Call Centre • POPIA and RICA compliance

POPIA-compliant call recording in South Africa: the 2026 checklist

Recording business calls is legal in South Africa, but only if you satisfy two laws, not one. Here is exactly what POPIA and RICA require, and a seven-step checklist to get compliant.

Last verified 7 July 2026
By the WhichVoIP editorial team
10 min read

Laws that applyPOPIA + RICA

Lawful bases3 practical

Max POPIA fineR10 million

Must-haveThe announcement

The short answer

Is call recording POPIA compliant in South Africa?

Yes, if you satisfy both laws. RICA lets you record a call you are a party to and monitor business calls, provided you tell people. POPIA then requires a lawful basis (consent, contract or legitimate interest), a stated purpose, secure storage, a retention limit and the ability to honour a caller’s access or deletion request. Announce recording on every line, document your basis per call type, and enforce a deletion schedule.

laws govern a recorded call: POPIA and RICA

POPIA conditions for lawful processing

rand: maximum POPIA administrative fine

announcement every caller must hear

A South African Contact Centre Agent Wearing A Headset At A Workstation With A Privacy Notice On Screen — The recorded announcement is both your RICA notice and part of your POPIA basis.

Two laws, not one, govern a recorded call

Most South African businesses treat call recording as a POPIA question. It is actually governed by two laws working together, and missing the second is the most common mistake we see.

RICA (the Regulation of Interception of Communications Act) treats recording a call as an interception of a communication. The good news: RICA lets you record a call you are a party to, and lets a business monitor its own calls, as long as you take reasonable steps to inform people. POPIA (the Protection of Personal Information Act) then governs the recording itself as personal information: you need a lawful basis to hold it, you must keep it secure, you cannot keep it forever, and the caller has rights over it. Get RICA right and you may lawfully make the recording. Get POPIA right and you may lawfully keep and use it. You need both.

The lawful recording chain

A recording that fails any one of these links is a liability, not an asset. The point of this page is to make every link easy to satisfy.

Your lawful basis: consent is one option, not the only one

POPIA section 11 lists the grounds for processing personal information. For call recording, three are practical, and consent is not always the strongest.

Consent is the ground everyone reaches for first, and the recorded announcement (“this call may be recorded for quality and training”) plus the caller staying on the line is the usual way it is given. It works, but it is fragile: a caller can withdraw consent, and a purely consent-based model struggles when someone objects but you still need the recording for a dispute.

Performance of a contract covers recordings that are genuinely necessary to deliver or prove a transaction, common in financial services and debt collection where the call itself is the agreement. Legitimate interest covers recording for quality assurance, training, fraud prevention and dispute evidence, provided that interest is real and is not outweighed by the caller’s privacy. For most contact centres a documented legitimate-interest assessment, backed by a clear announcement, is more robust than consent alone. Whichever ground you choose, the rule is the same: decide it deliberately, per call type, and write it down.

The red flag we see most. Recording every call “because everyone does” with no announcement, no chosen lawful basis and no deletion schedule. That is three POPIA failures and a RICA one in a single habit. The fix is an afternoon of paperwork, not a new system.

What compliant recording actually requires

Six requirements turn a pile of audio files into a defensible, POPIA-ready recording programme. None of them needs new software; they need decisions and enforcement.

What the law wants	What it means for a recorded call	How you comply
Lawful interception (RICA)	Recording a call is legally an interception. You may record a call you are a party to, and monitor business calls, provided you take reasonable steps to tell people.	Announce recording at the start of every call, on every line.
Lawful basis (POPIA s11)	You need a ground to process the recording: consent, performance of a contract, a legal duty, or a legitimate interest that is not overridden.	Write down which ground applies to which call type, before you record.
Purpose limitation	You may only use the recording for the purpose you gave (quality, training, dispute evidence), not repurpose it later.	State the purpose in your notice and your privacy policy, and stick to it.
Security safeguards (s19)	Recordings are personal information and often contain card or ID data. They must be protected against loss and unauthorised access.	Encrypt at rest, restrict who can play back, log every access.
Retention limitation (s14)	You cannot keep recordings forever. Hold them only as long as the purpose or a law requires.	Set an automatic deletion schedule per call type and enforce it.
Data subject rights (s23, s24)	A caller can ask what you hold, ask for a copy, or ask you to delete it.	Be able to find one caller’s recordings quickly and act on the request.

Recording every call because everyone does, with no announcement, no chosen lawful basis and no deletion schedule, is three POPIA failures and a RICA one in a single habit. The fix is an afternoon of paperwork, not a new system.

WhichVoIP editorial

The recording compliance checklist

Work through these seven steps once, then audit them quarterly. This is the recording-specific companion to our broader POPIA compliance checklist for call centres.

Announce recording on every lineA short, clear notice at the start of the call, in the languages your callers use. This is your RICA notification and part of your POPIA basis.

Pick and document a lawful basis per call typeConsent, contract or legitimate interest. Record which applies to sales, support, collections and so on, and why.

Write the purpose down and honour itQuality, training, dispute evidence, fraud prevention. Put it in your privacy notice and do not quietly reuse recordings for anything else.

Secure the recordingsEncrypt at rest, limit playback to named roles, and log every access. Treat card and ID numbers in a call as the sensitive data they are.

Set a retention and deletion scheduleDecide how long each call type is kept (often tied to a dispute or regulatory window) and delete automatically after that. “Keep everything forever” is not a policy.

Be able to answer a data subject requestYou must be able to find, produce or delete one caller’s recordings on request. If retrieval takes days of manual searching, fix it before the request arrives.

Check where the audio livesIf your platform stores recordings offshore, POPIA’s cross-border rules (section 72) apply. Confirm the storage location and safeguards with your provider.

What to ask a platform before you trust it with recordings

Compliance is your responsibility, but the right platform makes it far easier. These questions separate a recording feature from a compliance-ready capability.

Ask whether consent announcements can be configured per queue and language; whether retention and automatic deletion are built in per call type or left to you; whether playback access is role-based and logged; whether recordings are encrypted at rest; and where, physically, the audio is stored. A platform that answers these cleanly is doing half your POPIA work. One that cannot is quietly handing the risk back to you. This is the compliance layer generic feature comparisons skip, and it belongs on your shortlist alongside the capabilities in our guide to call centre software features that matter.

Close-Up Of A Secure Server Room Storage Rack With A Padlock Motif, Representing Encrypted Call-Recording Storage — Recordings are personal information: encrypt them, limit access, and delete them on schedule.

Our verdict

Call recording is entirely lawful in South Africa and genuinely valuable for quality, training and dispute evidence. What makes it a liability is treating it as a technical feature instead of a two-law compliance obligation. Get RICA right with a clear announcement, get POPIA right with a documented basis, secure storage, a retention limit and a way to honour data subject rights, and your recordings become defensible assets instead of a breach waiting to be found.

Our recommendation: Do the paperwork first, not the recording. Choose a lawful basis per call type, switch on the announcement everywhere, set an automatic deletion schedule, and confirm where your provider stores the audio. Then record with confidence.

Need a recording-ready call platform?

Tell us your call volumes and compliance needs. We will line up quotes from SA providers whose recording, retention and access controls are built for POPIA, not bolted on.

Get call centre quotes
See the full POPIA checklist

Frequently asked questions

Do I need consent to record a call in South Africa?

Not always. RICA lets you record a call you are a party to and monitor business calls if you take reasonable steps to inform people. Under POPIA you then need a lawful basis to keep the recording, which can be consent, performance of a contract, or a legitimate interest. Many contact centres rely on a documented legitimate interest plus a clear announcement rather than consent alone.

What must the recording announcement say?

It should tell the caller that the call may be recorded and why (for example quality and training). Keep it short, clear and in the languages your callers use. This announcement is both your RICA notification and part of how you meet POPIA’s openness requirement.

How long can I keep call recordings under POPIA?

Only as long as the purpose requires, or as long as another law requires you to keep them. POPIA’s retention principle (section 14) prohibits keeping personal information indefinitely. Set a deletion schedule per call type – often tied to your dispute or regulatory window – and delete automatically after it.

Does POPIA apply if my recordings are stored overseas?

Yes. If your platform stores recordings outside South Africa, POPIA’s cross-border transfer rules (section 72) apply. You need an adequate basis for the transfer and should confirm the storage location and safeguards with your provider.

What is the penalty for non-compliant call recording?

POPIA breaches can lead to an administrative fine of up to R10 million, and certain offences carry criminal penalties. Beyond the fine, an unlawful recording is inadmissible and reputationally damaging. The cost of compliance is far lower than the cost of a breach.

Is this the same as the general POPIA checklist?

No. This page is specifically about recording calls lawfully. Our broader POPIA compliance checklist for call centres covers your whole programme, from information officer registration to data subject requests. Use both together.

Keep reading

POPIA compliance checklist for call centres
Call centre software features that matter
How to buy the right call centre solution

Sources: POPIA (Protection of Personal Information Act 4 of 2013), sections 11, 14, 19, 23, 24, 72 and the administrative-fine provisions; RICA (Regulation of Interception of Communications Act 70 of 2002), party-to-communication and business-purpose provisions; Information Regulator (South Africa) guidance. Verified 7 July 2026.

POPIA-Compliant Call Recording in SA: 2026 Checklist