AI customer calls: POPIA & CPA rules in SA

AI voice agents can now phone your customers to remind them of appointments, tell them about specials or follow up on quotes. That is useful – but in South Africa, calling people is regulated. Two laws matter most: the Protection of Personal Information Act (POPIA) and the Consumer Protection Act (CPA) with its regulations. The rules apply whether a person or an automated system makes the call.

This guide explains the main points in plain English so you can plan your calling properly. It is not a substitute for advice on your specific situation.

Direct marketing under POPIA section 69

POPIA section 69 deals with direct marketing by electronic communication. The basic rule is that you need a person's consent before you market to them, unless they are already your customer.

For people who are not your customers, you need their opt-in. That means they agreed to be contacted for marketing, and you can show when and how they agreed. Bought or scraped lists do not meet this standard.

For existing customers, the position is different. You may contact a customer about your own similar products or services, provided you got their details in the context of a sale and you give them a chance to opt out. That chance must be offered every time you contact them – not only once.

• Non-customers: get and record their opt-in first.
• Existing customers: contact them only about similar products or services you offer.
• Every call: give a clear, easy way to opt out, and honour it.

The national opt-out registry

Under the CPA regulations in force since April 2026, people can register a block against direct marketing in a national opt-out registry. If a person has registered, you must not send them direct marketing that the block covers.

In practice, this means checking your call lists against the registry before a campaign and keeping your own internal opt-out list too. If someone opts out on a call, remove them from future marketing lists straight away.

Permitted calling hours

The CPA regulations limit when you may contact consumers for direct marketing. The permitted times are:

• Monday to Friday: not before 08:00 and not after 20:00.
• Saturday: only between 09:00 and 13:00.
• Sundays and public holidays: no direct marketing calls.

An automated system makes it easy to call outside these hours by mistake – for example when a list is uploaded late in the day. A good AI calling service should enforce these windows automatically, so calls queue until the next permitted time instead of going out.

Say who is calling

Every marketing call should make it clear who is calling and on whose behalf. The person should know the name of your business, why you are calling and how to contact you. Hiding the caller's identity, or pretending to be someone else, is not allowed.

Recording notices

If you record calls, tell the person at the start of the call. Recordings and transcripts contain personal information, so POPIA's rules on security and retention apply: keep them only as long as you need them, protect them properly and delete them when you no longer need them.

Disclose that it's an automated assistant

People are entitled to know whether they are speaking to a person or a machine. The safest and most honest approach is for the AI agent to say, at the start of every call, that it is an automated assistant – and to offer to pass the caller to a person on request. This builds trust and avoids complaints.

Who is responsible?

Under POPIA, your business is usually the responsible party for your customers' information. A provider that makes calls for you acts as your operator and must follow your instructions and keep the information secure. You remain responsible for having a lawful basis to contact the people on your list. Put this in writing in your agreement with the provider.

A simple checklist before you start

• Do you have consent or an existing-customer relationship for every person on the list?
• Have you checked the list against the national opt-out registry and your own opt-out list?
• Is the calling schedule limited to the permitted hours, with no Sundays or public holidays?
• Does the script say who is calling, that the call is recorded and that it's an automated assistant?
• Is there an opt-out offer on every call, and a process to record opt-outs?
• Do you know how long recordings are kept, and who can access them?

How WorkForge Voice handles this

WorkForge Voice agents identify themselves as automated assistants, tell every caller the call is recorded, offer a person on request and give an opt-out on outbound calls. Outbound calls run only Monday to Friday 08:00–20:00 and Saturday 09:00–13:00, never on Sundays or public holidays. Opt-outs are honoured and reported back to you, and recordings are kept for up to 12 months.

If you are planning a calling campaign, we're happy to talk through your lists and script before anything goes live.