Across Uganda, Kenya, Tanzania, Rwanda, Zambia and Nigeria, transactional SMS (OTPs, receipts, alerts, reminders about a service the customer uses) can generally be sent at any hour without an opt-out, while promotional SMS needs prior consent, a working opt-out and, in most of these markets, daytime sending. The windows differ: no commercial SMS 19:00 to 06:00 in Uganda and 19:00 to 07:00 in Rwanda, 08:00 to 18:00 for Safaricom promotions in Kenya, a 20:00 to 07:00 ban in Zambia's 2011 directive, and Nigeria's Do-Not-Disturb registry.
Last reviewed: 27 October 2026. This summary is not legal advice. Rules marked as operator practice or unverified can change without a published notice.
The six markets side by side
| Country | Promotional time window | Consent | Opt-out | Registry or DND | Main source |
|---|---|---|---|---|---|
| Uganda | Not timed for 19:00 to 06:00 unless agreed; health, fire and security alerts exempt | Prior consent, with an existing-customer exception | Free, STOP and similar words, honoured within 24 hours | None national | UCC regulations 2019, regs 11, 12, 19; DPPA 2019 s.26 |
| Kenya | Safaricom promotions 08:00 to 18:00 (operator notice); a 7pm cut-off was reported as a CA proposal | Prior consent for automated direct marketing | Opt-out instructions in every promotion | Safaricom *456*9*5# to stop promotions | CA Consumer Protection Regulations 2010, reg 17; Data Protection Act 2019 |
| Tanzania | No published rule found; daytime is advised | Lawful basis under the PDPA | Right to prevent direct marketing | None national | Personal Data Protection Act 2022, s.35 |
| Rwanda | No commercial communications 19:00 to 07:00 unless explicitly agreed | Required; state the source of the recipient's data | Free, stop/end/cancel and similar, within 24 hours, confirmed | National list provided for in the regulation (operation unverified) | RURA Regulation 001/R/STD-CMR/RURA/018, Arts 7, 9 to 15; Law 058/2021 Art 19 |
| Zambia | No promotions 20:00 to 07:00; one per day (2011 directive, current force unverified) | Opt-in or opt-out option with promotions; lawful basis under the DPA | Option in every promotion | None national | ZICTA 2011 directive (ITWeb); Data Protection Act 2021 |
| Nigeria | Daytime windows quoted by vendors are operator practice, not confirmed NCC rules | Right to object under the NDPA | Honour STOP; respect DND | NCC DND: STOP or HELP to 2442, 11 categories | NCC DND service; NDPA 2023 s.36 |
What counts as transactional
Regulators phrase it differently, but the test is consistent. Rwanda's regulation, for example, excludes messages whose primary purpose is to complete or confirm a transaction the recipient agreed to, to deliver goods or services they are entitled to, or to report a change in their account, subscription or loan status (Article 4). Uganda exempts emergency alerts about health, fire or security from its quiet hours. Kenya's Safaricom notice lists login codes, bank alerts, billing reminders and outage notices as transactional.
Use this three-question test before you classify a template:
- Did the customer start it? A code they asked for, a payment they made, an appointment they booked.
- Would they be worse off without it? A fraud alert, a failed payment, a changed delivery time.
- Does it sell anything? If any line promotes a product, a discount or an event, the whole message is promotional.
The third question catches the common mistake: a receipt with "Get 10% off your next order!" appended is no longer a receipt.
Duka Online: order 5512 delivered at 14:20. Thank you. Questions? Call 0700000000
Duka Online: weekend sale, 20% off shoes until Sunday. Shop: go.esmsafrica.io/dk20 Opt out: SMS STOP to 6xxx
Country notes
Uganda
The 2019 regulations are the most detailed of the six. Commercial messages need prior consent (regulation 11), with an exception for existing customers who can object; opt-out must be free, accept STOP, END, CANCEL, UNSUBSCRIBE or QUIT, be confirmed and be honoured within 24 hours (regulation 12); and commercial communications may not be timed for delivery between 19:00 and 06:00 unless the recipient agreed (regulation 19). The Data Protection and Privacy Act 2019 adds a right to stop direct marketing. Our plain-English guide to the UCC regulations goes through each one.
Kenya
Regulation 17 of the Consumer Protection Regulations 2010 makes direct marketing by automated systems without prior consent an offence and requires a valid address for stop requests. As summarised by Afriwise, the Data Protection (General) Regulations 2021 treat electronic messages as direct marketing and require a simple, free opt-out, and the ODPC has made awards against companies over unsolicited messages. Safaricom's 2020 notice put promotions on separate sender IDs with an 08:00 to 18:00 window. A Communications Authority proposal to stop promotional texts after 7pm was reported by the Nation; we have not seen it confirmed as final.
Tanzania
We found no published regulator rule on promotional sending hours. The Personal Data Protection Act 2022 gives individuals the right to require a data controller to stop processing their data for direct marketing (section 35), so an opt-out is effectively mandatory. Sender IDs must be registered, and daytime sending with STOP or SIMAMA honoured is the sensible standard.
Rwanda
RURA's regulation applies to commercial communications by SMS. Article 7 requires each message to identify who authorised it and to state the source of the recipient's data; Articles 9 to 12 require a free opt-out with words such as stop, end or cancel, honoured within 24 hours and confirmed; Article 15 bans commercial communications between 19:00 and 07:00 local time unless explicitly agreed. Because standard A2P routes cannot receive replies, use a link or phone number for opt-out. See Rwanda's 7pm to 7am rule.
Zambia
ITWeb reported in 2011 that ZICTA directed MTN, Airtel and Zamtel to stop promotional SMS between 20:00 and 07:00, to allow only one promotional SMS per day and to include an opt-in or opt-out option, from 1 September 2011. Its current enforcement is unverified, but it remains the safest default. The Data Protection Act No. 3 of 2021 applies to the customer data behind every campaign.
Nigeria
Nigeria's distinctive tool is the NCC Do-Not-Disturb service. Subscribers text STOP to 2442 to block unsolicited messages entirely, or HELP to choose among 11 categories (banking and finance, real estate, education, health, consumer goods, communications and entertainment, tourism, sports, religion, new products and news). Promotional traffic does not reach numbers that have opted out of its category. OTPs and alerts are sent on transactional routes, which is operator practice rather than a published NCC rule. The NDPA 2023 adds a right to object to direct marketing.
Mixed messages and edge cases
- Payment reminders with a discount for early payment. Usually promotional because of the offer. Send the reminder plainly and promote the discount separately.
- Loyalty points balances. A statement of points is close to an account notice, but "use them this weekend" turns it into a promotion.
- Event reminders. A reminder for a ticket the customer bought is transactional; an invitation to the next event is promotional.
- Surveys. A short satisfaction survey after a service is often treated as transactional, but a survey that leads into an offer is not.
- Public-interest messages. Exemptions in Uganda and Rwanda cover emergency and public-interest communications, and in Rwanda only public institutions authorised by RURA. NGOs and companies should not assume they qualify.
How to set this up in practice
- Separate templates and lists. Keep transactional templates in your application and promotional ones in campaigns, with separate contact lists.
- Separate sender IDs where it helps. Required for Safaricom; useful for DND in Nigeria; optional elsewhere.
- Schedule by local time. Each of the six countries uses one time zone, but East Africa (UTC+3), Rwanda and Zambia (UTC+2) and Nigeria (UTC+1) differ. Schedule campaigns in the recipient's time.
- Use the opt-out list. In eSMS Africa, numbers on the opt-out list are blocked from future sends, and STOP replies to a two-way number are recorded automatically.
- Approvals. Put promotional campaigns behind an approval step so someone checks timing, consent and the opt-out line.
Checklist
- Every template labelled transactional or promotional using the three-question test.
- Promotions sent only to customers whose consent is recorded.
- Promotions scheduled inside the strictest window that applies (Uganda 06:00 to 19:00, Rwanda 07:00 to 19:00, Kenya Safaricom 08:00 to 18:00, Zambia 07:00 to 20:00).
- A working opt-out in every promotion, honoured within 24 hours.
- Rwanda promotions state the source of the recipient's number.
- Nigeria lists checked against DND categories.
- Transactional templates free of offers.
Frequently asked questions
Can OTPs be sent at night in all six countries?
Yes. The time windows in these markets apply to commercial or promotional messages. OTPs, receipts and security alerts should go out immediately at any hour.
Is an appointment reminder promotional?
No, as long as it only reminds the customer of something they booked. If it also advertises another service, treat it as promotional.
Which window should a pan-African campaign use?
Use each country's window in local time. If you want one rule, 08:00 to 18:00 local time satisfies every window in the table.
Do transactional messages need an opt-out?
Generally not, and customers should not be able to opt out of security alerts by accident. Do offer a way to change notification preferences in your app.
Sources
- UCC - Text and Multimedia Messaging Regulations, 2019 (PDF)
- Uganda - Data Protection and Privacy Act, 2019 (ULII)
- Communications Authority of Kenya - Consumer Protection Regulations, 2010 (PDF)
- Afriwise - Direct marketing under Kenyan data protection law
- KICTANet - Safaricom notice on promotional and transactional sender IDs (2020)
- Khusoko - Safaricom USSD code to stop promotional messages (2021)
- Nation - CA proposal to stop promotional texts after 7pm (reported)
- Tanzania - Personal Data Protection Act, 2022 (TanzLII)
- RURA - Regulation governing unsolicited commercial communications (PDF)
- DLA Piper - Data protection laws of Rwanda
- ITWeb - ZICTA limits spam (2011 directive)
- Zambia - Data Protection Act No. 3 of 2021 (ZambiaLII)
- NCC - Do-Not-Disturb (DND) service in Nigeria
- Templars - Unsolicited messaging and the limits of opt-out provisions (PDF)
See how these rules apply to your sector on our use cases by country and industry, read sender ID registration compared and how to choose a bulk SMS provider, and check rates on the pricing page. When you are ready, create a free account.
