Body cameras are a reasonable accountability tool, and the case for them is strong. They can deter abuse by officers, give courts better evidence, and protect honest officers from false complaints. A South African police service that records its interactions is better than one that does not. The difficulty with the State IT Agency's tender is not the cameras. It is that facial recognition has been made a condition of entry before the legal rules for using it exist.
What the tender requires
TechCentral reported on 10 September 2026 that SITA tender RFB 3286-2026 covers the "supply, delivery, support and maintenance of body-worn and vehicle dashboard cameras" for the South African Police Service (SAPS), on a three-year contract. Bids closed at 11am on 29 September 2026.
The specification says the cameras must have the "ability to conduct facial recognition and integrate with various security platforms and have warning capabilities." It is a mandatory requirement, so a bid that fails it is not evaluated further. The accompanying video management software must also include facial recognition analytics, along with motion detection and licence-plate recognition.
The tender does not say what the facial recognition is for. The only use it describes is user management: facial recognition is one of three ways to release a camera from its dock, alongside a fingerprint reader and a key code. That is a narrow login function. It does not explain why recognition analytics are needed in the back-end software, or why a camera that integrates with "security platforms" and raises "warning capabilities" is a pass/fail criterion.
The same specification asks for continuous background recording, a 120-second pre-record buffer, remote switching, and an "ability to turn off sound/alarm and light indicators." None of that is unusual in itself. Taken together, it describes a capable surveillance system, and the tender is silent on how it would be governed.
What POPIA says
The Protection of Personal Information Act (POPIA) treats biometric information as special personal information. Under section 26, processing it is generally prohibited unless an exception in section 27 applies. Those exceptions include consent, establishing or defending a legal right, and public-interest processing that the regulator authorises with safeguards.
The Information Regulator told TechCentral that SAPS is not excluded from POPIA and must comply. It said it was not consulted on the project and is not required to be, and that it "neither approves nor disapproves" of the approach. Lawfulness, it said, has to be assessed against the eight conditions in Chapter 3 of POPIA on the specific facts.
The strongest argument for the police is section 6(1)(c), which excludes processing by a public body to prevent or detect offences, investigate or prosecute them, or serve sentences. That is a legitimate argument, because a state that cannot identify suspects cannot enforce its laws. But the exclusion applies only "to the extent that adequate safeguards have been established in legislation."
TechCentral's reporting says no South African statute currently sets out bodycam rules on activation, footage access, recording or retention. If so, the exclusion has nothing to rest on, and facial recognition would need a section 27 exception that the tender does not identify.
This is not a hypothetical reading. In April 2023 the Regulator issued an enforcement notice to SAPS after officers shared the details of rape survivors on WhatsApp. It found SAPS "did not meet the requirements for exclusion under section 6 (1) (c) (ii)" and "failed to demonstrate that it has any safeguards in place." SAPS complied and was not fined. The Regulator has already read the exclusion narrowly against this same institution.
Why this is a procurement problem
A procurement requirement works like law in practice. Once a vendor has built to a mandatory specification, the facial recognition capability is paid for and installed. The pressure to use it follows, whatever the privacy analysis eventually concludes. Reversing a deployed capability is far harder than specifying it carefully at the start.
SITA's spokesperson declined to answer questions on the facial recognition requirement or its legal basis, saying queries should go through the tender process. SAPS had not responded to questions sent on 10 September. A public purchase of this kind should be able to say what it is for.
The regional comparison counsels restraint. TechCentral found Morocco rolled out body cameras to about 5,000 front-line officers in 2017 and 2018 without facial recognition, and Senegal ordered 2,500 for traffic units, also without it. The article found no African police service running facial recognition on body cameras. South Africa would be an early mover, with no bodycam statute behind it.
A proportionate path
Nothing here requires abandoning the cameras. The pro-innovation course is to separate the two decisions:
- Buy body cameras now, with facial recognition made optional rather than mandatory, so vendors are not excluded for lacking an unneeded feature.
- Legislate the safeguards that section 6(1)(c) assumes: activation rules, footage access, retention limits, and audit.
- Define in writing the purpose of any facial recognition, and name the section 27 exception relied on.
- Consult the Information Regulator before deployment, even though it is not obliged to approve, and publish the assessment.
- Treat any live or retrospective identification of members of the public as a separate authorisation, with accuracy testing and independent oversight.
The cost of that sequence is a short delay. The cost of the alternative is a national surveillance capability with an unclear legal footing, in a country where the Regulator has already told the police they lacked the safeguards the law requires.