Call Recording and POPIA: What SA Businesses Should Know
Call recording and POPIA in plain language: informing callers, purpose, retention, security and transcripts. General guidance for South African businesses.
· 4 min read · Summarix team
South African businesses commonly record calls, but a recording is personal information, so POPIA (the Protection of Personal Information Act) applies to how you collect, use, store and delete it. In practice that means telling callers they are being recorded and why, only using recordings for that purpose, keeping them no longer than you need, and keeping them secure. This article explains those basics in plain language.
Why call recordings count as personal information
A call recording captures someone’s voice and usually their name, contact details and account information. Some calls include more sensitive details such as health or financial information. Transcripts and AI summaries of those calls contain the same information in text form, so they need the same care as the audio.
POPIA sets out conditions for processing personal information lawfully. The ones most relevant to call recording are summarised below. The Information Regulator’s website, inforegulator.org.za, publishes the Act, guidance notes and contact details.
1. Tell callers they are being recorded
POPIA expects people to know when their information is being collected and why. For calls, the usual approach is a short message at the start of inbound calls, and a statement by the agent on outbound calls.
- Say that the call is recorded and give the main purpose, for example ‘for quality, training and record-keeping purposes’.
- If you transcribe or analyse calls with AI, consider whether your notice and privacy policy make that clear.
- Make your privacy policy easy to find and describe how recordings are used, stored and deleted.
- Know what you will do if a caller objects, for example offering another channel.
2. Be clear about purpose
Record calls for specific, legitimate reasons and use them for those reasons. Typical purposes include quality assurance, training and coaching, resolving disputes, and keeping a record of instructions. If you later want to use recordings for something new, check whether it is compatible with what callers were told, and get advice if it is not obvious.
3. Collect and keep only what you need
POPIA favours minimal processing and not keeping information longer than necessary. For calls, this means setting a retention period on purpose rather than keeping everything forever.
| Data | Question to ask | Example approach |
|---|---|---|
| Audio recordings | Do we need the audio once it is transcribed? | Delete audio after processing unless needed for a dispute |
| Transcripts | How long are they useful for quality and disputes? | Keep for a defined period, then delete |
| Summaries and scores | Do they need personal details at all? | Keep outcomes and trends; minimise identifiers |
| Card or ID numbers read out | Should these ever be stored? | Pause recording or mask them where possible |
Some industries have their own record-keeping requirements that may mean keeping certain records for longer. This is exactly where legal advice specific to your business is worth having.
4. Keep recordings secure
- Limit who can listen to recordings or read transcripts, using roles rather than shared logins.
- Keep an audit trail of who accessed what.
- Use strong sign-in, such as two-factor authentication, on systems holding recordings.
- Check where your call analytics or transcription provider processes and stores data, and have an agreement in place with them as an operator.
- Have a plan for security incidents, including how you would notify the Information Regulator and affected people if required.
5. Respect callers’ rights
People have rights under POPIA, including asking what information you hold about them and asking for correction or deletion in certain cases. Make sure you can find a specific caller’s recordings and transcripts if they ask.
Where RICA fits in
RICA (the Regulation of Interception of Communications and Provision of Communication-Related Information Act) deals with the interception and monitoring of communications. It includes provisions relevant to businesses recording calls as part of their operations. How it applies depends on your situation, so we won’t summarise its details here: ask a legal adviser to confirm your recording practices meet both RICA and POPIA.
What to look for in call analytics tools
If you use AI to transcribe and analyse calls, look for tools that let you minimise what is kept. Summarix deletes call audio after processing by default, offers role-based access, an audit log and optional two-factor sign-in, and lets you export or delete your account data from settings. Our POPIA checklist for AI tools has more questions to ask any vendor, and POPIA-compliant data analytics covers the wider picture.
See how Summarix handles call audio, access and deletion.
Free plan: 5 AI reports a month, no card needed.
Conclusion
Recording calls is normal business practice, but it comes with responsibilities: tell callers, be clear about purpose, keep only what you need for as long as you need it, secure it and respect callers’ rights. Put your approach in writing, apply it to transcripts and summaries as well as audio, and have it checked by a legal adviser.
Frequently asked questions
Is it legal to record calls in South Africa?
Businesses commonly record calls, but they must comply with POPIA, RICA and any industry rules. This is general information, not legal advice, so confirm your approach with a legal adviser.
Do I have to tell customers a call is being recorded?
POPIA expects you to tell people when you collect their information and why, which is why most businesses play a recording notice at the start of calls.
How long should call recordings be kept under POPIA?
POPIA does not give a single period for all recordings; it says not to keep personal information longer than necessary for its purpose, subject to other legal requirements. Set and document a retention period suited to your business.
Are call transcripts covered by POPIA?
Yes. Transcripts and summaries contain the same personal information as the audio and should be handled with the same care.