Major problem for people with recycled phone numbers in South Africa

Recycling old phone numbers and assigning them to new users could be an inadvertent violation of the Protection of Personal Information Act (Popia), according to a data protection and privacy attorney.

MyBroadband has been testing cellular network performance on numerous new SIM cards for many years.

During this time, we have received dozens of phone calls and SMSs from marketers on some of the phone numbers that had previously been registered to other subscribers.

These numbers were recycled, a common and legal practice in South Africa, made necessary by the limited number of unique combinations of 10-digit phone numbers.

Mobile network operators typically deactivate a cell number after three months of network inactivity. Activity includes consuming data, making a phone call, or buying airtime.

Getting a recycled number could become a major pain for a new subscriber. If the old user had opted in to direct marketing, the new subscriber could be bombarded with SMS messages and phone calls.

In light of this, Fairbridges Wertheim Becker director Jodi Poswelletski told MyBroadband that number recycling could be seen as a Popia violation.

However, it may not just be the marketing entity that is violating Popia — the previous phone number’s owner may also be guilty.

“The crux of the matter is that the obligation to keep personal information up to date in terms of the requirements of Popia falls both upon the user as well as the service provider,” Poswelletski explained.

“Perhaps this is something that the National Consumer Tribunal and the Information Regulator’s office should give further consideration to and provide further guidance on.”

Poswelletski said that the recent amendment of Popia Regulation 6, published on 17 April 2025, made it clear that “data subjects” must opt in before they may be sent marketing messages.

This regulation dictates that businesses must first obtain consent from a data subject in writing before processing their personal data for direct marketing purposes.

Regulation 6.4 specifically stipulates that offering opt-out does not constitute consent, meaning any responsible party that contacts a user who had inherited a phone number may be violating Popia.

The problem is that there is currently no system in place that would allow mobile networks to notify all marketing entities that a particular number has been recycled so that they can take action.

Inadvertent access to OTPs and logins

Therefore, Poswelletski advised those who received marketing communications that are being sent to the previous registered cell phone user to immediately opt out of further marketing.

Another potential danger with recycling numbers is compromising the previous owner’s online profiles or private information.

However, in this case, it may not be a Popia violation for the responsible party if the data subject failed to notify a particular entity that their number had changed.

Poswelletski explained that Popia requires people to keep their personal information up to date. This requirement will also be prescribed in the privacy statements and policies of businesses.

She urged people to notify any companies or platforms where they had registered their cell number as a verification method to delete the number from their database.

“The onus, in our view, rests on the data subject to notify any responsible parties and or online entities with which their cellphone number is associated,” she said.

“This is very important to do so, so as to prevent fraud and identity theft, and banking institutions have strict terms and conditions in relation to same.”

She warned if the user of a recycled number received OTP credentials without request, they should immediately delete the message.

They may also want to block any further communication from the number on which they are receiving such notifications.