Every conversation counts: why call recording must be compliant

By Ushika Gayapershad, Voice Product Manager, FirstNet Technology Services

A customer approves a change on a call. A supplier confirms a deadline. An adviser explains a recommendation. A service agent agrees to a resolution.

At the time, the conversation feels clear. Months later, when expectations differ or a complaint is raised, memories are rarely as precise. A recording may help show what was discussed. But it should never be treated as conclusive proof on its own. Its value depends on three things. Was the conversation captured lawfully? Was it protected properly? Was it governed throughout its lifecycle?

That distinction matters because recording a call and managing a compliant recording are not the same thing.

The recorder is only the beginning

Many organisations still treat call recording as a phone system feature: switch it on, save the audio and get it back if something goes wrong.

That approach misses the harder questions:

• Why is the organisation recording the conversation?
• Which calls, users and platforms are in scope?
• Were the relevant people informed where required?
• Who can listen to, download or share the recording?
• How long should it be kept?
• What happens when it is placed on legal hold?
• When must it be deleted or de-identified?
• Can the organisation show who accessed or changed anything?

In South Africa, these questions sit across more than one legal and operational framework.

RICA generally bans the interception of communications, but it has exceptions. A person who is a party to a call may record it, under the Act’s conditions. RICA also lets some business communications be intercepted, for example to establish facts or keep records. The rules must be met. For example, the system controller must make reasonable efforts to tell users in advance that calls may be intercepted. So whether a recording is lawful depends on the facts and the exception that applies. You cannot simply assume that every business call may be recorded.

POPIA then governs how personal information in recordings is processed. Processing must be lawful, reasonable and linked to a defined purpose. POPIA also covers transparency, access, security, retention and deletion. Consent is one possible basis for processing, but not the only one. POPIA allows other grounds too. These include contractual necessity, legal obligations and legitimate interests, in the right circumstances.

This is why organisations should not begin with the question, “Can our phone system record calls?”

The better question is:

“Can we explain and defend how we record, use, protect, retain, share and ultimately dispose of those conversations?”

Compliance must cover the full lifecycle

A strong recording programme begins before the first call is captured.

The organisation should set a clear and lawful purpose. It should define which communications are in scope and be open with people about recording. Then it should apply suitable security and access controls, and monitor how recordings are used. It should enforce retention rules. It should delete or de-identify information once there is no longer authority to keep it.

POPIA requires personal information to be collected for a clear and lawful purpose. You must take reasonably practicable steps to tell people about the collection. POPIA also requires suitable technical and organisational measures. These protect personal information against loss, unauthorised access and unlawful processing. Records should not be kept longer than needed, unless another lawful basis allows it. Information you may no longer keep must be destroyed, deleted or de-identified as soon as reasonably practicable.

Capture is only one part of the responsibility. Compliant call recording is a lifecycle:

1. Purpose: a clear and lawful reason for recording
2. Scope: the communications, users and platforms covered
3. Transparency: people informed where required
4. Secure capture: protected from loss and unauthorised access
5. Governed use: access controlled and use monitored
6. Retention: kept for a defensible period, including legal hold
7. Deletion: destroyed or de-identified when the authority to keep it ends

Modern recording platforms can support this lifecycle with controls such as AES-256 encryption with key rotation, configurable retention policies, legal hold and secure, permission-controlled sharing. Role-based access, SSO or MFA options and detailed audit logs can further limit access. They also record actions such as log-ins, playback, downloads, sharing, permission changes and retention-setting changes.

These controls are important. But the technology does not decide an organisation’s lawful purpose, write its policies or set the correct retention period. Compliance still comes from the organisation’s legal basis, governance, setup and day-to-day practices.

One communications estate, several capture methods

Recording is getting more complex because business conversations no longer happen on a single PBX.

Calls and meetings may happen across Microsoft Teams, Zoom, Cisco, Webex, Avaya, RingCentral, contact-centre platforms and mobile services. Current Smarsh material supports capture across a range of these. But the specific integration, prerequisites and capture mode differ by platform.

For example, Smarsh’s Zoom integration uses Zoom event notifications. It can process recordings from Zoom Meetings, Webinars, Zoom Phone and Zoom Contact Center. It also needs the required Zoom licensing, permissions and configuration to be in place.

The practical lesson is simple: avoid phrases such as “any platform” or “every call is always captured” unless the exact environment has been technically validated.

A credible design starts by identifying:

• the platforms and call types that must be covered;
• the users, agents, numbers or channels in scope;
• the available integration for each platform;
• the required recording and notification configuration;
• failure monitoring and operational ownership; and
• the retention, residency and access requirements.

Deployment can also vary. Current Smarsh material describes cloud, on-premises and hybrid options. This lets the architecture match the organisation’s IT strategy and sovereignty requirements. But the hosting region and deployment design still need to be confirmed for each customer.

From protected record to useful intelligence

The first job is to capture and govern the recording correctly. Once that is in place, the same voice data can offer wider operational value.

Depending on the product tier, licence and configuration, capabilities may include:

• searchable transcription and summarisation;
• advanced playback, tagging and call notes;
• quality-assurance evaluations and scorecards;
• manual or automated redaction of sensitive information;
• synchronised screen recording;
• multilingual transcription;
• sentiment and detailed voice analysis; and
• configurable analytics dashboards.

The important qualification is “depending on the tier and configuration”.

Current product material distinguishes core call recording from advanced recording and conversation analytics. Advanced Recording adds features such as QA, reporting, screen capture and manual or API-driven redaction. Conversation Analytics adds more, such as automated transcription, automated redaction, sentiment analysis, multilingual transcription, automated QA and custom dashboards.

Used responsibly, these tools can help organisations find relevant conversations faster, improve coaching and spot recurring themes in customer interactions. But they should not be treated as always right. Transcripts, summaries, sentiment indicators and automated scorecards are analytical aids. Their outputs should be checked in context. This matters most where decisions may materially affect a customer or employee.

POPIA also requires further processing to stay compatible with the purpose for which the information was collected. This matters most when recordings made for one purpose are later used for analytics, training, staff evaluation or automated decision support.

CallCabinet is now part of Smarsh

Smarsh acquired CallCabinet in February 2025, bringing CallCabinet’s voice-recording and analytics technology into the wider Smarsh portfolio for communications data and intelligence. Smarsh now presents CallCabinet as part of its call-recording and analytics offering. It covers voice environments such as UCaaS, CCaaS, PBX, mobile and trading platforms. Supported integrations include Microsoft Teams, Zoom, Cisco, Avaya and RingCentral.

For South African organisations, the value is not just access to a platform. It is the ability to apply that platform sensibly to a real communications environment.

FirstNet delivers and supports compliance-recording solutions powered by CallCabinet and Smarsh. We handle customer discovery, solution design, onboarding, setup and ongoing support. Optional managed services are available where needed. Current FirstNet material places the offering across Microsoft Teams, Zoom, PBX/SIP and contact-centre environments. It also makes clear that final compliance depends on the customer’s policies, setup and obligations.

That local layer matters. Recording scope, retention, residency, access roles and platform integrations should be confirmed before a solution is proposed. They should not be discovered after deployment.

Every conversation counts, but governance counts more

The purpose of compliant call recording is not to store audio forever. Nor is it to record every conversation just because the technology allows it.

It is to create a controlled, trustworthy record of the conversations an organisation has a lawful and legitimate reason to keep.

Done well, that record helps with audits, investigations, solving customer issues and improving how you work. With the right licences and governance, it can also give you useful quality and customer insight.

But the starting point remains the same:

Know why you are recording. Be transparent where required. Protect the information. Limit access. Retain it for a defensible period. Use it only for appropriate purposes. Delete it when the authority to keep it ends.

Because every conversation may count, and how you manage it counts just as much.

This article gives general information. It is not legal advice. Organisations should get proper legal and regulatory guidance for their own circumstances, sectors and recording use cases.

Related reading

Services: compliant call recording and analytics, Microsoft Teams Calling, Zoom Phone and Contact Centre and Smartz contact centre.

Answers: Do we need to tell callers that calls are recorded?, Isn’t Teams or Zoom native recording enough?, How long are recordings stored? and Who can access recordings?

Sources

1. Smarsh, “Smarsh Acquires CallCabinet for Major Expansion, Bringing Leading Edge Technology to the Voice Market” (4 February 2025).

About the author

Ushika Gayapershad is Voice Product Manager at FirstNet Technology Services.