POPIA Compliance for VoIP and Cloud PBX in South Africa

POPIA — the Protection of Personal Information Act — applies fully to your VoIP and cloud PBX setup. Every recorded call, voicemail, contact record and CRM note involves personal information, and the way your provider hosts, transmits and stores that data matters. This guide goes deeper on the VoIP/cloud-PBX-specific compliance issues: where your data flows, how it’s protected, and the practical configuration that keeps you on the right side of the law.

What POPIA expects from a VoIP/cloud PBX setup

The principles are the same as for any data processing — lawfulness, transparency, security, minimisation, retention, access rights — but the application to VoIP looks specific:

• Calls in transit carry voice as data; that data must be protected.
• Call recordings are personal information at rest.
• Voicemail is personal information at rest.
• Cloud hosting means understanding where the data lives and who has access.
• Caller ID and call logs are personal information.
• Integrations (CRMs, helpdesks) extend the compliance perimeter.

A modern, reputable provider handles most of this by default. A neglected setup or a poor provider can be a slow-burning compliance problem.

RICA — the other law

POPIA isn’t the only piece of legislation that applies. RICA governs whether you can record calls in the first place. The business-purpose exception generally covers you, but you still need to handle the recordings POPIA-correctly afterwards. The familiar “this call may be recorded for quality and training purposes” notice is the cleanest way to satisfy POPIA’s transparency requirement. (See What Is Call Recording? for the full RICA/POPIA breakdown.)

VoIP/cloud-specific compliance considerations

Encryption in transit

Voice traffic between your devices and the cloud platform should be encrypted (typically using TLS/SRTP). Without it, calls travelling over the internet could in principle be intercepted. Ask your provider: “Are voice and signalling encrypted in transit?”

Encryption at rest

Stored recordings, voicemails and contact data should be encrypted at rest in the provider’s data centre. Ask: “Are recordings encrypted at rest?”

Hosting location and access

You should know where your data is hosted and who can access it. South African or POPIA-aligned hosting with documented access controls is best practice. Ask: “Where is my data stored? Who has access to it?”

Role-based access for your team

Internally, you should be able to restrict who can listen to recordings, view contact data and pull reports. Individual logins (not shared accounts) make actions auditable.

Retention controls

Set an automatic retention/deletion policy for recordings — only as long as you genuinely need them for the stated purpose. Most businesses settle on 3–12 months.

Audit trails

The platform should log who did what (especially access to recordings) so you can demonstrate compliance.

Consent and notification

A recording notice (“this call may be recorded”) at the start of calls, or in your IVR greeting, satisfies POPIA’s transparency requirement. Your privacy policy should reference call recording too.

Data subject access

Have a process for handling access requests — individuals can ask what you hold about them. A reputable platform makes it easy to retrieve specific calls and records.

A VoIP/cloud PBX POPIA configuration checklist

• ✔ Voice and signalling encrypted in transit (TLS/SRTP)
• ✔ Recordings encrypted at rest
• ✔ POPIA-aligned hosting and clear access policy
• ✔ Role-based access controls in place
• ✔ Recording notice in IVR or call introductions
• ✔ Automatic retention / deletion policy configured
• ✔ Individual logins with audit trail
• ✔ Privacy policy references call recording
• ✔ Documented process for data subject access requests
• ✔ Provider contract addresses POPIA alignment

What a good provider does for you

A reputable VoIP/cloud PBX provider builds most of this in by default — you inherit best practice rather than building it from scratch. Even better, the same applies to extensions of your setup like missed call recovery, where consent language and secure storage of SMS threads come built in.

Common pitfalls

• Using a provider that won’t answer hosting/encryption questions clearly. Walk away.
• Recording everything indefinitely. Set a retention policy.
• Shared logins for recording playback. Use individual accounts.
• No recording notice. The “this call may be recorded” line is cheap and important.
• Forgetting about call logs. They’re personal information too.
• Treating POPIA as one-and-done. It’s an ongoing posture.

Frequently asked questions

Is cloud telephony riskier than on-premise for POPIA?

Properly configured, cloud is typically safer — encryption, access controls, retention automation and audit trails come built in.

Does POPIA prevent us from recording calls?

No. POPIA governs how recordings are handled, not whether you can make them (RICA covers that and generally permits business recording).

What if our provider is overseas?

The location matters less than the alignment. A POPIA-aligned provider with documented access controls and contractual commitments can be acceptable; ask the questions before signing.

Make your VoIP setup POPIA-ready

NexysCloud builds POPIA-aligned controls into every cloud phone system — encryption, access controls, retention and audit trails, all handled.

Book a compliance review or call 010 110 7100.