The owner of a small solar-installation company is looking for new customers. A supplier offers him a list of 20,000 email addresses of homeowners in Gauteng for a modest fee. It seems like a bargain. He could send a promotional email this afternoon.
A few years ago, many small business owners would have gone ahead without much thought. The Protection of Personal Information Act, POPIA, has been fully in force since 2021, but for a long time it felt to many like a big-company concern, enforced mainly against government departments and large corporations.
That perception is becoming harder to sustain. In 2026, the Information Regulator, which enforces POPIA, has been sending increasingly clear signals that it is willing to act, including against smaller businesses, and particularly over unwanted direct marketing. For the solar installer, that bargain list may be a much riskier purchase than it looks.
One Like insight: A list of people who never agreed to hear from you is a liability dressed up as a marketing asset.
What the Regulator is signalling
At a media briefing on 31 August 2026, the Information Regulator gave its most detailed account yet of its enforcement work, marking ten years since it was established and five since POPIA’s enforcement provisions came into effect. A few points stood out.
The Regulator said it had received more than 3,800 complaints in the previous year, and that around 10% related to direct marketing. It has also received more than 8,000 notifications of security compromises, such as data breaches, since 2021, a rate it described as alarming. It confirmed its position that marketing phone calls count as electronic communication under POPIA, a view the direct-marketing industry disputes and that is now being tested in cases involving large companies.
Crucially for small businesses, enforcement has already reached beyond big organisations. A small consulting firm, FT Rams Consulting, received the Regulator’s first direct-marketing enforcement notice for sending persistent marketing emails without consent and ignoring opt-outs, and was later issued with a six-figure administrative fine. The Regulator has also said it wants legislative changes that would allow it to issue fines immediately, rather than first giving organisations a window to comply.
Amended POPIA regulations, which took effect in April 2025, had already tightened the rules on direct marketing, including clearer consent requirements for unsolicited electronic marketing and easier ways for people to object. Taken together, the direction is clear: POPIA compliance is moving from a paperwork exercise to something with real consequences.
Where small businesses are most exposed
Most small businesses aren’t deliberately misusing personal information. The risks tend to come from ordinary habits that felt harmless until recently.
Buying or borrowing contact lists. Sending marketing emails, SMSes or WhatsApp messages to people who haven’t agreed to receive them is precisely the kind of direct marketing the Regulator is focused on.
No easy way to opt out. Every marketing message should make it simple to stop receiving more, and those requests need to be honoured promptly. Ignoring opt-outs was central to the FT Rams case.
Marketing calls. If your business makes cold calls, the Regulator’s view is that the same consent rules apply. That position is still being tested, but it would be unwise to ignore it.
Unreported breaches. A lost laptop, a hacked email account or a misdirected spreadsheet containing customer details can all count as security compromises that must be reported.
No Information Officer registered. Every organisation covered by POPIA, including small businesses, has an Information Officer, usually the owner or head, who must be registered with the Regulator. It’s an easy step to miss and an easy one to fix.
[Infographic placement] Five POPIA risks for small businesses. Five simple icons in a row with short labels: Bought lists · No opt-out · Cold calls · Unreported breaches · Unregistered Information Officer. Beneath, one green line: Fix first: market only to people who’ve agreed, and make stopping easy. Caption: Information Regulator, August 2026: 3,800+ complaints in a year, about 10% about direct marketing.
A sensible response
None of this needs to be frightening or expensive. For most small businesses, a few habits cover the biggest risks. Market only to people who have agreed to hear from you, ideally by building your own list, as we explored in You Have 2,000 Followers. About 36 Saw Your Post. Keep a record of when and how each person gave consent. Put a clear unsubscribe option in every message and act on it quickly. Register your Information Officer. And agree, in advance, what you’ll do if customer data is lost or exposed.
If your business does a lot of marketing, handles sensitive information such as health or financial details, or works with large customer databases, it’s worth getting tailored advice from a POPIA specialist.
A few questions can help:
- Can we show when and how every person on our marketing list agreed to hear from us?
- Does every marketing message include an easy way to opt out, and do we honour it?
- Is our Information Officer registered with the Regulator?
- What would we do this week if a laptop with customer details went missing?
Which brings us back to the solar installer and his list of 20,000 homeowners. Sending to it might bring in a few leads. It might also bring complaints, an enforcement notice and a reputation for spam. A smaller list of people who actually asked to hear from him, built through his website, referrals and satisfied customers, would be slower to grow and far safer, and those people would be much more likely to buy.
Sources
- Werksmans Attorneys, “The Regulator is watching: New enforcement signals for POPIA and PAIA compliance”, via Polity, 1 September 2026. Summary of the Information Regulator’s media briefing of 31 August 2026.
- Moonstone, “Information Regulator sounds alarm over data breaches”, 2026 (8,000+ security compromise notifications; direct-marketing referrals).
- Bowmans, “South Africa: Data protection – recent developments and enforcement trends”, 17 March 2026, and MJK Inc POPIA enforcement tracker (FT Rams Consulting matter).
