls for the following:
  1. details of the person being approached;
  2. details of the person authorised to sign on behalf of the party making the request;
  3. an option as to how the person wants to receive direct communications; and
  4. the signature of both parties. 
Unsurprisingly, the market adopted a "substance over form" approach in an effort not to grind marketing to a halt.  There is room for this approach, as the definition of "form" in the regulations provides that a "substantially similar" form may also be used.

In the present case, the infringing party had according to the Regulator failed to secure consent in the required manner and was ordered to "…use the form prescribed by the Regulator for this purpose…" and further that "…[t]he use of this form is compulsory."

The Regulator's stance is that no consent to direct marketing to a non-customer is valid, unless the marketer can show a duly signed Form 4.  It is not clear what allowance the Regulator has or is willing to make for a "substance over form" approach.

What is the standing of the Regulator's enforcement notice?

The short answer is that it is not generally binding.  
As aforementioned, it does however evidence the Regulator's view and approach to compliance.   

What are the practical implications of this?

Electronic signatures

The Electronic Communications and Transaction Act, 2005, provides that whenever a law, which by implication includes a subordinate law, requires a "signature", that requirement can only be fulfilled when an advanced electronic signature ("AES") is used.

For those not familiar with it, an AES is a very special and specific types of electronic signature which only a select few people in South Africa have and even fewer internationally given that is a uniquely South African creation.

Since POPIA requires the consent on Form 4, and it in turn calls for the parties to sign the form, it would appear that unless the signatures to the form are applied in wet ink or by way of AES, a valid signature has not been applied.   

Website and application subscriptions

Where a website or application invites a person that is only browsing the website to subscribe to their newsletter – often in return for a discount on a future sale – that person is not yet a customer and so Form 4 will have to be used, and countersigned by both parties in a valid manner.

Brand activations 

Consumers have become accustomed to brand owners putting on brand activation activities where consumers are treated to promotional gifts, free services (such as internet access) and other entertainment.  These activities aim to endear consumers to a brand, and for the brand owners to be able to communicate with them after the first interaction.  Form 4 would apparently also have to be used in this context, and countersigned by both parties in a valid manner.  


An insistence on the strict use of Form 4 to somehow protect unsuspecting consumers would be unfortunate and cause practical issues for responsible digital marketers that may well be to the detriment of consumers in the end.  

Respectfully, the Regulator missed an opportunity to give common sense guidance based on "substance over form" here to avoid what some might call an absurd result.

We note that the Regulator is apparently working on guidelines on direct marketing, which we hope will address the issues raised here, and specifically use the leeway afforded by the legislation to put a practical approach in place.

Back to top

Please note that our blog posts are informal commentaries on developments in the law as at the time of publication and not legal advice. You should place no reliance on our blog posts; we look forward to discussing your particular matter with you.