Compliance

POPIA and WASPA, explained for people who ship software.

Every market has its own rules for messaging, and Sendbaze enforces them in the API. This page covers the two that apply in South Africa, POPIA and WASPA: what each requires, what Sendbaze enforces automatically, and what stays your responsibility. It is a plain-language guide, not legal advice.

POPIA

Protection of Personal Information Act, 2013

South Africa's data protection law, in force since 1 July 2021 and enforced by the Information Regulator. It governs how personal information such as email addresses and phone numbers is collected, used and stored.

Section 69 restricts direct marketing by electronic communication: you need the person's consent, or an existing customer relationship where they were given a chance to opt out.
Every marketing message must identify the sender and give a way to opt out.
You must be able to show the consent you rely on, which means keeping evidence with a timestamp and source.
Personal information must be protected with appropriate security measures and kept no longer than needed.

WASPA

Wireless Application Service Providers' Association Code of Conduct

The industry code that South African networks require of anyone sending SMS commercially. Sendbaze is the WASPA member, and messages you send through it must follow the code.

Marketing SMS only between 08:00 and 20:00 on weekdays and Saturdays, never on Sundays or public holidays.
Every marketing message must offer a free or standard-rate opt-out, and STOP replies must be honoured.
Numbers on the WASPA do-not-contact list may not receive marketing.
Sender identity must be clear and not misleading; branded sender IDs are approved, not self-declared.

Who does what

Shared responsibility, written down

Sendbaze is your operator under POPIA. These are the lines.

Sendbaze enforces

Classifies every SMS as transactional or marketing and refuses marketing without a consent record.
Stores consent with source, evidence and timestamp; exports it as CSV on demand.
Parses STOP keywords on inbound SMS, flags the contact and blocks future marketing.
Appends the opt-out footer to marketing SMS and adds List-Unsubscribe headers to marketing email.
Scrubs marketing against the WASPA do-not-contact list weekly.
Holds marketing SMS outside 08:00 to 20:00 SAST, on Sundays and on public holidays until the next legal window.
Encrypts recipient data at rest, redacts message bodies after 30 days and isolates each organisation's data.

You remain responsible for

Collect consent lawfully and record it through the consent API or an attestation before sending marketing.
Classify messages honestly. An OTP is transactional; a discount code is marketing.
Keep your own privacy notice accurate about how you use Sendbaze.
Respond to data-subject requests from your customers. We give you the exports to do it.
Use a sender identity people recognise, and do not send content that breaks the Acceptable Use Policy.

Why it matters

How this reduces your risk

A regulator query takes minutes, not a week: Consent, opt-out and send-time evidence for any number is one export away. That is the difference between a closed complaint and a fine.
No accidental 02:00 campaigns: The API holds out-of-window marketing rather than sending it. A cron misfire becomes a scheduled send, not a WASPA complaint.
STOP means stop, everywhere: One opt-out blocks marketing across every integration you run on the same organisation, including the ones a teammate wrote last year.
Your aggregator account stays clean: Complaints and DNC violations are caught before they reach the networks, protecting the sender reputation your OTPs depend on.

Common questions

Does using Sendbaze make me POPIA compliant?

No single tool can. Sendbaze enforces the messaging rules and keeps the evidence, which removes the most common failure points. You remain the responsible party for the personal information you collect.

Is Sendbaze an operator under POPIA?

Yes. When you send through Sendbaze we process personal information on your behalf as an operator. The Data Processing Agreement sets out our obligations, including security measures and breach notification.

Where is data stored?

Message data is stored in Postgres and Redis hosted in the regions closest to our customers, and email is sent from Amazon SES in the Africa (Cape Town) region. Bodies are redacted after 30 days; metadata is retained for your logs and invoices.

What about transactional SMS at night?

Transactional messages such as OTPs, delivery updates and alerts are not subject to the marketing time window and are sent immediately, around the clock.

Do I need my own WASPA membership?

Not for sending through Sendbaze. We hold the membership and the do-not-contact list access; you agree to follow the code through our Acceptable Use Policy.

Compliance you do not have to build

Consent, STOP, do-not-contact and send windows are enforced from your first message on the free plan.

Start free Read the quickstart →