If you run a small business in South Africa and you use an AI receptionist to answer calls, you are processing personal information the moment it picks up. Caller names, phone numbers, voice recordings, and message content all fall under POPIA. The 2025 amendments that took effect in April changed how you handle telephonic consent and WhatsApp opt-outs, and ignoring them means the Information Regulator can knock. By the end of this piece you will know the exact steps to stay compliant without hiring a lawyer or tearing up your workflow.
Step 1: Establish a lawful basis for processing caller data
POPIA requires a lawful basis before you collect or store any personal information. For an AI receptionist handling caller names, numbers, voice recordings, and message content, you must define both a lawful basis and a stated purpose. Most small businesses rely on legitimate interest rather than explicit consent, because asking every caller to opt in before the AI can help them kills the point of automation.
Legitimate interest means the processing serves a real business need (answering inquiries, booking appointments, routing urgent calls) and the caller expects it. Document your legitimate-interest assessment in writing: what you collect, why you need it, how long you keep it, and why the benefit outweighs any privacy risk. Keep that document where the Information Regulator can see it if they ask.
AskAndBook logs every call with a transcript and summary, which means you are storing voice data and text. Your lawful basis covers both the live call (answering questions, booking) and the retention of the transcript (quality checks, dispute resolution, compliance audit). If you also use the transcript for marketing follow-up, state that purpose separately and make sure the caller knows.
Step 2: Announce call recording and retention at the start of every call
South African law lets a party to the call record it, but POPIA still requires a lawful basis to keep the recording, and businesses should take steps to inform callers. A documented legitimate-interest basis plus a clear announcement is the standard approach for business call recording, not relying on consent alone.
Your AI receptionist should say something like: "This call is recorded for quality and training. If you prefer not to be recorded, please let me know and I can take a message instead." That gives the caller notice and an out. It also creates an audit trail, because the first few seconds of every transcript will show you announced it.
Set a retention limit and write it down. Six months is typical for most SMBs (long enough to resolve billing disputes or check what was promised), but medical practices often keep call records for two years to match patient-file retention. Whatever you choose, delete recordings when the clock runs out. AskAndBook does not auto-delete; you or your admin must purge old transcripts, so put a calendar reminder every quarter.
Step 3: Handle the 2025 telephonic-consent and WhatsApp amendments
The 2025 POPIA Regulations amendments took effect on 17 April 2025. They let you request marketing consent by email, phone, SMS, or WhatsApp, but telephonic and automated-call requests must be recorded. If your AI receptionist asks a caller, "May we send you property alerts?" that question and the answer must be logged. AskAndBook transcripts cover this, but only if the AI asks the question and logs the reply. Train your knowledge base to include the consent script and check a few transcripts each month to confirm it happened.
The amendments also say opt-out cannot itself count as consent under section 69(2), which matters if you use the AI for outbound marketing calls. Pre-ticking a box or treating silence as a yes is out. The caller must agree, and the recording must show it.
Data-subject requests (access, correction, deletion) and objections must now be accepted through accessible, free channels, including WhatsApp. If a caller messages your business WhatsApp saying "delete my booking transcript," you cannot ignore it or demand they email instead. AskAndBook offers an optional WhatsApp assistant add-on (R4.99 per conversation or prepaid bundles: 20 for R95, 50 for R225, 100 for R429) that logs inbound messages, so you have a record when someone asks for deletion. Route those requests to one person on your team and respond within two weeks (the Regulator does not publish a hard deadline, but two weeks is the safe floor).
Step 4: Secure storage and access control
POPIA compliance requires secure storage and a way to honor access or deletion requests. That means your AI receptionist platform must encrypt data in transit and at rest, restrict access to people who need it, and let you delete a specific call record when a data subject asks.
Mental accounting says R1,290 is less than two missed patient calls or one lost property lead, so the compliance overhead pays for itself before you count the time saved.
AskAndBook stores call transcripts and summaries on cloud infrastructure with encryption. You control who on your team can log in and read transcripts (most practices limit it to the practice manager and the owner). If a caller emails asking for a copy of their transcript, search by phone number or date, export the record, and send it. If they ask for deletion, delete the transcript and confirm in writing. Keep a log of every deletion request and your response; the Regulator will want proof you acted.
One limitation: AskAndBook will not scrub a caller's details from your CRM or your Google Calendar if you have synced the booking. The Business plan can push bookings into your CRM via webhook, but once the data lives in your CRM, you own the deletion there too. Check your CRM's POPIA settings and make sure you can search and delete by phone number or email.
Step 5: Price transparency and the real cost of compliance
Most small businesses worry compliance will cost thousands. It does not, if you pick tools that handle the technical pieces. For most SMBs, a production-ready AI receptionist costs R199 to R1,500 per month, plus a one-time setup fee of R0 to R5,000 depending on integration depth. AskAndBook's Starter plan is R1,290 per month and includes 200 minutes, then R3.95 per minute after that. No setup fee, no per-user charge, and the transcript logging that POPIA demands is built in from day one.
Compare that to the hidden cost of a missed call. A dental practice loses about R650 every time a new-patient inquiry goes to voicemail and never calls back (one crown prep pays for a month of the AI). A property agent who misses an after-hours viewing request loses the commission, which in Johannesburg averages R15,000 on a sale. Mental accounting says R1,290 is less than two missed patient calls or one lost property lead, so the compliance overhead pays for itself before you count the time saved.
If you need more than the Starter plan offers, the Pro plan (R2,990/month, 500 minutes included, then R3.50/min) adds analytics, email summaries, sentiment analysis, and smart transfer, so the AI dials your cell while staying on the line and resumes the call if you do not pick up. The Business plan (R5,990/month, 1,200 minutes included, then R3.25/min) adds webhook integration and API access, which matters if you run multi-location franchises or you want bookings pushed straight into your practice-management software.
Step 6: Document your POPIA manual and train your team
The Information Regulator expects a POPIA manual (or at least a processing-activities register) that lists what personal information you collect, why, how long you keep it, and who can access it. Your AI receptionist is one processing activity. Write it down: "We use AskAndBook to answer inbound calls. It collects caller name, phone number, message content, and voice recordings. Lawful basis: legitimate interest (answering inquiries and booking appointments). Retention: six months, then deleted. Access: practice manager and owner."
Train your team on two things: how to respond to a data-subject request ("Please send the request to [email], we will reply within 14 days") and how to check that the AI announced recording. Listen to three random call transcripts each month. If the announcement is missing, update your knowledge base and test again. I have seen practices skip this step and then scramble when the Regulator sends a compliance notice; ten minutes a month prevents that panic.
Most small businesses think POPIA is about saying no to customers. It is actually about saying yes faster, because a compliant system lets you follow up, remind, and re-engage without legal risk.
Step 7: WhatsApp follow-up and the consent trail
AskAndBook offers an optional WhatsApp assistant that follows up after a call and answers inbound WhatsApp messages. If you use it to send booking confirmations or property alerts, you need consent before the first message. The 2025 amendments let you ask for that consent on the call itself, as long as the AI records the question and the answer.
Script it clearly: "May I send you a WhatsApp confirmation and a reminder the day before your appointment?" If the caller says yes, the transcript is your proof. If they say no, flag the booking so your admin does not send the message. The WhatsApp assistant costs R4.99 per conversation or prepaid bundles (20 for R95, 50 for R225, 100 for R429), and every conversation is logged, so you have an audit trail when the Regulator asks how you got consent.
One contrarian take: most small businesses think POPIA is about saying no to customers. It is about saying yes faster, because a compliant system lets you follow up, remind, and re-engage without legal risk. The practices that treat POPIA as a checklist to finish are the ones that lose patients to competitors who text a reminder two days before the appointment.
What to do before you flip the switch
Before you route calls to your AI receptionist, check five things: your legitimate-interest assessment is written down, the AI announces call recording in the first ten seconds, you have a calendar reminder to delete old transcripts every quarter, one person on your team owns data-subject requests, and your POPIA manual lists the AI as a processing activity. That is the compliance floor. Everything else (analytics, sentiment, CRM webhooks) is a business decision, not a legal one.
AskAndBook is built for South African small businesses that want a front desk without the admin overhead. It answers calls in English and switches mid-call to isiZulu or Afrikaans when a caller prefers it. It books appointments on the spot (Starter confirms or captures details for callback; Pro and Business sync live with Cal.com and Google Calendar). It transfers to a human on every plan, and the Pro and Business tiers add smart transfer so the AI dials your cell, waits, and takes a message if you are in a meeting. Every call is logged with a transcript and summary, which is what POPIA demands and what you need when a caller disputes what was said.
The Starter plan (R1,290/month, 200 minutes included, then R3.95/min) fits most single-location practices and agencies. The Pro plan (R2,990/month, 500 minutes included, then R3.50/min) suits multi-practitioner clinics and real-estate teams that need sentiment tracking and email summaries. The Business plan (R5,990/month, 1,200 minutes included, then R3.25/min) is for franchises and firms that push bookings into their own CRM via webhook. Add SMS notifications (R3.50 per SMS or bundles: 50 for R149, 200 for R449, 500 for R799) for booking confirmations and reminders, and add the WhatsApp assistant (R4.99 per conversation or bundles: 20 for R95, 50 for R225, 100 for R429) for follow-up and inbound queries. No setup fee, no per-user charge. You pay the plan plus any minutes over the monthly pool, and you can cancel anytime.
POPIA compliance is not a project you finish; it is a habit you build. Check your transcripts monthly, delete old recordings quarterly, and respond to data-subject requests within two weeks. Do that and the Information Regulator will never be your problem. Skip it and a single complaint can cost you more than a year of the AI.
Frequently asked questions
Does POPIA require consent to record business calls?
No. POPIA requires a lawful basis, and legitimate interest is enough for business calls. You should still announce the recording at the start of the call and give the caller an out. Consent is one lawful basis, but it is not the only one, and it is often the hardest to manage because the caller can withdraw it anytime.
How long can I keep call recordings under POPIA?
POPIA does not set a specific retention period; it says you must delete personal information when you no longer need it for the original purpose. Six months is common for most SMBs, two years for medical practices that need to match patient-file retention. Write your retention limit in your POPIA manual and stick to it.
Do I need the caller's permission to send a WhatsApp follow-up?
Yes. The 2025 amendments let you ask for marketing consent by phone, and the AI must record the question and the answer. If the caller agrees on the call, the transcript is your proof. If they do not agree, do not send the WhatsApp message. Treating silence or opt-out as consent is not allowed under section 69(2).
What happens if a caller asks me to delete their transcript?
You must delete it within two weeks and confirm the deletion in writing. Keep a log of every deletion request and your response, because the Information Regulator will want proof you acted. If the booking also synced to your CRM or calendar, delete it there too.
Can I use the AI receptionist for outbound marketing calls?
Yes, but the 2025 amendments require recording of any telephonic marketing-consent request, and opt-out cannot count as consent. The caller must agree, and the recording must show it. AskAndBook is designed for inbound calls; if you need outbound voice agents, look at AskAndBook Studio for a custom build.
What is the cheapest POPIA-compliant AI receptionist for a single-location practice?
AskAndBook Starter is R1,290 per month with 200 minutes included, then R3.95 per minute. It logs every call with a transcript, announces recording, and lets you delete individual records when a data subject asks. That covers the POPIA floor. Other entry-level AI receptionists start around R25 to R100 per month, but many do not include transcript logging or the retention controls POPIA demands, so you pay less and get a compliance gap.
