Cannabis compliance in South Africa is not a box you tick once and forget. It is a living set of requirements that spans product scheduling, advertising claims, data handling, and platform-specific rules — each with its own regulator, its own enforcement mechanism, and its own liability exposure if ignored.

This checklist is for SA cannabis operators who want to be certain their marketing is built on a compliant foundation before spending anything on growth. Work through it section by section. If you cannot check a box, that gap is your first priority before adding any marketing activity.

SAHPRA Product and Claims Compliance

SAHPRA is the South African Health Products Regulatory Authority. It governs which cannabis products can be sold, how they can be scheduled, and what claims can be made about them.

Scheduling Status

• [ ] Your product's scheduling status is confirmed — you know whether it falls under Schedule 0 (unscheduled CBD), Schedule 5, Schedule 6, or another category
• [ ] Your product formulation matches its scheduling classification — concentration, extraction method, and carrier substance are all consistent with the schedule
• [ ] Any changes to product formulation have been reviewed against scheduling requirements before going to market

Claims Discipline

• [ ] You have an approved claims list — a documented set of statements your team can make about products, reviewed against SAHPRA and ASA requirements
• [ ] No marketing materials make unregistered health, therapeutic, or efficacy claims — you are not promising that your product treats, cures, prevents, or mitigates any condition
• [ ] Testimonials in marketing materials do not contain health claims that you yourself cannot make
• [ ] Your product packaging does not contain claims that contradict or exceed your SAHPRA scheduling

For a full breakdown of what claims are and are not permitted for CBD products, see SAHPRA CBD marketing guidelines.

ASA Advertising Standards Compliance

The Advertising Standards Authority of South Africa governs what can be said in advertising. Cannabis and health product advertising falls under specific ASA codes.

Content Requirements

• [ ] All advertising — including social media posts, email, and paid media — avoids unsubstantiated health benefit claims
• [ ] Any comparative claims (faster, better, stronger) are substantiated and documented
• [ ] Testimonials used in advertising are genuine and do not imply clinical outcomes
• [ ] Advertising is not directed at minors — targeting parameters and creative content both comply with age restrictions

Channel-Specific Compliance

• [ ] Your digital advertising (paid and organic) does not imply or suggest that cannabis is safe, beneficial, or recommended for any specific medical condition without regulatory backing
• [ ] Influencer partnerships have explicit briefings on what claims can and cannot be made — and these are documented
• [ ] Any advertorial or sponsored content is clearly identified as such

POPIA Data Compliance

The Protection of Personal Information Act governs how you collect, store, and use personal data from customers, leads, and subscribers.

Consent and Collection

• [ ] Lead capture forms have explicit consent language that specifies what data is being collected and how it will be used
• [ ] WhatsApp broadcast lists and email lists are opt-in only — you have documented proof of consent for every subscriber
• [ ] Consent language does not bury cannabis marketing in a generic "commercial communications" opt-in
• [ ] You have a documented data retention policy — you know how long you keep lead data and what happens to it

Storage and Access

• [ ] Customer and lead data is stored on systems with appropriate access controls
• [ ] Your CRM, email platform, and any lead management tool has been reviewed for POPIA compliance — you are not using platforms that export or share SA personal data in ways that violate the Act
• [ ] You have a process for handling data subject access requests and deletion requests

See POPIA cannabis email marketing for the specific data handling framework for cannabis marketing.

Platform Policy Compliance

Each marketing platform you use has its own cannabis-specific policy layer on top of regulatory requirements.

Meta (Facebook and Instagram)

• [ ] You understand that direct cannabis product promotion is prohibited on Meta regardless of local legalisation status
• [ ] Any paid campaigns you run do not link to landing pages with direct product purchase paths for cannabis items
• [ ] Your Meta Business Account has a clear record of compliant advertising — no prior policy violations on the account you are using for cannabis-adjacent campaigns
• [ ] Organic posts are reviewed before publishing to ensure they do not cross into paid promotion territory (direct product pricing, explicit purchase calls-to-action)

Google

• [ ] You understand that THC product advertising is prohibited on Google globally, and CBD product advertising requires LegitScript certification that is currently difficult for SA operators
• [ ] Your Google Ads account (if active) does not have pending policy violations related to health products or pharmaceuticals
• [ ] Your Google Business Profile is verified, complete, and contains no claims that would violate Google's health product policies

Email and WhatsApp

• [ ] Your email platform terms of service permit cannabis or CBD marketing — many generic email providers do not
• [ ] WhatsApp Business usage complies with Meta's commerce policies for your category
• [ ] Automated messaging sequences have been reviewed for claims compliance, not just channel compliance

Website and Content Compliance

On-Site Claims

• [ ] All product descriptions on your website are reviewed against your approved claims list
• [ ] Age verification is in place if you sell age-restricted cannabis products
• [ ] Terms and conditions cover the legal basis for your product sales, including jurisdiction-specific disclaimers
• [ ] Your website's privacy policy reflects your actual data collection practices and is POPIA-compliant

Blog and Content Marketing

• [ ] Authority content and blog posts do not contain unsubstantiated health claims — educational content about cannabis can describe the regulatory landscape without implying clinical efficacy
• [ ] Guest posts, sponsored content, and third-party contributions are reviewed before publication
• [ ] Any content about dosing, consumption, or product use is framed in the context of legal personal use and does not constitute medical advice

Before You Scale Marketing

If you have worked through this checklist and found gaps, the sequence matters. Fix compliance gaps before adding marketing spend. A non-compliant platform account, a claims-heavy website, or a POPIA-violating lead capture process creates liability that marketing investment will amplify — not reduce.

Book the SA Market Clarity Call to get a direct assessment of your current compliance posture and what it means for your marketing strategy. AtlasFlow reviews the compliance layer before recommending any growth system.

Frequently Asked Questions

Is there an official SAHPRA compliance checklist for cannabis operators? SAHPRA publishes scheduling notices and guidance documents but not a consolidated marketing checklist. The compliance requirements are distributed across the Medicines and Related Substances Act, SAHPRA scheduling notices, and ASA codes. This checklist synthesises the marketing-relevant requirements across those sources.

How often should a cannabis operator review their compliance status? At minimum annually, and whenever SAHPRA publishes new scheduling notices or guidance. The regulatory environment for cannabis in South Africa is still evolving — operators who set their compliance posture once and do not revisit it are typically behind within 18 months.

Does ASA compliance apply to social media posts? Yes. ASA's code applies to all advertising communications including social media, email, and digital marketing — not just traditional paid advertising. An Instagram post making an unsubstantiated health claim is subject to the same ASA standards as a print advertisement.

What is the penalty for non-compliance with SAHPRA marketing requirements? Non-compliance can result in product seizure, prosecution under the Medicines and Related Substances Act, and reputational damage from public enforcement action. The commercial impact of an enforcement action typically far exceeds the cost of building a compliant marketing system from the outset.

Can a cannabis marketing agency handle compliance for us? An agency can help design compliant campaigns and review content against the required standards. Ultimate accountability for compliance sits with the operator. Working with an agency that has demonstrated cannabis compliance knowledge reduces risk significantly — but does not transfer legal responsibility.