The previous nine parts of this series have made Lowveld Ledger's go-to-market system faster. Signals trigger plays automatically, AI drafts the messages, handoffs move without anyone chasing them and a dashboard shows what is working. Each of those improvements also makes it easier to do the wrong thing at scale.
That became clear in a single afternoon. An SDR, keen to fill an empty pipeline before month-end, bought a list of about 5,000 "HR managers at South African SMEs" from an online data seller and imported it into the CRM. The import worked perfectly. The enrichment tool added company sizes. Several hundred of them scored well enough on fit to land in the audience of an outbound play. Nothing in the system asked where the contacts had come from or whether any of them had agreed to be emailed.
CloudNala's view is that governance is what makes an engineered go-to-market system safe to run fast: a lawful basis for every contact, only the data the plays actually use, an approval path for AI-generated outreach and a named owner for every tool. Built into the system, governance takes a few hours a month. Bolted on after a complaint, it can stop the system entirely.
This is the final part of the series. Part 1 described the motion as a system, and the parts since have engineered its data, signals, scores, plays, messages, handoffs and measures. This part governs it.
This article is general information about governing marketing systems, not legal advice. It summarises parts of the Protection of Personal Information Act (POPIA) and the Consumer Protection Act (CPA) for a business and technical audience, as checked on 31 October 2026; read the primary texts and take advice from your information officer and a qualified legal practitioner before relying on any interpretation.
Lowveld Ledger is fictional, and its systems and figures are illustrative. It is a Mbombela accounting and payroll software company for SMMEs with about 2,300 paying customers, a nine-person sales and marketing team and a GTM engineer.
What POPIA asks of electronic direct marketing
The central rule is in section 69 of POPIA. In summary:
- Section 69(1) prohibits processing personal information for direct marketing "by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail" unless the person has given consent, or is a customer of the responsible party under the conditions in subsection (3).
- Section 69(2) allows a responsible party to approach a person whose consent is required, and who has not previously withheld it, only once, to ask for that consent, and the request must be made in the prescribed manner and form.
- Section 69(3) sets the conditions for marketing to existing customers: the contact details must have been obtained in the context of the sale of a product or service, the marketing must be for the responsible party's own similar products or services, and the customer must have been given a reasonable opportunity to object, free of charge and without unnecessary formality, both when the details were collected and on every marketing message.
- Section 69(4) requires every direct-marketing communication to identify the sender, or the person on whose behalf it was sent, and to give an address or other contact details for asking the messages to stop.
The Act as published in the Government Gazette is on gov.za, the Information Regulator's resources are on its POPIA page, and an unofficial section-by-section version is at popia.co.za.
Two points of interpretation from the Information Regulator matter in practice. In a media statement on 21 April 2026, the Regulator's chairperson said that "by merely opting-out, a data subject cannot be regarded as having given consent". The same statement points to the Regulator's Guidance Note on Direct Marketing, published in December 2024. A guidance note is not legislation, and law-firm summaries of this one, such as DLA Piper's, report that it treats a telephone call as an electronic communication and expects a responsible party to keep a database of people who have withheld consent. Some lawyers expect the telephone reading to be challenged; your information officer should tell you how your organisation applies it.
Direct marketing that is not electronic is covered by a different provision. Section 11(3)(b) lets a person object at any time to processing for direct marketing other than the electronic marketing covered by section 69, and section 11(4) says that once they object, the responsible party may no longer process the information for that purpose.
The decision, made in the system
None of this is complicated in principle. It becomes risky when the sender decides it under time pressure. Lowveld turned it into a decision the CRM records for every contact before a play can include them.
Each contact carries a contact basis field with one of three values: customer (with the date and the sale the details came from), consent (with the date, the wording the person agreed to and the channel) or no basis. A separate field records whether consent has already been requested, and when, because section 69(2) allows one request only. Plays filter on these fields. A contact with no basis cannot enter a play that sends electronic messages, whatever their score. The POPIA in Production series explains the wider pattern of carrying purpose and basis as data rather than as a policy footnote.
The withheld-consent list sits above every play. Anyone who has said no, opted out or objected is on it, and the list is checked at send time, not only at import. A person who opted out of the webinar emails has opted out of Lowveld's marketing, not just of webinars.
The bought list failed the decision at the first question. It was quarantined in a separate, inaccessible object in the CRM, nobody was emailed, and the list was deleted once Lowveld's information officer had recorded the incident and the decision. The SDR was not disciplined. The import permission was changed so that no one can bulk-import contacts without a source and a contact basis.
The National Opt-Out Registry changes operations
The CPA has a parallel set of rules. Section 11 of the CPA gives consumers the right to refuse, stop or pre-emptively block direct marketing approaches. For years the registry that would let consumers register such a block did not operate. That has changed.
The Consumer Protection Act Amendment Regulations, 2026 were published in the Government Gazette on 15 April 2026, as the Information Regulator's statement of 21 April 2026 records. On 7 October 2026, the Department of Trade, Industry and Competition announced the National Opt-Out Registry, administered by the National Consumer Commission. According to that statement, direct marketers must register on the system and cleanse their lists against it monthly before running a campaign; direct marketers could register from 15 September 2026 until December 2026, lists can be cleansed at no cost over five months from December 2026 to April 2027, and blocks registered by consumers apply from May 2027. The National Consumer Commission has also issued draft compliance guidelines for comment, and law-firm commentary shows that parts of them are still being debated, so details may change. Check the current position on the Commission's and the department's own pages before you rely on these dates.
Two practical consequences follow for a system like Lowveld's.
The registry adds to POPIA; it does not replace it. The Regulator's April statement is explicit that POPIA compliance is still mandatory whether or not a person is on the registry. A contact who is not on the registry still needs consent, or must be a qualifying customer, before receiving electronic marketing.
Cleansing becomes a scheduled job. Lowveld's GTM engineer has added a monthly registry check to the governance calendar below, with a named owner and a record of each run, so that it is ready before the cleansing phase begins. Whether, and by when, Lowveld itself must register as a direct marketer is a question its information officer has taken to a legal adviser, because the registration window closes in December 2026.
Collect only what the plays use
The second governance question is data minimisation. An enrichment tool can add dozens of fields to every contact. Most are never used, yet every field held must be protected, kept accurate and eventually deleted.
Lowveld applies three rules:
- Every field has a user. A contact or account field exists only if a signal, score, play, handoff record or report uses it. The signal catalogue and the play specifications are the reference.
- Every contact has a source. The source field (form, event, referral, customer record, consent request) is mandatory, and imports without it are rejected.
- Dead leads are deleted. Leads with no engagement and no basis for further contact are deleted on a schedule rather than kept "in case". The traffic-light guide in our AI and POPIA series covers which kinds of personal information need extra care, and none of the red category belongs in a sales system.
Approve the AI, not just the message
AI-drafted outreach, covered in Part 7, needs its own approval path, because the thing being approved is a generator rather than a single message.
At Lowveld, the head of sales and the marketing lead jointly approve three artefacts for each play that uses AI drafting: the drafting prompt, the account fact sheet definition and the banned list. Changes to any of them go through the same approval. Every AI-drafted message that is sent is logged with the prompt version, the fact-sheet entries it used and whether a person reviewed it. When a complaint arrives, the team can see exactly what the system was told to do and why.
Own every tool
The final control is the least glamorous. Lowveld's go-to-market system had grown to eleven tools: the CRM, the product database, billing, a webinar platform, an enrichment service, a sales-engagement tool, an AI writing tool, a scheduling tool, a form builder, a spreadsheet and a data warehouse. Several held copies of the same contacts. Two had been paid for on personal cards.
The GTM engineer built a tool register with six fields for each tool: owner, personal information held, purpose, whether an operator agreement is in place, integrations, and next review date. Two tools were retired because nobody could name a purpose that another tool did not already serve. One was moved to a company account with an agreement in place. Every tool now has an owner who answers for what it holds.
A cadence a small team can run
Governance fails when it is a project. It works when it is a calendar.
Weekly, the GTM engineer samples AI-drafted sends, confirms that opt-outs were processed, watches bounce and complaint rates and reviews rejected handoffs. Monthly, the registry cleanse runs once it applies, the learning review covers scores and signals, and any new data source is approved or refused. Quarterly, the tool register is reviewed, stale leads are deleted, the AI templates are signed off again and a sample of consent records is audited against what the CRM says.
Each item has an owner and leaves a record. The whole calendar takes a few hours a month, which is far less than one serious complaint takes to resolve.
CloudNala's view
This series started from a simple claim: a go-to-market motion is a system, and it can be engineered. Engineering it means specifying its data, testing its signals, explaining its scores, building its plays like products, grounding its AI, preserving context at every handoff and measuring what it learns.
Governance is not a separate topic at the end of that list. It is the property that lets all the others run at speed without someone having to slow them down after the fact. A team that knows the contact basis of every person in its CRM, owns every tool it pays for and can show what its AI was told to write is a team that can move quickly and say yes to new ideas, because the system will catch the ones that should not run.
Start this week
- Add a contact basis field to every contact record, backfill it for active plays, and block plays from including contacts without one.
- Build the tool register for your go-to-market stack: owner, personal information held, purpose, agreement status, integrations, review date.
- Put the governance cadence in the calendar with named owners, and ask your information officer to confirm how your organisation applies section 69 and the opt-out registry timetable.
That completes the series. Start again from Part 1, Your go-to-market motion is a system, or see all ten parts on the series page.
How CloudNala can help
CloudNala helps teams build governance into their go-to-market systems rather than around them. We map where personal information enters and flows through your sales and marketing tools, design the contact-basis model and withheld-consent controls, set up approval and logging for AI-drafted outreach, build the tool register and put a governance cadence in place. We work alongside your information officer and legal advisers, who make the legal determinations.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a Go-to-Market Systems Review or write to us at consult@cloudnala.co.za