In the week of 8 September 2026, the State Information Technology Agency (SITA) opened a tender for the South African Police Service (SAPS). Bids close at 11am on 29 September. The contract runs three years and covers body-worn cameras, vehicle dashcams and management software. According to Biometric Update, the software must include facial recognition for video analytics and access control, plus automatic number plate recognition (ANPR). The tender sets no target budget and no camera quantity. This is a procurement story, not a rulemaking one. No telecoms-regulator (ICASA) action features in the reporting, so this article does not claim one.
The strongest case for the tender
The police case is not frivolous. South Africa has some of the highest violent-crime rates in the world. Officers are often accused of misconduct, and evidence disputes are common. Body cameras can protect citizens and officers alike, and ANPR is a mature tool for tracing stolen and hijacked vehicles. A police service that wants to modernise is not doing something sinister. Requiring cameras to carry analytics from day one is also cheaper than retrofitting them later.
Where the tender outruns the law
The difficulty is the legal footing, not the hardware. The Protection of Personal Information Act (POPIA) starts from a prohibition. Under section 26, a responsible party may, subject to section 27, not process biometric information. Section 27 allows processing with consent, where it is necessary to establish, exercise or defend a right or obligation in law, or where the Information Regulator authorises it in the public interest with appropriate safeguards. Consent is impractical for people scanned on a street. The other routes need either a specific legal duty or a regulator sign-off. The tender identifies neither.
Police might argue POPIA does not apply to them at all. Section 6(1)(c) excludes processing by a public body for the prevention, detection or investigation of offences, but only "to the extent that adequate safeguards have been established in legislation for the protection of such personal information." That qualifier matters. Biometric Update reports that POPIA appears unlikely to cover police body cameras. The Information Regulator told TechCentral the opposite. Its spokeswoman Nomzamo Zondi said SAPS "is not excluded from the operations of the act and must still comply with the act." The Regulator also described biometric processing as subject to a general prohibition.
The Regulator has already tested this against SAPS. In an April 2023 enforcement notice, issued after officers circulated the details of Krugersdorp rape survivors on WhatsApp, it found SAPS did not meet the section 6(1)(c) requirements. TechCentral quotes the notice as saying SAPS had "failed to demonstrate that it has any safeguards in place, let alone safeguards established in legislation." TechCentral also reports that no South African statute governs when body cameras must be switched on or how the footage is handled. If the exclusion depends on legislative safeguards and none exist for this footage, the exclusion is hard to claim. POPIA then applies, and so does the biometric ban.
Why this is a pro-innovation objection
This is not an argument against police technology. It is an argument about sequencing, and about the cost of getting it wrong. A contract signed before its legal basis is settled invites three problems.
- Litigation risk. A system built on facial recognition can be challenged as unlawful after the money is spent. Public procurement bears that cost.
- Vendor lock-in. A three-year contract with no stated quantity or budget makes cost control and vendor accountability difficult.
- Public trust. Body cameras are valuable mainly because people believe the footage is handled fairly. A facial-recognition feature with no stated purpose weakens that belief.
SITA, according to TechCentral, declined to say what legal basis it relies on and pointed questions to the formal tender process. That is a procedural answer to a substantive question.
A proportionate path
There is a workable middle course, and it does not need a ban. Four steps would let the tender proceed lawfully.
- Separate the modules. Body cameras and ANPR are far easier to justify than live facial recognition. Procurement can make recognition an optional, separately approved module instead of a mandatory requirement.
- Seek section 27(2) authorisation. Ask the Information Regulator to authorise any facial-recognition use case in advance, with named safeguards. POPIA already provides this route.
- Legislate the safeguards. Parliament, or the Minister through regulations, should set rules on when cameras record, how long footage is kept, who can access it, and when face matching is permitted (for example, against a defined watchlist tied to a warrant or a serious offence).
- Publish a quantity, a budget and an impact assessment before award, so that oversight bodies can evaluate proportionality.
Such a framework would give police the tools, give vendors a stable market, and give citizens a remedy. It would follow the risk-based approach that the pro-innovation position favours: light rules for low-risk uses such as evidence-recording cameras, and stricter conditions for high-risk biometric identification.
The bottom line
The risk is not that South African police will use cameras. It is that they may buy a biometric identification system first and ask what law permits it afterwards. POPIA, on the Regulator's reading, already says the default is prohibition. Bids close on 29 September, so the window to fix the specification is short. Making facial recognition a conditional module, with a stated legal basis, would cost the tender almost nothing and would spare SAPS a legal fight it may lose.