What You Need to Know ABout The NCC Opt-Out Registry

South Africa's National Consumer Commission (NCC) has set up a national Opt-Out Registry for electronic direct marketing, and unlike a lot of regulation that quietly gathers dust, this one comes with a real deadline, a real fee schedule, and real fines. If you send marketing emails, SMSs, WhatsApps, or make outbound calls to South African consumers, this affects you, whether you're POPIA-compliant already or not.

Here's what it is, what's actually due when, and what to do about it before the enforcement clock starts running.

So what is the Opt-Out Registry, exactly?

It's a central, government-run list that lets any South African consumer register a pre-emptive block against electronic direct marketing, before a marketer ever contacts them, not just after they're annoyed enough to unsubscribe.

A few things make it different from the "unsubscribe" links you already have:

• It's not just one on/off switch. Consumers can set a blanket block on all direct marketing, or get specific and block a particular marketer, an entire industry, a purpose, a time period, or a single channel (say, blocking SMS but allowing email).
• It overrides consent you already have. This is the part that catches marketers out. Even if someone gave you clean, POPIA-compliant opt-in consent last year, a registry block registered today cancels it. Fresh consent afterwards may not be enough either; the block generally needs to be formally withdrawn through the registry itself before you can market to that person again.
• It's the only opt-out that counts for enforcement. Your own suppression list, a third-party do-not-call service, WhatsApp's block feature; none of that satisfies the regulation. Only the NCC's registry does.

It sits alongside, not instead of, your existing obligations. The Consumer Protection Act (section 11(6)) is the legal basis for the registry itself, and POPIA (section 69) still governs the consent you need in the first place. You now have to get both right.

The deadline: 1 October 2026

• 1 July 2026: the registration portal opened at https://eservice.thencc.org.za/
• July – 30 September 2026: a transitional window where you can register and get your processes in order without facing enforcement action.
• October 2026 onwards: full enforcement. If you're marketing to South African consumers without being registered and cleansing your lists, you're now non-compliant.

That's a month away. If your database hasn't touched the registry yet, this is the "stop reading blog posts and go do the thing" section.

What direct marketers actually have to do

1. Register as a direct marketer

Every business registers once, using its CIPC number, via the NCC's eService portal. You'll nominate a responsible person inside your business to manage registration and the ongoing cleansing process. Registration costs R2,574 (2026 rate), with roughly R1,930.50 to renew annually.

2. Cleanse your database every single month

Before you launch a marketing send, you submit your contact list to the registry. It matches your list against registered blocks and returns the records you need to remove. This isn't optional or occasional; it's a monthly requirement, and it has to happen before the campaign goes out, not after.

3. Budget for cleansing fees

The registry charges R0.12 per record that needs to be actioned (i.e., removed or restricted), not per record submitted. For a large or fast-growing list, that's a real recurring line item, not a rounding error.

4. Get your sender ID right

Every marketing communication needs to clearly show who's sending it: business name, physical address, contact number, and electronic address. No more marketing from an unbranded shortcode or a "noreply@" address and hoping nobody asks.

What counts as "direct marketing" here?

The registry covers electronic communications: email, SMS, telephone calls, fax, and "wireless computer access" (read: push and similar). Traditional mail sits outside its scope, for now, this is entirely about the channels TouchBasePro clients live in.

And if you don't comply?

Administrative penalties run up to R1 million or 10% of annual turnover, whichever is greater, plus the possibility of criminal liability for serious or repeat breaches. Beyond the fine itself, an unregistered marketer simply isn't legally entitled to contact consumers for marketing purposes at all from 1 October.

Your pre-1-October checklist

• Register your business on the NCC eService portal using your CIPC number and nominate a responsible person internally.
• Set a recurring monthly reminder to cleanse every list month.
• Add registry cleansing fees (R0.12/record) to your campaign cost planning, not as an afterthought.
• Audit your email and SMS templates for proper sender identification.
• Stop treating existing opt-in consent as permanent; build a process to check for registry blocks even on your "warm" lists.
• Keep records: registration confirmation, monthly cleansing receipts, and your original consent trail. If the NCC ever asks, "we're pretty sure we're fine" isn't a defence.

This isn't legal advice, and this regulation is genuinely still settling. The NCC has already issued clarifications since the April regulations, and more guidance is likely before enforcement kicks in fully. If you're building or changing a large-scale direct marketing programme, it's worth a proper conversation with a lawyer who specialises in POPIA/CPA compliance.