The facial recognition the South African Police Service (Saps) wants built into its new body cameras is legally prohibited by default, and the police have no blanket exemption from the country’s data protection law, the Information Regulator has told TechCentral.
“There is a general prohibition against processing SPI,” Information Regulator spokesperson Nomzamo Zondi said, using the Protection of Personal Information Act’s term for “special personal information”, which includes biometrics. Where a project involves SPI or the personal information of children, “such processing must be done in accordance with the exceptions contained in Popia”.
Nor can the police sidestep the act. “Saps is not excluded from the operations of the act and must still comply with the act,” Zondi said.
TechCentral reported last week that the State IT Agency (Sita) had published a tender, RFB 3286-2026, requiring that body-worn cameras bought for the Saps have the “ability to conduct facial recognition and integrate with various security platforms and have warning capabilities”. The dashboard cameras must do automatic number plate recognition, and the video management software analytics including “motion detection, facial recognition, licence plate recognition”. Bids close at 11am on 29 September.
Section 26 of Popia lists biometric information alongside race, religious beliefs, political persuasion, trade union membership, health and sex life as categories that may not be processed at all unless one of the narrow exceptions in section 27 applies. Those include consent and processing necessary for the establishment, exercise or defence of a right or obligation in law. The regulator may also authorise processing in the public interest, subject to safeguards.
Section 27 exemption
The tender does not say which it would rely on, because it does not say what the police would use facial recognition for. The only place the specification describes such a system working is under user management, where facial recognition is one of three ways to release a camera from its docking station – a function that identifies the officer rather than whoever the camera is pointed at.
That reading does not put the tender outside Popia either. An officer’s face is biometric information, too, and processing an employee’s special personal information still needs a section 27 exemption.
Beyond the special category, Zondi said lawfulness must always be assessed against the eight conditions for lawful processing in chapter 3 of Popia, “considered holistically and in light of the specific factual circumstances of each matter”.
The regulator stopped short of pronouncing on the tender itself. It has not been consulted on the project, Zondi said, though she noted there is no legal requirement that it be notified, and “as such the regulator neither approves nor disapproves the particular implementation approach”. Any determination would require consideration of all the relevant facts, she said, and could come through its statutory powers, among them investigation, assessment and prior authorisation.
Sita did not answer questions about what the facial recognition requirement is for or on what legal basis it was written into the specification, saying it prefers to deal with queries inside the procurement process. “As part of governance, the preferred approach is to respond to questions within the tender process protocols than through the media,” said Tlali Tlali, head of corporate affairs at Sita.
Sita scheduled a bidders’ briefing for Monday, at which, Tlali said, prospective bidders could ask for clarification and Sita would respond formally and on the record. Bidders have until 23 September to submit questions. The police service had not responded to questions sent on 10 September by the time of publication.
Section 6(1)(c) of Popia excludes processing by a public body for the investigation of offences, but only “to the extent that adequate safeguards have been established in legislation”. No South African statute sets out when an officer must switch a body camera on, who may view the footage, what personal information might be recorded and stored, or how long it is kept.
In an enforcement notice served in April 2023, after Saps members circulated Krugersdorp rape survivors’ details on WhatsApp, the regulator found the service “did not meet the requirements for exclusion under section 6 (1) (c) (ii)” because it had “failed to demonstrate that it has any safeguards in place, let alone safeguards established in legislation”. The police service complied and was not fined.
Zondi restated that position in general terms: where processing is not excluded under section 6, “such processing must comply with Popia”.
Few African models
There is little to compare it with on the continent:
- Morocco’s national security directorate announced in December 2017 that almost 5 000 front-line officers would be issued with body cameras by the start of 2018, without facial recognition.
- Senegal’s interior minister told parliament in February that 2 500 bodycams had been ordered for traffic units, also without it.
- The Zimbabwe Republic Police has begun issuing body cameras, calls the roll-out a work in progress and will not say how many; guidelines on the use, storage and access of footage are still being developed.
- Kenya’s police oversight authority is exploring the technology. Neither force has published bodycam-specific rules, and TechCentral could find no police service on the continent on record running facial recognition on body cameras. — (c) 2026 NewsCentral Media
