PRETORIA, Thursday 8 October 2026 — South Africa’s Information Regulator has warned political parties that they must obtain voters’ personal information lawfully and cannot purchase contact databases or share voters’ details with third parties for political targeting without the required consent.
Information Regulator chairperson Pansy Tlakula issued the warning during Wednesday’s launch of the National Opt-Out Registry.
The clarification comes less than a month before the 4 November local government elections, when political parties are intensifying their direct communication with voters.
Tlakula said political campaigning remained subject to the Protection of Personal Information Act, commonly known as POPIA.
Political parties must obtain voter information lawfully
The Information Regulator said political parties could communicate with voters as part of legitimate election campaigns.
However, the parties must comply with the legal requirements governing the collection, processing and sharing of personal information.
Tlakula warned against purchasing voters’ telephone numbers or other contact details.
She also said parties could not share lawfully obtained voter information with third parties for micro-targeting or polling purposes without the required consent.
The warning places renewed attention on how parties build and use databases for WhatsApp messages, telephone campaigns and other direct voter engagement.
Election campaigning differs from commercial marketing
The issue arose during the launch of the National Opt-Out Registry by Trade, Industry and Competition Minister Parks Tau.
National Consumer Commissioner Hardin Ratshisusu explained that ordinary political campaigning would generally not be treated as direct marketing under the Consumer Protection Act.
However, he indicated that the position could differ where political parties solicit donations or undertake activities that qualify as direct marketing.
Political parties conducting activities covered by the direct marketing regulations may therefore have additional obligations.
Tlakula emphasised that the distinction did not exempt political parties from POPIA.
Regulator raises concerns about personal data
The Information Regulator said the lawful collection and protection of personal information remained essential during political campaigns.
Tlakula also disclosed that the regulator had received approximately 3,000 data-breach notifications since the beginning of the year.
The figure relates to broader personal-information protection concerns and does not establish that political parties were responsible for those breaches.
The regulator’s warning comes as parties increasingly rely on digital communication, targeted advertising and messaging platforms to reach voters.
Political parties will be expected to ensure that their campaign databases and voter communication practices comply with the applicable privacy legislation.
The clarification provides guidance ahead of election day but does not establish that any particular political party has breached POPIA.
