Handling Customer Contact Data Under POPIA When You Send Bulk Messages
When you upload a contact list to a messaging platform, POPIA doesn't stop applying to you — it just adds a second party. Here's who's responsible for what.
Uploading a contact list doesn't transfer your compliance obligations
A common assumption is that once a contact list is uploaded to a messaging platform, the platform is now responsible for handling that data lawfully. Under South Africa's Protection of Personal Information Act (POPIA), that's not quite right — and getting the roles wrong is a real compliance risk.
Responsible party vs. operator, in plain terms
POPIA draws a distinction between two roles. The responsible party is whoever decides why and how personal information is processed — for a business sending its own marketing or notifications, that's the business itself. An operator processes personal information on the responsible party's behalf and according to their instructions, without deciding the purpose.
When a business uses LeadTime to send notifications to its contacts, LeadTime processes that recipient contact information as an operator, on the business's behalf. The business remains the responsible party, and stays accountable for the lawful collection and use of that data — including having a proper basis to message each contact in the first place.
What this means in practice
Concretely, before uploading a contact list to any messaging platform, the responsible party (your business) needs to be able to answer: where did this contact come from, do we have a lawful basis to message them, and would they reasonably expect to hear from us this way? A messaging platform can give you the tools to send compliantly — segmentation, opt-outs, delivery tracking — but it can't manufacture consent you didn't already have.
A short practical checklist
- Know the source of every contact on a list before uploading it — a lawful basis has to already exist, not be assumed.
- Keep messaging within what a contact would reasonably expect, based on how they gave you their details.
- Give recipients a clear way to opt out, and honour it.
- Remember that using a platform as an operator doesn't shift your own accountability as the responsible party.
Frequently asked questions
Is LeadTime responsible for my contact list under POPIA?
No. LeadTime processes your contacts as an operator, on your instructions. Your business remains the responsible party and is accountable for the lawful collection and use of that data.
Does using a messaging platform give me a lawful basis to message my contacts?
No. A lawful basis to process and message your contacts has to exist independently — the platform provides the sending tools, not the legal basis.
What's the practical difference between a responsible party and an operator?
The responsible party decides why and how data is processed and is accountable for that decision. An operator processes data on the responsible party's instructions without deciding the purpose.
See LeadTime in action