Gyms Must Now Register on the NCC Opt-Out Registry

7 min read

Since 15 April 2026, a South African business may not send direct marketing to a consumer unless it is registered with the National Consumer Commission. Registration opened in July, it costs R2 574, and the rules reach further into a gym's follow-up than most owners expect.

Most independent gyms run on messages. A lead fills in a form and gets an SMS a minute later. A member misses two weeks and gets a WhatsApp. January arrives and the whole list gets an offer.

All of it is regulated more tightly than it was last year. The Consumer Protection Act Amendment Regulations, 2026 created a national NCC opt-out registry, and since 15 April 2026 no direct marketer may contact a consumer unless it is registered on it. If your gym sends messages to promote anything it sells, your gym is a direct marketer.

The change

What happened on 15 April 2026

According to a newsflash published by ENSafrica, the amended regulations came into effect on the day they were published, with no transitional period. They do two things at once. Consumers get one central place to block marketing, called a pre-emptive block, instead of having to unsubscribe from every business separately. Marketers get an obligation: register with the National Consumer Commission, renew that registration every year, and cleanse your database monthly against the Commission's records.

ENSafrica sets out the consequence in one line: no direct marketer may contact a consumer unless it is registered on the registry. Registration is the permission to send at all.

The Commission announced the change in a statement in which Acting Commissioner Hardin Ratshisusu said, "For too long, consumers have been exposed to intrusive and unwanted direct marketing communication." The same statement confirms registration opened in July 2026 and puts the administrative penalty at up to R1 million or 10% of annual turnover, whichever is greater.

Does the NCC opt-out registry apply to your gym?

If you send messages that promote what you sell, yes. The Consumer Protection Act defines direct marketing by what the message is trying to do, not by how big the business sending it is, and a gym offering a six-week challenge to a list of phone numbers is doing exactly what the definition describes. There is no carve-out for small operators.

What it does not cover is the ordinary running of a membership. A booking confirmation, a class cancellation, a debit order notice, a reminder that the session is at 06:00: none of those promote anything, so none of them are direct marketing. The line sits between servicing a member and selling to one.

The harder case is the one every gym has. Somebody fills in your enquiry form at 21:15 on a Friday and asks about your trial. Replying is not an unsolicited approach, because they asked. Sending them a promotional sequence for the next fourteen days is something else, and the rules below decide whether you may.

The older rule

POPIA already said no, and it bites harder

The registry is new. The underlying restriction is not. Section 69 of the Protection of Personal Information Act has restricted direct marketing by electronic communication for years, and it allows only two doors.

The first door is consent, and it is narrower than it sounds. Section 69(2) lets you approach a person who has not already refused you, and it lets you do that once, in a prescribed form. One ask, ever. If they ignore it, that is your answer. The regulations amended on 17 April 2025, published as Government Notice 6126 in Gazette 52523 and summarised by Bowmans, loosened the paperwork slightly by allowing a form "substantially similar to" the prescribed one, as long as it is expedient, free of charge and reasonably accessible. The same amendment closed the gap most businesses were relying on: an opt-out does not constitute consent. Giving somebody a way to unsubscribe is not the same as them having agreed, because consent needs a positive action.

The second door is the one that matters to a gym with paying members. Section 69(3) lets you market to an existing customer without asking first, provided you got their details in the context of a sale, you are marketing your own similar products or services, and you gave them a chance to object both when you collected the details and in every message since. Section 69(4) then requires every message to identify the sender and give a contact address for stopping it.

Your member list and your lead list are two different legal objects, and most gyms store them in one place.

That distinction is the whole compliance job. A member who paid you is reachable under the existing-customer door. A person who walked past your stand at a school fete and left a number is not, and neither is a list somebody bought you.

The Information Regulator has shown it will act. On 27 February 2024 it issued its first enforcement notice over a direct marketing complaint, against a training company called FT Rams Consulting, for sending marketing email without consent and ignoring requests to stop. As Cliffe Dekker Hofmeyr reported, the company was ordered to cease and given 90 days, with failure to comply carrying a fine of up to R10 million or imprisonment of up to ten years.

Neither number is a realistic outcome for a 200-member gym that tidies up its consent this month. Both answer the question of whether this is worth an afternoon.

The timing

The hours your automation does not know about

This is the rule that catches well-run gyms, because it has nothing to do with intent. The Consumer Protection Act regulations set the hours in which a consumer may be approached at all. As set out in De Rebus, the attorneys' journal, marketing may not be directed at a consumer on Sundays or public holidays, on Saturdays before 9am or after 1pm, or on any other day between 8pm and 8am.

Two details make this workable. De Rebus notes that what counts is when the message was sent, not when the person happened to read it, so a Saturday morning send that is opened on Sunday is fine. And the restriction falls away where the consumer has expressly or implicitly requested or agreed otherwise, which is what the person filling in your form at 21:15 on a Friday and asking you to call has done. The burden of showing the message went out inside the window sits with the marketer, so the scheduler needs to be the thing enforcing it, not somebody's memory.

Most gym automations are built to fire immediately, at whatever hour the trigger happens. A missed-check-in nudge that goes out at 04:40 because that is when the overnight job runs is the kind of thing nobody notices until somebody complains.

What to change this week

Start with step two. You cannot decide what you are allowed to send anybody until you know which list they are on, and for most gyms that answer is currently spread across a spreadsheet, a CRM and the manager's phone. Pull the list today and tag it.

This is a description of published regulations and guidance, not legal advice. If your gym markets at scale or buys lists from anybody, have an attorney look at your specific setup.