POPIA has been in force long enough that the early architectural debates are settled. The question now is operational — what does a defensible call recording stack look like for a South African contact centre, end to end?
The pattern we deploy by default has four components: explicit consent capture at the start of every recorded interaction, encryption at rest with key separation, role-based access with full audit trail, and time-bound retention enforced by the platform rather than by policy alone.
None of this is exotic. All of it is missing from a meaningful share of the production environments we audit. If your recording stack does not have all four, you have an exposure — regardless of which platform you are on.