COLD CALLING IS NOT BANNED: WHAT THE NEW NCC OPT-OUT REGISTRY MEANS FOR ESTATE AGENTS
What property practitioners may do, what their agency must control, and what changes between now and May 2027
J9Compliance | 12 October 2026 | Protect • Comply • Prosper
“Cold calling has been banned.” It is a striking headline, but it is not a sufficiently accurate explanation of South African law.
Estate agents can still market their services and build relationships with potential sellers, landlords, buyers and tenants. What they cannot do is assume that a telephone number found on a property website, an old client list or a public record gives them unrestricted permission to call or WhatsApp that person with a sales pitch.
The National Consumer Commission (NCC) has launched its new Opt-Out Registry. The important message for the property industry is not that prospecting has ended. It is that prospecting must be lawful, controlled and capable of being evidenced. And much of that control belongs with the estate agency, not with an individual practitioner acting alone.
WHAT HAS CHANGED – AND WHEN?
The Consumer Protection Act Amendment Regulations, 2026, published on 15 April 2026, introduced direct-marketer registration, annual renewal and monthly database-cleansing requirements linked to the NCC’s pre-emptive opt-out mechanism.
On 7 October 2026, the NCC announced a phased implementation timetable:
• 15 September to December 2026: registration of direct marketers;
• December 2026 to April 2027: a five-month opportunity for marketers to practise cleansing and prepare their databases, with no cleansing charge during this phase;
• from May 2027: consumer use of the registry’s pre-emptive blocking functionality, according to the NCC’s announced rollout.
These are operational rollout dates, not a postponement of existing privacy law. Direct marketers should use the registration phase now and prepare for cleansing; they must continue to observe consumers’ existing rights and POPIA requirements throughout the transition.
A further development is the NCC’s draft Guidelines for Compliance with Opt-Out Registry Regulations, published on 2 October 2026 for public comment. Comments are due by 17 October 2026. The document is draft guidance, not a final change to the law. Some of its interpretations, particularly the effect of a registered block on existing consent, are being debated.
TWO LEGAL GATES – NOT ONE
Gate 1: Consumer Protection Act and NCC controls.
The agency must determine who conducts and controls its direct marketing, assess applicable NCC registration requirements, maintain its own do-not-contact records and prepare to cleanse relevant marketing databases against the registry. When a consumer has registered an applicable block, that block must be respected.
Gate 2: POPIA authority for the person and the communication.
Section 69 of the Protection of Personal Information Act regulates direct marketing by unsolicited electronic communication. The starting position is consent, or the narrow statutory exception for certain existing customers. A number being absent from an opt-out database is not proof of consent.
Passing one gate does not automatically mean passing the other. The Information Regulator stated this expressly on 21 April 2026: POPIA applies whether or not a consumer has placed a pre-emptive block on the NCC registry.
DOES POPIA REALLY APPLY TO AN ORDINARY PHONE CALL?
Yes. The Information Regulator’s December 2024 Guidance Note lists telephone calls as direct marketing by unsolicited electronic communication under section 69. A call placed personally by an estate agent is not automatically exempt because it is not a robocall.
Section 69 permits a responsible party to approach a non-customer whose consent is required only once to REQUEST that consent, provided the person has not previously withheld it. The regulator says the consent request must use the prescribed Form 4 or a substantially similar method. If the request is made by telephone, the Form 4 information must be read out and the call recorded.
This is a narrow permission to ask for marketing consent, not permission to launch into a listing presentation and ask for consent at the end. If consent is refused, or no valid consent is obtained, the agent must not treat the person as available for future marketing calls.
FIVE PROPERTY-INDUSTRY SITUATIONS
1. “I found a homeowner’s number and want to ask if they are selling.”
That is usually unsolicited direct marketing. A publicly visible telephone number is not a marketing opt-in. The agency must assess the lawful source of the details, the permitted purpose and the possibility of a compliant, one-time consent request; it must not treat a cold sales pitch as freely permitted.
2. “A buyer enquired about a property on our website.”
The agency can generally respond to the genuine enquiry within its scope. But an enquiry about one property does not automatically authorise indefinite promotional messages about unrelated listings or services. Separate marketing requires its own lawful basis.
3. “They sold through our agency three years ago.”
An old client is not an unlimited marketing asset. The section 69(3) existing-customer exception applies only where all statutory conditions are met: contact details obtained in the context of a sale of a product or service, marketing of the responsible party’s own similar services, and a free, simple opportunity to object both when the details were collected and in every marketing communication. A name in an old CRM is not enough evidence on its own.
4. “I am sending the same listing to everyone on WhatsApp.”
A property promotion sent by WhatsApp, SMS or email is electronic direct marketing. Being in a contact list or neighbourhood group does not, by itself, establish individual marketing consent. Check the recipient, channel and purpose before sending, and provide a simple way to stop communications.
5. “I bought an owner database – or exported contacts from a portal.”
A paid list, public Deeds data or a scraped profile is not a substitute for lawful collection and marketing permission. The agency should quarantine the list until it has checked where the details came from, what people were told, the scope of any consent or other lawful basis, prior objections and the applicable NCC and POPIA controls.
WHAT ABOUT DOOR-KNOCKING AND LEAFLETS?
POPIA distinguishes unsolicited electronic marketing from non-electronic approaches such as in-person contact and hand-delivered mail. These may be assessed under POPIA’s general lawful-processing provisions rather than section 69’s electronic-marketing consent rule. They are not completely unregulated: consumer objections, relevant CPA requirements, lawful sourcing of personal information and respectful conduct still matter. The exact method should be reviewed before an agency launches a canvassing campaign.
WHAT MUST THE AGENCY HANDLE – AND WHAT MUST THE AGENT DO?
The agency or principal should establish the compliance operating model:
• identify the correct direct marketer and complete applicable NCC registration and renewal;
• approve how leads are obtained and which sources may enter the CRM;
• maintain consent records, source records and a central do-not-contact register;
• organise registry cleansing as each phase becomes available, and retain evidence of the checks;
• approve call scripts, WhatsApp templates, channels, operating hours and opt-out procedures;
• train practitioners and monitor whether those procedures work; and
• make sure lead-generation suppliers, franchise participants and marketing platforms follow the agreed controls.
The practitioner must use those approved controls: check the contact status, use the correct script and channel, identify the agency, document the outcome, honour a “no”, and never move suppressed contacts into a private phone list to try again.
There is a qualification. The regulations define a direct marketer by the activity undertaken. A practitioner who independently buys lists, chooses the purpose and means of marketing, or promotes a separate business may have obligations in their own right. A franchise logo or independent-contractor contract does not answer that question on its own. Agency and practitioner responsibilities must be documented according to how the marketing actually operates.
WHAT IF WE ALREADY HAVE CONSENT, BUT THE CONSUMER REGISTERS A BLOCK?
This is one of the nuances worth watching. The NCC’s October draft guidance takes a restrictive approach to the effect of a pre-emptive block, while commentators have identified tension between that interpretation and wording in the regulations concerning certain existing clients.
Until there is final clarity, J9Compliance recommends a conservative operational rule: where a relevant registered block is known, do not market to that person merely because an older consent record exists. Record the conflict and seek specialist advice for unusual cases. A direct objection or withdrawn consent should always be respected immediately.
CONTACT TIMES, IDENTIFICATION AND EVIDENCE
The CPA rules restrict direct marketing directed at consumers at home on Sundays and public holidays; on Saturdays before 09:00 or after 13:00; and on other days between 20:00 and 08:00, subject to the applicable consumer-agreement exceptions. The agency should adopt these as default campaign windows and not assume that an unsolicited WhatsApp at midnight is harmless.
Marketing communications must identify the sender and give usable details through which the recipient can ask for marketing to stop. The 2026 regulations additionally require the name, electronic address, physical address and contact number of the direct marketer to be identifiable to recipients of electronic communications.
The agency should retain evidence of the data source, permission, consent request, communication channel, campaign approval, suppression check, contact outcome and any opt-out. The point is not to generate paperwork for its own sake; it is to be able to demonstrate that the agency respected a person’s choice.
WHAT SHOULD PRINCIPALS DO NOW?
Start with seven controls:
1. Appoint a responsible owner for direct-marketing compliance.
2. Review the NCC registration process and record who must register for the business.
3. Inventory the CRM, personal agent lists, portal exports, purchased databases and third-party lead sources.
4. Separate genuine enquiries, verified customer relationships, consented leads and unverified prospects.
5. Put one central suppression and opt-out process in place across branches, agents and suppliers.
6. Approve one-time consent-request scripts, proper consent records, and clearly identified marketing messages.
7. Prepare the monthly cleansing process for the announced rollout, train practitioners, and keep review evidence.
Do not wait until May 2027 to examine a database that is already being used today. Equally, do not describe the announced phasing as though every consumer-blocking and cleansing function is fully operational in October 2026.
CAN THE RISKS BE SIGNIFICANT?
Yes. The NCC has warned that CPA non-compliance can result in enforcement and administrative penalties up to R1 million or 10% of annual turnover, whichever is greater, depending on the statutory process and findings. That is a potential upper limit, not an automatic fine for each unwanted call. POPIA carries separate enforcement and complaint consequences.
The better response is neither panic nor silence. It is to build a compliant prospecting process.
THE J9COMPLIANCE POSITION
Estate agents should still be able to grow their businesses, build relationships and provide a valuable property service. But “I have the number” is no longer an adequate prospecting policy – and it was never a sound privacy control.
The principal’s responsibility is to give practitioners a safe, practical operating framework. The practitioner’s responsibility is to use it. When source, permission, marketing purpose, channel and opt-out evidence are clear, prospecting becomes more professional and less risky.
J9Compliance helps agencies move from document compliance to operating compliance. Our MYJ9 Direct Marketing & Cold Calling Control Guide provides agency-level checks, a practitioner quick guide and evidence-register templates.
Contact: compliance@j9web.co.za | WhatsApp 074 233 9492
Learn more: https://j9web.co.za/compliance/
SOURCES AND REGULATORY REFERENCES
1. NCC, “NCC launches the national Opt-Out Registry to curb unwanted direct marketing”, 7 October 2026: https://thencc.org.za/ncc-launches-the-national-opt-out-registry-to-curb-unwanted-direct-marketing/
2. Consumer Protection Act Amendment Regulations, 2026, Government Notice R.7380, Gazette 54521, 15 April 2026: https://lawlibrary.org.za/akn/za/act/gn/2026/r7380/eng%402026-04-15
3. Information Regulator, Guidance Note on Direct Marketing in terms of POPIA (3 December 2024): https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf
4. Information Regulator, media statement on CPA Amendment Regulations, 21 April 2026: https://inforegulator.org.za/wp-content/uploads/2026/04/MEDIA-STATEMENT-REGULATOR-NOTES-PUBLISHED-GAZETTE-OF-THE-CONSUMER-PROTECT-ACT-AMENDMENT-REGULATIONS-2026.pdf
5. NCC draft Guidelines for Compliance with Opt-Out Registry Regulations, Gazette 55465, Notice 7981, 2 October 2026; public comment context: https://www.hsfkramer.com/notes/crt/2026-10/draft-opt-out-registry-guidelines-for-direct-marketing-in-south-africa
EDITORIAL NOTE
Regulatory position checked on 12 October 2026. The draft NCC guidelines and announced implementation phases may change. This article is general compliance information, not legal advice. Obtain legal advice where contractual arrangements, customer exceptions or contested provisions require interpretation.
J9Compliance | Protect. Comply. Prosper.
This article provides general compliance information and does not constitute legal advice, PPRA certification or a regulatory determination. Agencies and practitioners should confirm the application of the PPRA requirements to their individual circumstances.
Get Your Compliance Sorted
The recent sanctions are not isolated incidents – they represent an enforcement programme that is rapidly expanding. Being FICA compliant requires an operational, fully documented programme that your staff understands and applies daily.
If your agency’s Risk Management and Compliance Programme isn’t up to standard, don’t wait for the FIC to find the gaps.