Your Phone System Just Became Your Biggest Security Hole
POPI compliance isn't optional in 2025. Neither is knowing exactly who called your business, what was said, and whether your team handled that customer's personal information correctly. When a single data breach can cost you a fine of up to R10 million, a regulatory investigation, and the trust of every customer you've worked to build — your phone system is no longer just a communication tool. It's a compliance liability, or a compliance asset. The choice is yours.
Why phone calls are a data risk most businesses ignore
Every time a customer calls your business, they share personal information. Names, ID numbers, addresses, medical details, financial information — it all flows through your phone lines every single day. Most small businesses log none of it. Calls happen, conversations are forgotten, and there's no record of what was promised or what data was captured.
That's a problem POPI is specifically designed to address. The Act requires that you process personal information lawfully, that you can demonstrate accountability, and that you maintain appropriate security measures. A phone system with no call recording, no access controls, and no audit trail is hard to defend if the Information Regulator comes knocking.
Recent data breach headlines — including incidents involving billions of records globally — have made one thing clear: no organisation is too small to be a target, and regulators are increasingly focused on whether businesses had adequate safeguards in place before a breach occurred.
What POPI actually requires from your phone system
POPI doesn't prescribe exactly which tools you must use, but it does require that you:
- ▸Process personal information securely — meaning access to recorded calls should be restricted and logged
- ▸Maintain accountability — you should be able to show what happened to a customer's information
- ▸Respond to complaints and queries — which is much easier when you have a call record to refer back to
- ▸Notify the Regulator of breaches — and demonstrate the scope of what was exposed
If a customer later disputes what they were told over the phone — about a quote, a medical procedure, a property transaction — and you have no recording, you have no defence. That's a legal and reputational risk that goes well beyond a fine.
For a deeper look at how VoIP and cloud phone systems fit into your compliance obligations, read our post on POPIA compliance for VoIP and Cloud PBX in South Africa.
How NexysPBX turns your phone system into a compliance tool
NexysPBX is NexysCloud's hosted cloud phone system, built for South African businesses that need more than just the ability to make and receive calls. Here's how its features directly support POPI compliance:
Call recording with controlled access
NexysPBX records inbound and outbound calls and stores them securely in the cloud. Access is role-based — only authorised users can retrieve or download recordings. This means your receptionist can't accidentally expose a client's sensitive conversation, and your admin team can pull a specific call when a dispute arises.
This matters enormously in sectors like legal, medical, and financial services, where calls regularly contain information that qualifies as special personal information under POPI.
Audit trails that show who did what
Every action taken on the system — who accessed a recording, who exported a call log, which extension handled which call — is logged. That audit trail is your proof of accountability. It shows the Regulator, or a court, that you had systems in place and that access to personal information was controlled.
IVR and call routing that reduces human error
NexysPBX's IVR (Interactive Voice Response) system routes calls automatically based on rules you set. Fewer manual transfers mean fewer opportunities for a call containing sensitive information to land in the wrong hands. To understand more about how IVR works, see our IVR glossary post.
Voicemail-to-email with traceable delivery
When a caller leaves a voicemail, NexysPBX converts it to an audio file and sends it to a designated email address. That creates a traceable record of the message — who received it, when, and on which device. No more voicemails that get listened to and deleted with no record they ever existed.
Mobile app with the same security controls
Your staff working remotely or in the field use the NexysPBX mobile app, which applies the same call recording and access controls as the desk phone. Whether your team is in the office or on a job site, your compliance posture stays consistent.
For businesses wondering whether call recording is a legal and practical fit, our dedicated post on what call recording is and how it works is worth a read.
The industries where this matters most
Certain sectors carry higher POPI risk simply because of the nature of the information they handle:
- ▸Medical and dental practices — patient details, diagnoses, appointment reasons
- ▸Law firms — privileged communications, matter details, financial information
- ▸Estate agencies — identity documents, bond applications, financial disclosures
- ▸Logistics companies — client contracts, delivery addresses, high-value cargo details
- ▸Financial advisers and insurers — income information, policy details, claims data
If your business falls into any of these categories and you're still running calls through a basic cellphone or an old Telkom landline, you're operating without a safety net. Our guide on POPI compliance for business phone systems covers the specific obligations that apply.
What happens if you don't act
The Information Regulator has made clear that enforcement is coming. Fines of up to R10 million or up to 10 years' imprisonment for responsible parties are written into the Act. Beyond the legal consequences, a breach that exposes customer data is a reputational event. Clients talk. Losing the trust of a medical patient or a legal client is rarely recoverable.
The Telkom copper switch-off is also forcing many businesses to upgrade their phone infrastructure right now. If you're moving to a new system anyway, making it a POPI-compliant one is simply good sense.
Frequently asked questions
Does call recording under NexysPBX comply with POPI?
NexysPBX's call recording is designed with POPI requirements in mind — secure storage, role-based access, and audit logging. That said, you also need an internal policy that informs callers they may be recorded, which is a legal obligation regardless of the technology you use.
Do I need to tell callers their call is being recorded?
Yes. POPI, together with the Regulation of Interception of Communications Act (RICA), requires that parties to a call are aware it may be recorded. NexysPBX's IVR system can play a standard notification message before every call is connected.
What happens to call recordings if I cancel my subscription?
Your data belongs to you. NexysCloud provides a data export process so you can retrieve your recordings before any account closure, in line with POPI's requirements around data retention and subject access.
Is a cloud phone system more or less secure than an on-premise system?
For most South African small businesses, a cloud phone system is significantly more secure — provided it's with a reputable provider. On-premise systems require you to manage your own physical security, backups, and software updates. With NexysPBX, that's handled at the infrastructure level, with uptime maintained even during load shedding through failover connectivity options.
