Don't ban the handshake: why asking first beats a ban on approaching strangers

Every business that exists today began the same way: someone it did not know agreed to listen. The first customer of every supplier on your preferred-vendor list was once a stranger. Take away the right to make that first approach and you do not get a quieter market. You get a closed one.

That is the risk now facing South African business-to-business selling. The Information Regulator's view, set out in its 2024 statements and its Guidance Note on Direct Marketing, is that marketing by email, and even by live phone call, needs prior consent under section 69 of POPIA, and that companies are protected just as people are. In November 2025 the Regulator said it was looking for a test case to settle the point in court.

We agree with the Regulator about the problem. Unwanted calls and spam are a plague, and the businesses that change their numbers and call again after being asked to stop deserve every penalty they get. We disagree with treating a supplier writing once to a published procurement address as the same thing.

A published procurement desk is an open door

A company that publishes a procurement email, a supplier-registration page or the name of its buyer is not hiding. It is telling the market how to reach it. Procurement departments exist to meet suppliers, compare them and choose the best. Treating every first approach to them as an intrusion turns a front door into a wall.

The law already recognises this. POPIA lets information be collected from what a person or company has deliberately made public. And its very first purpose is not privacy at any cost. Section 2 says privacy must be protected subject to justifiable limits aimed at "balancing the right to privacy against other rights" and protecting "the free flow of information". The spirit of the Act is balance, not silence.

A ban protects the incumbents

Who wins if no supplier may approach a buyer it has not already met? The supplier already in the room. Large, established firms have existing contracts, account managers, golf days and twenty years of relationships. They never need to knock. The new company, the better product and the cheaper, smarter local alternative are the ones that need a first conversation.

That runs against everything else the country is trying to do. The Public Procurement Act, signed in July 2024, aims at transparency and broader economic participation in who supplies the state. Private buyers need the same thing: a steady supply of newcomers to test the incumbents against. A market that cannot meet new suppliers stops improving. Like any closed community that never meets strangers, it grows weaker with each generation.

The rest of the world asks, it doesn't ban

Strict privacy regimes elsewhere draw the line differently for business contacts. In the United Kingdom, for example, the electronic marketing rules allow emails to named people at company addresses without prior consent, provided every message identifies the sender and offers a working opt-out. The test is respect, not a ban.

POPIA already contains its own version of that balance. Section 69(2) allows a business to approach someone once to ask for consent. That single ask is the right answer: it lets a new supplier be heard, and lets the buyer say no for good.

What good looks like

This is how we work, and what we think every responsible business should do:

• A real reason. Approach a company only when there is a dated, public reason it may need you now: a tender won, a new site, a hiring drive.
• Published business details only. Never a guessed email, a personal cell number or a bought list.
• Ask before you pitch. One message that says who you are and why you are writing, and asks whether they would like to hear more.
• No means no, for good. No reply or a no ends it. The opt-out is kept and honoured.
• Keep the record. Where every detail came from, and when, so you can answer "how did you get my details?" in one sentence.

That is Permission-First Prospecting. It respects the buyer and gives the newcomer a fair hearing. It is also the strongest position to hold if the Regulator ever asks.

The case for caution

To be fair to the other side: the Regulator's strict reading exists because voluntary restraint failed. Many people experience "one polite ask" multiplied by hundreds of senders as harassment, and a small business cannot easily tell a serious supplier from a spammer. Until a court rules, the safe course is to treat calls and emails the same and ask first. We do.

Our position: keep the door open, make the knock count, and make no mean no. Ban the abuse, not the handshake.

This is an opinion piece, not legal advice.