The POPI Act and its impact on marketing a small business

by Lynette Dicey
Being a small business in this environment isn’t easy; the past 12 months have been extremely challenging for SMEs operating in the travel, hospitality, beauty and food and beverage sectors, among others. According to a recent survey by SME financier Retail Capital, 31.5% of small businesses are running at a loss, while 29.6% are only just breaking even. Not surprisingly, business owners are trying anything to generate new business, whether that’s going online with an ecommerce store, offering great deals and sales, or putting their marketing into overdrive.

How businesses market themselves will be impacted by the Protection of Personal Information Act (Popi Act) which comes into effect on July 1 this year.

“The act, which is finally being implemented after years of being in draft format, does not offer special treatment to small businesses that do not comply with its rules,” says Sián Fields, intellectual property and technology law consultant at Reynolds Attorneys, a boutique law firm in Cape Town. “Business owners need to understand how to procure and use personal information for marketing purposes in compliance with the Popi Act by June 30 – or risk contravening the act.”

This has implications for SMEs that need to reach new prospects to keep their business going. For starters, says Fields, the days of sending newsletters out to all and sundry in an effort to gain new customers are over. From July newsletters can’t be sent to anyone without their consent.

“This will need to take the form of express and explicit consent to receive electronic direct marketing, and someone following you on social media, or signing up for a competition online or in-store, would not qualify,” explains Fields.

Under the act marketers face the prospect of a cookie-less future as the protection of personal information becomes increasingly pertinent. A cookie – a text file that contains small pieces of data – is used to identify a consumer’s computer and is responsible for the deluge of online marketing that consumers experience daily. This invasive marketing will no longer be allowed without express consent, and consumers will need to give their permission when receiving marketing content.

“Marketing has to shape up and the old days of spamming people with unsolicited information will be well and truly over,” says Fields, adding that while this is a win for the consumer, it does make life harder for SMEs to generate new leads.

There are a number of best practices that businesses now need to factor into their marketing initiatives, she says, including asking whether the personal information being collected about people is really needed. Avoid asking consumers to login, register or provide personal details unless you need to use them. You can, however, request this if someone makes an enquiry or wants to do business with you.

Furthermore, SMEs must make their intentions of acquiring their information very clear, and explain why it is being collected and what it will be used for. Communicating this on your website is highly recommended.

Businesses are required by law to ensure their customers’ data is secure. Request IT support on how to encrypt information and only allow those staff who are trained to keep it secure and looked after to access it.

When using a third party, such as someone who manages the company newsletters, provide them with a written contract to sign to ensure that they, too, will keep your customers’ and prospects’ information safe at all times.

If you do use a customer’s information to send them marketing information such as a newsletter, be aware of the rules under the act. The information regulator publishes guidance notes for understanding provisions of the Popi Act from time to time and is expected to release one on marketing shortly. These can be accessed here.

Your website might be used by other brands to market their products or services. So while you are not legally responsible for this content, consumers may think otherwise. It’s wise to have proper procedures in place if a customer lays a complaint about a particular ad.

If you don’t need the information that has been collected, then securely get rid of it.

Consumers have a right to ask if any of their information is being used for marketing purposes. Ensure that all staff know how to deal with a “subject access request”. In a similar vein, make it easy for consumers to check the information you hold on them. Do so by allowing them to update or correct any of their records if they are outdated or wrong.

“Being a small business is not easy at the best of times, but this pandemic has seen many sectors lose many of their prospects as they themselves battle financially through these tough times. It may be tempting to market as much as possible, but in a few weeks’ time this will no longer be possible without consumers’ consent. SMEs must ensure that they are familiar with the Popi Act, train their staff where necessary and ensure that all personal information is safe and secure,” says Fields.

The big take out:

The days of spamming people with unsolicited information will be well and truly over once the Popi Act takes effect.

Useful resources:
The Red Zone
The Red Zone is a marketing and media website featuring breaking news from the industry as well as insightful opinion pieces and up to the minute event coverage.
Share on Twitter Share on LinkedIn Share on Facebook
Share via Email
©2022 SURREAL. All rights reserved.
Follow us on Twitter Follow us on LinkedIn Join us on Facebook