Every conversation counts: why compliant call recording can no longer be an afterthought

By Ushika Gayapershad, Voice Product Manager, FirstNet Technology Services

A customer approves a change on a call. A supplier confirms a deadline. An adviser explains a recommendation. A service agent agrees to a resolution.

At the time, the conversation feels clear. Months later, when expectations differ or a complaint is raised, memories are rarely as precise. A recording may help establish what was discussed, but it should never be treated as conclusive proof on its own. Its value depends on whether the conversation was captured lawfully, protected properly and governed throughout its lifecycle.

That distinction matters because recording a call and managing a compliant recording are not the same thing.

The recorder is only the beginning

Many organisations still treat call recording as a telephony feature: switch it on, save the audio and retrieve it if something goes wrong.

That approach overlooks the more difficult questions:

• Why is the organisation recording the conversation?
• Which calls, users and platforms are in scope?
• Were the relevant people informed where required?
• Who can listen to, download or share the recording?
• How long should it be kept?
• What happens when it is placed on legal hold?
• When must it be deleted or de-identified?
• Can the organisation show who accessed or changed anything?

In South Africa, these questions sit across more than one legal and operational framework.

RICA generally prohibits the interception of communications, but contains specific exceptions. A person who is a party to a communication may record it, subject to the Act’s conditions. RICA also allows certain business communications to be intercepted for purposes such as establishing facts or keeping records, provided the relevant requirements are met, including reasonable efforts by the system controller to inform users in advance that communications may be intercepted. Whether a particular recording is lawful therefore depends on the facts and the applicable exception, not on a blanket assumption that every business call may automatically be recorded.

POPIA then governs the processing of personal information contained in recordings. It requires processing to be lawful, reasonable and connected to a defined purpose. It also addresses transparency, access, security, retention and deletion. Consent is one possible justification for processing, but it is not the only one; POPIA recognises other grounds, including contractual necessity, legal obligations and legitimate interests in appropriate circumstances.

This is why organisations should not begin with the question, “Can our phone system record calls?”

The better question is:

“Can we explain and defend how we record, use, protect, retain, share and ultimately dispose of those conversations?”

Compliance must cover the full lifecycle

A strong recording programme begins before the first call is captured.

The organisation should establish a clear and lawful purpose, define which communications are in scope and provide appropriate transparency. It should then apply suitable security and access controls, monitor how recordings are used, enforce retention rules and delete or de-identify information when there is no longer authority to retain it.

POPIA specifically requires personal information to be collected for an explicitly defined and lawful purpose. It requires reasonably practicable steps to make data subjects aware of relevant information about the collection, and appropriate technical and organisational measures to protect personal information against loss, unauthorised access and unlawful processing. Records should not be retained longer than necessary unless another lawful basis permits continued retention, and information that is no longer authorised for retention must be destroyed, deleted or de-identified as soon as reasonably practicable.

Capture is only one part of the responsibility. Compliant call recording is a lifecycle:

1. Purpose: a clear and lawful reason for recording
2. Scope: the communications, users and platforms covered
3. Transparency: people informed where required
4. Secure capture: protected from loss and unauthorised access
5. Governed use: access controlled and use monitored
6. Retention: kept for a defensible period, including legal hold
7. Deletion: destroyed or de-identified when the authority to keep it ends

Modern recording platforms can support this lifecycle with controls such as AES-256 encryption with key rotation, configurable retention policies, legal hold and secure, permission-controlled sharing. Role-based access, SSO or MFA options and detailed audit logs can further restrict access and record actions such as log-ins, playback, downloads, sharing, permission changes and retention-setting changes.

These controls are important, but the technology does not decide an organisation’s lawful purpose, write its policies or determine the correct retention period. Compliance remains an outcome of the organisation’s legal basis, governance, configuration and day-to-day operating practices.

One communications estate, several capture methods

The recording challenge is becoming more complex because business conversations no longer happen on a single PBX.

Calls and meetings may take place across Microsoft Teams, Zoom, Cisco, Webex, Avaya, RingCentral, contact-centre platforms and mobile services. Current Smarsh material supports capture across a range of these environments, but the specific integration, prerequisites and capture mode differ by platform.

For example, Smarsh’s Zoom integration uses Zoom event notifications and can process recordings from Zoom Meetings, Webinars, Zoom Phone and Zoom Contact Center. It also depends on the required Zoom licensing, permissions and configuration being in place.

The practical lesson is simple: avoid phrases such as “any platform” or “every call is always captured” unless the exact environment has been technically validated.

A credible design starts by identifying:

• the platforms and call types that must be covered;
• the users, agents, numbers or channels in scope;
• the available integration for each platform;
• the required recording and notification configuration;
• failure monitoring and operational ownership; and
• the retention, residency and access requirements.

Deployment can also vary. Current Smarsh material describes cloud, on-premises and hybrid options, allowing the architecture to be aligned with the organisation’s IT strategy and sovereignty requirements, but the applicable hosting region and deployment design still need to be confirmed for each customer.

From protected record to useful intelligence

The first responsibility is to capture and govern the recording correctly. Once that foundation is in place, the same voice data can offer wider operational value.

Depending on the product tier, licence and configuration, capabilities may include:

• searchable transcription and summarisation;
• advanced playback, tagging and call notes;
• quality-assurance evaluations and scorecards;
• manual or automated redaction of sensitive information;
• synchronised screen recording;
• multilingual transcription;
• sentiment and detailed voice analysis; and
• configurable analytics dashboards.

The important qualification is “depending on the tier and configuration”.

Current product material distinguishes core call recording from advanced recording and conversation analytics. Advanced Recording adds capabilities such as QA, reporting, screen capture and manual or API-driven redaction. Conversation Analytics introduces further functions such as automated transcription, automated redaction, sentiment analysis, multilingual transcription, automated QA and custom dashboards.

Used responsibly, these tools can help organisations find relevant conversations faster, improve coaching and identify recurring themes across customer interactions. They should not, however, be treated as infallible. Transcripts, summaries, sentiment indicators and automated scorecards are analytical aids. Their outputs should be reviewed in context, particularly where decisions may materially affect a customer or employee.

POPIA also requires further processing to remain compatible with the purpose for which the information was collected. This becomes particularly important when recordings captured for one purpose are later used for analytics, training, employee evaluation or automated decision support.

CallCabinet is now part of Smarsh

Smarsh acquired CallCabinet in February 2025, bringing CallCabinet’s voice-recording and analytics technology into the broader Smarsh communications-data and intelligence portfolio. Smarsh now presents CallCabinet as part of its call-recording and analytics offering, covering voice environments such as UCaaS, CCaaS, PBX, mobile and trading platforms, with specific supported integrations including Microsoft Teams, Zoom, Cisco, Avaya and RingCentral.

For South African organisations, the value is not simply access to a platform. It is the ability to apply that platform sensibly to a real communications environment.

FirstNet delivers and supports compliance-recording solutions powered by CallCabinet and Smarsh. Our role includes customer discovery, solution design, onboarding, configuration and ongoing support, with optional managed-service capabilities where required. Current FirstNet material positions the offering across Microsoft Teams, Zoom, PBX/SIP and contact-centre environments, while also making clear that final compliance depends on the customer’s policies, configuration and obligations.

That local layer matters. Recording scope, retention, residency, access roles and platform integrations should be confirmed before a solution is proposed, not discovered after deployment.

Every conversation counts, but governance counts more

The purpose of compliant call recording is not to store audio indefinitely or to record every conversation simply because the technology allows it.

It is to create a controlled and trustworthy record of the conversations an organisation has a lawful and legitimate reason to retain.

Done properly, that record can support audits, investigations, customer resolution and operational improvement. With the right licences and governance, it may also become a valuable source of quality and customer-experience insight.

But the starting point remains the same:

Know why you are recording. Be transparent where required. Protect the information. Limit access. Retain it for a defensible period. Use it only for appropriate purposes. Delete it when the authority to keep it ends.

Because every conversation may count, and how you manage it counts just as much.

This article provides general information and does not constitute legal advice. Organisations should obtain appropriate legal and regulatory guidance for their specific circumstances, sectors and recording use cases.

Related reading

Services: compliant call recording and analytics, Microsoft Teams Calling, Zoom Phone and Contact Centre and Smartz contact centre.

Answers: Do we need to tell callers that calls are recorded?, Isn’t Teams or Zoom native recording enough?, How long are recordings stored? and Who can access recordings?

Sources

1. Smarsh, “Smarsh Acquires CallCabinet for Major Expansion, Bringing Leading Edge Technology to the Voice Market” (4 February 2025).

About the author

Ushika Gayapershad is Voice Product Manager at FirstNet Technology Services.