Cold email deliverability in South Africa starts with a legal question, not a technical one. POPIA section 69 bars unsolicited electronic direct marketing unless the recipient consented or is already a customer, and it covers companies too. Get that wrong and no authentication saves you, which is why this sits apart from the owned-list playbook in our email marketing South Africa guide. Below: what the law permits, the motion that works, the metrics.
Quick Answer
Cold email deliverability is decided by POPIA before DNS. Section 69 bars unsolicited electronic direct marketing to anyone who has not consented and is not an existing customer, and unlike Europe it protects juristic persons — so B2B is not exempt. The lawful motion is one approach, framed as a consent request, to a researched list. That constraint is a gift: low volume and high relevance are what earn inbox placement anyway.
Running outbound and unsure whether your SA list is legal? Worth an hour of someone's time.
Get a Free Outbound Compliance CheckCold Email Deliverability and POPIA Section 69: What the Law Permits
Most outbound advice online is written for American senders under CAN-SPAM, where unsolicited business messages are broadly permitted if you honour opt-outs. South Africa inverts that assumption, and importing the American playbook is how SA firms end up with an unlawful programme and a burnt domain.
Section 69 bars processing personal information for direct marketing by electronic communication unless one of two bases applies: the recipient consented, or they are an existing customer whose details you obtained during a sale of similar goods. Consent must be requested in the prescribed form, and you may approach a person only once to obtain it.
The Information Regulator's guidance notes reinforce this reading. The guidance itself is advisory, but the Act and its Regulations are binding and prevail over it.
Two details catch SA businesses out. POPIA protects juristic persons alongside natural ones, so "it is B2B" is not a defence the way it is under Europe's regime. And every message sent must identify the sender and provide a working way to object — with a do-not-contact register kept for anyone who refuses.
| Scenario | Section 69 Position | What It Means Practically |
|---|---|---|
| Prospect who opted in | Permitted | Market freely; honour objections immediately |
| Existing customer, similar offer | Permitted under 69(3) | Details must come from the sale itself |
| Scraped or bought list | Not permitted | No lawful basis; highest complaint risk |
| Single approach seeking consent | One approach only | The lawful entry point — use it well |
| Person who refused before | Not permitted | Register them; never approach again |
Growth Pulse Media is an agency, not a law firm, and this is a summary rather than legal advice — the Regulator's position on some points is contested and may yet be tested in court. Anyone running outbound at scale should take proper advice. But the direction of travel is not ambiguous, and the Regulator has already issued enforcement notices over ignored opt-outs.
Why the Compliant Motion Is Also the One That Lands
Here is what SA operators find counterintuitive about cold email deliverability: the legal constraint and the technical goal point the same way. Everything section 69 forces you to do is also what mailbox providers reward.
Volume is the enemy of both
Blasting 2,000 strangers a day is the fastest route to a spam-folder reputation and, locally, to an unlawful programme. One approach to a tightly-researched prospect is lawful and lands, because low volume from a clean domain with real replies looks exactly like normal business correspondence. The law pushes you toward the sending pattern that works.
Relevance is the whole engine
A single, well-researched approach earns a reply. A templated blast earns a complaint. Mailbox providers weigh complaints heavily, so the message written for one named person outperforms the one merged across a spreadsheet — on both the compliance test and the inbox test. Our subject line guide covers earning that open.
Replies are the signal that matters
An owned list builds sender reputation on opens and clicks accumulated over years. A first-touch approach has no such history, so replies do the work — a genuine human response is the strongest positive signal available. Optimise for conversation, not volume, and the reputation follows.
The Constraint-as-Advantage Insight
SA operators treat section 69 as a handicap on cold email deliverability that overseas competitors do not carry. It is closer to the opposite. The law forces low volume, real research, and relevance — exactly the behaviours that produce inbox placement and replies, and exactly what the spray-and-pray crowd will never do. A compliant programme sending 30 researched approaches a day beats a non-compliant one sending 2,000.
Want an outbound motion that is compliant and still fills the pipeline? We build both halves.
Get a Free Outbound BlueprintThe Technical Setup That Protects the Domain
Compliance settles whether you may send. The technical layer of cold email deliverability settles whether the message arrives. Both must hold, and this is where the owned-list playbook and outbound genuinely part company.
Never send from your primary domain. The single most important rule. Buy a lookalike domain, authenticate it fully, and send outbound from there. If reputation is damaged, your invoices, quotes, and client correspondence carry on landing from the untouched main domain.
Authenticate completely before the first send. SPF, DKIM, and DMARC on the sending domain, no exceptions. Google and Yahoo both tightened bulk-sender requirements in 2024, and an unauthenticated sender in 2026 is not a risk, it is a guarantee of the spam folder. Our general deliverability guide covers the DNS mechanics for your main domain in depth.
Warm the domain over weeks, not days. A brand-new domain sending fifty messages on day one looks exactly like a spammer, because that is what spammers do. Start at ten a day, climb gradually across three to four weeks, and let real replies accumulate. The ramp is not optional and cannot be rushed.
Keep complaint rates far below the threshold. Gmail treats user-reported spam above 0.1% as a problem and 0.3% as a hard ceiling. Outbound has no engagement history to cushion it, so a handful of complaints moves the number fast. Research quality is your complaint control.
The Separate-Domain Insight
The decision separating recoverable mistakes from catastrophic ones is sending outbound from a domain you can afford to lose. Damage on a lookalike domain costs a few hundred rand and a fresh warm-up. The same damage on your primary domain means client quotes land in spam and invoices go unseen for months while nobody connects the cause. Buy the second domain — cheapest insurance in the programme.
Before and After: What a Disciplined Programme Changes
The table below reflects the typical trajectory for an SA B2B firm moving from a bought list blasted off the main domain to a compliant, researched, single-approach motion over one quarter. Figures are indicative composites from SA benchmark ranges.
| Metric | Before (bought list, main domain) | After (researched, separate domain) |
|---|---|---|
| Daily send volume | 500-2,000 | 25-50, researched |
| Reply rate | 0.2-0.8% | 4-8% |
| Complaint rate | 0.3%+ (danger zone) | Under 0.05% |
| Primary domain reputation | At risk, sometimes burnt | Untouched and protected |
| Meetings booked per month | 2-4, expensively | 8-15, defensibly |
| Legal exposure | Real and unmanaged | Documented and defensible |
Writing the One Approach You Get
If the law permits a single approach, the craft question changes entirely. You are not writing a sequence that wears someone down over eight touches. You are writing one message that has to earn a reply on its own merits, from a stranger who owes you nothing.
Prove you did the work in the first line. Not "I came across your company" — something only someone who actually looked would know. A specific job posting, a recent expansion, a problem visible in how they operate. The opening line is the entire test: it either proves research or reveals a merge field.
Make the ask small and specific. "Worth a 15-minute call on Thursday?" beats "let me know if you'd like to explore synergies". A stranger will not commit to a vague process, but many will answer a precise question. Precision also reads as respect for their time, which is most of what a first approach is selling.
Keep it short enough to read on a phone. Under 120 words, no images, no tracking pixels, no attachments. Plain text from a real person outperforms designed templates here, partly because it reads as human and partly because the filters treat it that way. Everything that makes a newsletter attractive makes a first approach suspicious.
Say what happens if they say no. A line confirming you will not follow up unless they want you to is unusual, disarming, and — given the one-approach rule — simply true. Honesty about the constraint turns a legal limitation into a credibility signal.
Measurement and Reporting Discipline
Strong cold email deliverability programmes report on replies and meetings, never on volume sent. Track reply rate, positive reply rate, meetings booked, complaint rate, and bounce rate — plus the size of your do-not-contact register, a compliance artefact as much as a metric. Open rate is near worthless here: privacy protections made it unreliable, and a first-touch approach has no engagement baseline.
Bounce rate is the early warning nobody watches. Anything above 3% says the research or the data source is bad, and bad data is simultaneously a deliverability problem, a reply-rate problem, and a POPIA problem. Verify every address before sending; it costs cents and protects the domain you cannot easily replace.
Keep the consent and objection records as carefully as the pipeline numbers. Who was approached, when, on what basis, and what they said — because the onus sits on you to prove a lawful basis, not on the recipient to disprove it. The POPIA guide covers the record-keeping detail, and a spreadsheet you can produce on request is worth more than a confident memory.
The Growth Pulse Media Difference
Growth Pulse Media treats cold email deliverability as an operator discipline, not an account-management one. Dirk built and scaled a large SA business before founding the agency, and runs outbound in-house today — which means this playbook comes from sending real approaches to real SA prospects under the actual local rules, not from a US software vendor's blog written for a legal regime we do not have.
All work is done in-house with a deliberately limited client load. No offshore outsourcing, no junior hand-offs, and reporting built on replies and meetings booked — never messages sent, which measures effort rather than outcome.
If you would rather have this built properly, our managed inbox revenue service covers the full outbound system — lawful basis and consent records, separate authenticated domain, warm-up, researched targeting, and reporting on pipeline rather than volume.
Who This Is NOT For
An honest disqualifier list saves both sides time. Investing in cold email deliverability is the wrong move right now if any of the following describes you:
You want to blast a bought database. There is no lawful basis for it in South Africa, no technical trick that makes it land, and a regulator that has already issued enforcement notices. We will not build it, and nobody competent should.
You need 500 meetings next month. A compliant motion is deliberate and moderate in volume. If the number only works at spray-and-pray scale, the plan needs changing rather than the sending limits.
Nobody will do the research. The single approach only works if it is genuinely specific to the person receiving it. Without someone willing to read the prospect's world properly, you are just writing a slower blast.
Your offer has no clear buyer. Outbound amplifies clarity and exposes its absence. If you cannot name the exact role and the exact problem, no targeting or authentication rescues the campaign — fix the positioning first.
Not sure whether outbound or inbound suits your SA business? We'll give you a straight answer.
Request a Free Channel Fit ReviewFrequently Asked Questions
Is cold email legal in South Africa?
Only in narrow circumstances. POPIA section 69 prohibits unsolicited direct marketing by electronic communication unless the recipient has consented or is an existing customer whose details you obtained during a sale of similar goods. Consent must be requested in the prescribed form, and you may approach a person only once to obtain it. Unlike Europe, POPIA protects juristic persons too, so B2B is not exempt.
Does POPIA apply to B2B outreach?
Yes. This is where most SA firms get caught out, because international guidance assumes B2B sits outside the rules. POPIA protects juristic persons alongside natural persons, so approaching a company contact is regulated in the same way. The practical consequence is that "we only market to businesses" is not a defence, and your lawful basis must still be consent or the existing-customer exception.
How many outbound messages can I send per day?
Far fewer than the international playbooks suggest, and that is fine. Start at around ten a day from a freshly warmed domain and climb to roughly 25-50 researched approaches. Volume above that damages sender reputation, drives complaints past Gmail's 0.1% threshold, and in South Africa compounds an already narrow lawful basis. Reply rate matters; messages sent does not.
Should I use my main domain for outbound?
Never. Buy a lookalike domain, authenticate it with SPF, DKIM, and DMARC, warm it over three to four weeks, and send from there. If reputation is damaged you lose a cheap domain rather than the one carrying your invoices, quotes, and client correspondence. Firms that burn their primary domain typically lose months of normal business communication before anyone diagnoses the cause.
What reply rate should SA outbound achieve?
A researched, compliant motion commonly lands 4-8% replies, against 0.2-0.8% for a blasted bought list. Track positive replies and meetings booked rather than raw responses. Ignore open rate — privacy protections have made it unreliable, and a first-touch approach has no engagement history to benchmark against. Bounce rate above 3% means your data source is bad.
What records do I need to keep?
Who you approached, when, on what lawful basis, and what they said — plus a do-not-contact register of everyone who refused or objected. The onus sits on you to demonstrate a lawful basis, not on the recipient to disprove one, so a spreadsheet you can produce on request is worth more than a confident memory. Honour objections immediately and permanently.
Worried this reads as a reason not to run outbound at all? It is not — it is the reason the SA firms doing it properly have so little competition in the inbox.
Get Your Free Outbound Plan for Your SA Business
Growth Pulse Media builds outbound programmes for South African businesses — lawful basis and consent records that survive scrutiny, a separate authenticated domain warmed properly, researched targeting that earns replies, and reporting on meetings booked rather than messages sent. Built by an operator who runs this motion in-house under the actual local rules, not a US template.
No obligation — we will get back to you within 24 hours.
Request Your Free Outbound Plan →