Your Customer Data Is Safe With Us — Here's How NexysCloud Protects Your POPI Rights

Banks aren't the only ones handling sensitive customer information. If you're running a plumbing company, a medical practice, or an estate agency, you're collecting personal data every single day — names, ID numbers, contact details, medical histories, financial circumstances. The Protection of Personal Information Act (POPI) says you must protect all of it, and the Information Regulator is not shy about enforcing penalties. The good news is that getting your phone system right is one of the most practical steps you can take toward genuine compliance.

What POPI Actually Requires From Your Business

POPI applies to any organisation that collects, stores, or processes the personal information of South Africans. That means almost every business in the country — not just banks and insurers.

Under the Act, you must:

• ▸Collect only what you need — no gathering data "just in case"
• ▸Store it securely — unauthorised access must be prevented
• ▸Keep it only as long as necessary — then delete or anonymise it
• ▸Notify affected parties if there is a breach
• ▸Appoint an Information Officer responsible for compliance

The penalty for non-compliance can reach R10 million or up to 10 years' imprisonment for serious offences. Most small businesses aren't facing that extreme, but regulatory investigations and reputational damage are very real risks.

Where Your Phone System Fits Into POPI Compliance

Most business owners focus their POPI efforts on websites and email newsletters. That's sensible, but your phone system is quietly handling some of the most sensitive data in your business:

• ▸Call recordings containing customer complaints, financial discussions, or medical information
• ▸Voicemail messages that may include personal details left by callers
• ▸IVR inputs where callers key in account numbers or ID digits
• ▸Call logs showing who contacted you, when, and how often
• ▸Contact data synced to your phone system's directory

All of this falls squarely under POPI. If it's stored on an unmanaged server, backed up to a personal Dropbox, or sitting on an old Telkom PABX with no access controls, you have a problem. The Telkom copper switch-off is already forcing thousands of SA businesses to migrate away from legacy systems — and that migration is a good moment to fix your data practices at the same time.

How NexysPBX Is Built With POPI in Mind

NexysPBX is NexysCloud's hosted cloud phone system, and it was designed with South African data obligations in mind from the ground up.

Call Recording Storage and Access Controls

Call recording is one of the biggest POPI risk areas for businesses. Under NexysPBX, recordings are stored in a secured cloud environment with role-based access — meaning only the people who are supposed to hear a recording can access it. Managers can set retention periods so that recordings are automatically purged once they're no longer needed, rather than sitting on a server indefinitely.

For more on what call recording actually involves and the legal context around it, see our guide to call recording.

Voicemail-to-Email With Controlled Delivery

Voicemail messages can contain surprisingly sensitive information — a patient describing symptoms, a client mentioning a legal matter, a customer sharing their ID number. NexysPBX delivers voicemail to email with controls over which addresses receive those messages, so personal information doesn't land in shared inboxes or personal accounts outside your business domain.

Encrypted Transmission

Calls made over NexysPBX use encrypted voice-over-IP protocols, which means conversations aren't transmitted as plain audio across the public internet. This matters particularly for medical practices, law firms, and financial services businesses where confidentiality is both a legal and professional obligation.

Number Portability Without Data Loss Risk

Moving your number to NexysPBX through number porting is straightforward and doesn't require you to hand sensitive configuration data to multiple third parties. The process is managed end-to-end, reducing the number of touchpoints where customer data could be exposed.

Specific Sectors With Higher POPI Obligations

Some industries carry heavier data protection responsibilities than others.

Medical and dental practices — Patient records, appointment details, and clinical notes are among the most sensitive categories under POPI. Any phone system that stores or transmits these needs to be hosted in a secure environment with proper access controls. Our post on missed calls in medical practices touches on this from a patient experience angle — but the compliance dimension matters just as much.

Law firms — Legal privilege depends on confidentiality. Call recordings between attorneys and clients need careful handling, and you need documented processes for how long those recordings are kept. See our guide for SA law firms for more context on the communication challenges firms face.

Estate agencies — You're collecting financial information, ID documents, and FICA data as part of normal business. Your phone system, including voicemails and recorded calls, forms part of that data environment.

Trades businesses — It may seem low-risk, but plumbers, electricians, and contractors are still collecting names, addresses, and contact numbers. POPI applies.

Practical Steps to Align Your Phone System With POPI

You don't need a legal team to take meaningful action. Start here:

1. ▸Audit what your current system stores — call logs, voicemails, recordings. Know where it all lives.
2. ▸Set retention limits — decide how long you actually need recordings and voicemails, then enforce those limits.
3. ▸Restrict access — not everyone in the business needs to hear every call recording. Apply role-based controls.
4. ▸Document your processes — your Information Officer needs to be able to show the regulator what controls are in place.
5. ▸Use a hosted system with a reputable provider — on-premise hardware that you manage yourself carries far more compliance risk than a properly managed cloud phone system.
6. ▸Ensure your provider signs a data processing agreement — if a third party processes personal information on your behalf, POPI requires a written agreement in place.

Frequently Asked Questions

Does POPI apply to small businesses?

Yes, without exception. POPI applies to any person or organisation that processes personal information about South Africans, regardless of size. A sole trader with ten clients is subject to the same principles as a large corporation.

Can I record customer calls legally under POPI?

You can, provided you notify callers that the call is being recorded and you handle those recordings in line with POPI's security and retention requirements. Most businesses include a recorded announcement at the start of the call. NexysPBX supports this through its IVR functionality.

What counts as personal information under POPI?

The Act defines it broadly: names, contact details, ID numbers, financial information, health data, location data, online identifiers, and more. For most businesses, almost everything a customer tells you qualifies.

What should I do if there's a data breach involving my phone system?

POPI requires you to notify the Information Regulator and affected data subjects as soon as reasonably possible after discovering a breach. Document what happened, what data was affected, and what steps you're taking to contain it. Having a hosted system with audit logs makes this investigation far easier than trying to piece together what happened on an unmanaged on-premise system.

Ready to get your phone system POPI-ready?

NexysCloud's team can walk you through what NexysPBX includes, how call recording and voicemail storage are managed, and what documentation you need to satisfy your compliance obligations — in plain language, without the legal jargon.