You need to reach a real decision-maker, not just the generic info@ address that goes straight to a junior staffer or a spam folder. 

But guessing wrong costs you a bounce, and doing it carelessly risks a POPIA complaint before your outreach has even started. 

You can find business email addresses without breaking the rules, as long as you know which methods are actually legitimate and which ones look that way.

This guide covers both sides: how to find the address you need properly, and what South African data protection law actually expects from you once you’ve found it.

What “Breaking the Rules” Actually Means Here

POPIA governs how personal information is collected and used in South Africa, and B2B prospecting sits in a specific corner of that law. 

Section 11 permits processing personal information without direct consent where it serves a legitimate business interest. This is generally understood to cover reasonable B2B outreach, provided it’s handled carefully.

A practical distinction worth knowing:

Role-based addresses like sales@ or info@, aimed at the business itself rather than a specific person, generally carry lower compliance risk than a personal-format address like a named individual’s firstname.lastname@ used to target them directly. 

The moment you’re emailing a named individual rather than a general business inbox, the consent and opt-out expectations become more relevant.

None of this is a substitute for proper legal advice if your outreach is high-volume or high-stakes. 

But for everyday B2B prospecting, the safe pattern is consistent: 

• Have a genuine business reason for the contact

• Respect any opt-out immediately

• Avoid building your entire outreach strategy around lists you can’t account for the origin of.

Legitimate Ways to Find Business Email Addresses

The most reliable methods are also conveniently the ones that carry the least compliance risk, since they rely on information the business or individual has already made public on purpose.

Company Websites and Team Pages

Start with the source itself. Many businesses list direct emails or at least role-based addresses on their contact or team pages, and this is about as clean a starting point as exists. 

It’s because  the business chose to publish it.

LinkedIn

A person’s current role, company, and sometimes direct contact details are often visible on their LinkedIn profile.

Sales Navigator adds filtering by company, title, and industry if you’re prospecting at any real volume, though a manual LinkedIn search works fine for smaller, targeted lists.

LinkedIn’s own messaging feature is also worth using directly rather than skipping straight to email. 

A short connection request with context often gets a reply, or an invitation to email directly, which sidesteps the guesswork of finding an address entirely.

Common Email Pattern Conventions

Most companies follow a predictable format across their whole domain, such as [email protected] or first initial plus surname.

Once you’ve confirmed one employee’s address from a public source, the same pattern usually applies across the business.

This is a starting point for a guess, not a finished contract. 

Never add a pattern-guessed address straight into a campaign without verifying it first. 

Since an unconfirmed guess is exactly the kind of address that generates a hard bounce and quietly damages your sender reputation.

Email Finder and Verification Tools

Dedicated tools like Hunter, Anymail Finder, or similar services combine pattern-matching with real-time verification, checking whether a guessed address actually exists before you use it. 

These tools typically pull from publicly available data rather than scraping private information, which keeps them on the more defensible side of the compliance line.

Most of these tools work on a credit-based free tier, which is worth using to test a smaller batch of contacts before committing to a paid plan for larger volume. 

Cross-checking a tool’s confidence score against a manual LinkedIn confirmation catches the occasional false positive that pure automation misses.

The CIPC Company Registry

For registered South African businesses, the Companies and Intellectual Property Commission registry lists official company details. 

This can help confirm you’re targeting the right legal entity, particularly for a role-based address rather than a named individual.

Referrals and Warm Introductions

The least scalable method is often the most effective one. 

An introduction through:

•  A mutual contact

• An industry event

• an existing client carries far higher response rates than any cold-found address. 

It also sidesteps the compliance question almost entirely, since the contact is being made through a relationship, not a database.

Verify Before You Send

Every address you gather this way, whether guessed from a pattern or pulled from a public page, deserves a quick verification pass before it goes anywhere near a real campaign. 

Verification tools check whether the mailbox actually exists without sending a real email, catching typos and outdated addresses before they become bounces.

This step matters more than it might seem. 

A high bounce rate on your very first outreach batch damages your domain’s sending reputation, and that damage affects every email you send afterward. 

It’s not just the ones that bounced. A few minutes of verification protects months of deliverability. 

Treat verification as a standing step in your process, not a one-time check. 

Contacts change roles, companies update their domains, and an address confirmed six months ago can quietly go stale. 

Re-verifying a list before a major send catches this drift before it costs you.

What to Avoid

A few practices come up often in B2B prospecting and are worth avoiding outright, both for compliance reasons and because they don’t work as well as they seem to.

• Buying bulk, unverified contact lists from a data broker with no clear sourcing methodology

• Scraping personal-format addresses indiscriminately from websites or social platforms without a specific business reason for each contact.

• Misrepresenting who’s sending the email, or disguising a sales pitch as something else to get it opened

• Ignoring an opt-out or unsubscribe request, or continuing to email someone who has clearly asked to stop

Each of these might produce a bigger list faster, but they consistently produce worse results too. 

Since unverified and unwilling contacts drive the complaint and bounce rates that get domains blocked.

Once You’ve Found the Right Address

Finding the address is only the first step. 

What happens next, the domain you send from, its authentication, and how the message itself is written, determines if that email reaches the inbox or gets filtered before your prospect ever sees it.

A properly authenticated business domain, with SPF, DKIM, and DMARC configured, gives every email you send the best possible chance of landing where it should. 

Truehost’s Workplace plans include this as standard, so the outreach you’ve carefully and correctly sourced doesn’t get lost to a deliverability problem instead.