Can a business record calls in South Africa? RICA, POPIA and AI receptionists

Recording a call your business is part of is not automatically unlawful in South Africa, but specific rules apply, and a recording is also personal information under POPIA. This article walks through what the two Acts say, in the order that matters for an owner, and then gives you wording to copy. It is general information, not legal advice. For your own situation, speak to an attorney.

We read the text of both Acts on the Department of Justice website: the Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002 (RICA) and the Protection of Personal Information Act 4 of 2013 (POPIA). Where we describe a section, we name it. Where something is unsettled, we say that too.

What does RICA say about recording a call?

The starting point is section 2 of RICA: subject to the Act, no person may intentionally intercept a communication, or arrange for someone else to, while it is happening or being transmitted in South Africa. Section 49 makes doing so an offence unless a later section allows it. Under section 51, a person convicted of that offence is liable to a fine of up to R2,000,000 or imprisonment of up to ten years.

The Act defines "intercept" widely. It means acquiring the contents of a communication so that they become available to someone other than the sender or the intended recipient, and it includes monitoring a communication with a device. A phone call is speech sent over a telecommunication system, which the Act calls an "indirect communication" (section 1).

So for any recording the question is which exception in sections 3 to 9 applies. For a business, three matter.

What are the conditions in section 6?

Section 6(2) lists conditions, and they are joined by "and". In plain terms, the recording must be made by, or with the express or implied consent of, the "system controller" (for a company, the chief executive or someone they authorise). It must be for a listed purpose, such as keeping a record to establish the existence of facts, investigating unauthorised use of the system, or securing the effective operation of the system. The telephone system must be provided wholly or partly for use in the business. And the system controller must have made all reasonable efforts to inform in advance anyone who intends to use the system that their communications may be intercepted, or the recording must be made with that person’s express or implied consent.

Contravening section 6(2) is itself an offence under section 51. In our reading, a spoken notice at the start of the call is not just politeness. It is one way to show reasonable efforts to inform the caller, although section 6(2)(d) speaks of informing a person who intends to use the system in advance, so a notice on your website or in your terms may also matter.

Where does an AI receptionist fit in?

This is where the law is unsettled. Section 4 depends on being a "party to the communication". For a call, the Act defines that, for section 4, as the sender, the recipient or the intended recipient, and in some cases others in the immediate presence of those people. When a caller phones your business, your business is the intended recipient. An AI receptionist answers on your behalf.

What we could not find is any ruling on whether an AI system counts as a party, as the business acting through its tool, or as a separate third party. We searched for a South African case on AI and call recording and we found no reported case. That is not the same as saying the answer is yes or no. It means we cannot point you to a judgment, so treat any supplier who tells you it is "definitely fine" with caution.

The facts probably matter. Does the AI answer the call as your business, with a recording kept for you? Or does a separate company record the call line as a third party and keep the audio for its own purposes? The second set-up raises sharper questions under both Acts, including whether section 5 and its written consent come into play. In our reading, section 6 is the more natural fit for a business recording its own calls, because it is written for the carrying on of a business. Whether it covers your exact set-up is a question for an attorney.

What does POPIA add once you have a recording?

A recording of a caller is information relating to an identifiable person. POPIA defines personal information to include a telephone number and a person’s opinions, views or preferences, and a recording will usually contain both, plus a voice and often a name. So POPIA’s conditions apply on top of RICA. We cover the wider picture in our plain guide to POPIA and AI agents. Four sections matter most for recordings.

• Section 18, notification. When you collect personal information, you must take reasonably practicable steps to make the person aware of what is collected, who you are, the purpose, whether supplying it is voluntary, and further details such as who receives it and their right to complain to the Information Regulator, as needed to make the processing reasonable. If you collect it directly from the person, this must happen before it is collected, unless they are already aware. A short notice on the call plus a fuller privacy notice on your website is the usual way to do this.
• Section 13, purpose. Collection must be for a specific, explicitly defined and lawful purpose related to a function or activity of your business. "To book your job correctly and keep a record of what was agreed" is a purpose. "Just in case" is weak.
• Section 14, retention. Records must not be kept longer than necessary for the purpose, unless the law requires or authorises it, you reasonably need it for lawful business purposes, a contract requires it or the person consented. When you may no longer keep a record, you must destroy, delete or de-identify it as soon as reasonably practicable, and deletion must prevent reconstruction in an intelligible form. POPIA does not set a number of days.
• Section 19, security. You must take appropriate, reasonable technical and organisational measures to prevent loss, damage and unlawful access. In practice: restrict who can listen, protect logins, and know where the audio is stored.

If a supplier stores your recordings, it is probably an "operator" under POPIA, someone who processes personal information for you under a contract. Section 21 says you must ensure, through a written contract, that the operator maintains the section 19 security measures. Ask for that contract before you switch recording on.

What should the caller hear, and how long do you keep the recording?

Tell callers at the very start, before they say anything personal, that the call is recorded and why. If an AI answers, say that too, which we cover in telling customers they are talking to AI. Here is wording you can adapt.

On retention, POPIA gives no fixed period, so you set one you can defend and write it down. As an example only: a salon that records calls to confirm bookings might keep the audio for 30 days and the transcript or booking note for as long as the booking record. A business that often has disputes about quotes might keep recordings longer. The test in section 14 is whether you still need the record for the purpose you told the caller. If a customer later asks to see or delete a recording, you need to be able to find it.

1. Write down the purposeOne sentence: why you record. Use it in the call notice and the privacy notice.
2. Put the notice at the startUse wording like the above, in the languages your callers speak. Give a way to opt out and a person who can take the call.
3. Choose a retention periodPick a number of days for audio and a separate one for transcripts. Set the system to delete on its own.
4. Limit who can listenName the people with access, use individual logins and keep a log. Avoid passing recordings around on WhatsApp or email.
5. Get the operator contractIf a supplier stores the audio, get a written contract covering security, deletion and what the supplier may do with the data.

What should you ask an AI receptionist supplier?

• Is the call recorded, transcribed, or both, and can I switch either off?
• Where are recordings and transcripts stored, and who at your company can access them?
• How long do you keep them, and can I set my own period and delete a single recording on request?
• Do you use my callers’ audio or transcripts to train any model, yours or someone else’s? Is that in writing?
• Which other companies handle the audio, such as speech-to-text or storage providers, and in which countries?
• What do you do if there is a breach, and how fast will you tell me?
• Can the AI say at the start that it is an AI and that the call is recorded, in wording I control?

If a supplier cannot answer these plainly, that is the answer. When we set up an AI receptionist, we start in draft mode, where the agent drafts and the owner approves. Our own product, Never Miss a Lead, is still on a founding waitlist and has not launched.

What is still unsettled?

• Whether an AI system counts as a party to a call under section 4, and whether a supplier recording a call line for its own purposes needs written consent under section 5.
• Anything particular to your sector, such as clinics that handle health information, where further rules may apply that we have not covered here.

The cautious practice is the one in this article: tell callers up front, record for a stated purpose, keep recordings only as long as needed, restrict access and get a contract with the supplier. This is general information, not legal advice. Take your own set-up to an attorney before you rely on any of it.