Choosing a BPO (business process outsourcing) partner in South Africa: questions and exit terms

Judge a BPO partner on four things you can get in writing: who will do the work, how the service is measured, how your customers' personal information is protected, and how you leave. Shortlist three or four providers, put the same written questions to each, run a paid pilot on real work, and sign only when the service level schedule, the operator agreement and the exit plan are attached to the contract.

ITWeb, reporting the sector report of the industry body BPESA, gives 26,346 new jobs serving international markets in 2025 for global business services. Of those new jobs, 13,056 were in the Western Cape, 7,709 in KwaZulu-Natal, 3,969 in Gauteng and 1,612 in the Eastern Cape. The figures count new work for overseas clients only; we found no public count of work done for South African companies.

Treat "top BPO companies" lists with care: the ones that rank for those searches are written by providers or by directories. Build the shortlist from your own needs.

• Fit by type of work. Inbound support, outbound sales, back office and data capture, and collections are different trades.
• Scale. Ask for the size of their smallest and largest accounts.
• Location and languages. Which province, which languages the team speaks, and whether agents work from a site, from home or both.
• Registrations the work needs. Collections is regulated. The Debt Collectors Act defines a debt collector as a person who "for reward collects debts owed to another", and excludes attorneys, their employees and parties to a factoring arrangement. Under section 8, a company that is one must be registered, and so must every director and every officer concerned with debt collecting. Check the Council for Debt Collectors' register.
• B-BBEE. If recognising the spend matters to you, ask for the current certificate or sworn affidavit and note its expiry date.
• References. One current client of your size and industry whom you can call without the provider on the line.
• Who employs the agents. If the provider uses a labour broker or passes work to a second provider, you need to know before you sign.

Send these in writing and compare the answers side by side. Vague answers on measurement and exit are the clearest warning sign.

1. Who will work on our account, and are they dedicated to us or shared with other clients?
2. How do you recruit and train for our work, and how long before a new agent takes live contacts?
3. What was staff turnover on comparable accounts over the last year, and how do you calculate it?
4. Who manages our account day to day, and who above them do we escalate to?
5. Which service levels will you commit to in the contract, and how is each one calculated?
6. Can we see the raw reports and listen to recordings ourselves, or only summaries?
7. Who scores quality, against which scorecard, and on how many contacts each week?
8. Which systems will hold our customers' information, and where are they hosted?
9. Will you sign our operator agreement, and which subcontractors will touch our data?
10. How, and how quickly, will you tell us about a suspected breach?
11. What happens to our service during a power, network or system outage at your site?
12. What happens to our service if you are sold or enter business rescue?
13. How is the fee calculated, and what does it exclude?
14. If we leave, what do we get back, in what format, and by when?

A service level is only as good as its definition. For each measure, the schedule should state what is counted, over which period, what is excluded, the target, and what happens when it is missed.

For a contact centre:

• Service level: the share of contacts answered within a set number of seconds. The trap is a daily average, where a quiet afternoon hides a morning of long queues. Ask for it by half-hour interval.
• Abandonment rate: the share of callers who hang up before an agent answers. The trap is the short-abandon cut-off, which removes callers who hang up within the first few seconds. Agree the cut-off in writing.
• Average handle time: talk, hold and wrap-up. A handle-time target pushes agents to end calls early, so pair it with a resolution measure.
• First contact resolution: the issue is solved without the customer coming back within an agreed window.
• Quality score: the share of sampled contacts that pass a scorecard. If the provider scores itself, hold regular calibration sessions where your team scores the same contacts.

For back-office and data work, measure turnaround time from receipt to completion in working hours, accuracy on a sample you check yourself, and the backlog of items older than the agreed turnaround. For collections, measure right-party contacts, promises to pay that are kept, the amount collected against the amount placed, and complaints.

Tie each target to a service credit off the monthly fee, and add a right to terminate after repeated misses so credits are not your only remedy.

Insurers have these terms set for them: Joint Standard 1 of 2024 requires a written contract for a material outsourced function that covers the level of service, access to information, subcontracting, termination and a reasonable termination period, and arrangements made before it began must comply by 1 December 2026, or on renewal or renegotiation if that comes first; outside insurance, the same list works as a checklist.

If a provider handles your customers' personal information for you, you need a written operator agreement. POPIA calls the provider an "operator": a person who processes personal information for a responsible party "in terms of a contract or mandate, without coming under the direct authority of that party". You remain the responsible party.

What the Act requires:

• Section 21(1): you must, "in terms of a written contract", ensure that the operator establishes and maintains the security measures in section 19, which are appropriate, reasonable technical and organisational measures against loss, damage and unlawful access.
• Section 20: the operator processes the information only with your knowledge or authorisation, and treats it as confidential.
• Section 21(2): the operator must notify you "immediately" where there are reasonable grounds to believe the information has been accessed or acquired by an unauthorised person.
• Section 22: you, not the operator, notify the Information Regulator and the people affected.
• Section 72: if the provider sends the information to a third party in another country, such as an offshore team or a foreign cloud service, the transfer must meet one of the Act's conditions, for example a law or binding agreement giving adequate protection, or the person's consent.

Clauses to put in the agreement: processing only on your written instructions; the security measures by name, with your right to audit them; breach notice within a stated number of hours; a list of subcontractors, your consent before any is added, and the same terms passed down to each; where the data is stored and whether it leaves South Africa; how long call recordings are kept; and return and deletion of everything at the end, confirmed in writing.

The Regulator enforces this. In an enforcement notice dated 31 August 2023, it found that a pharmaceuticals company had not concluded a written contract with the operator processing its customers' information, and that the operator had then not told the company about a security compromise. It ordered the company to conclude written contracts with all its operators.

Agree how you leave before you sign, while you still have leverage.

• Term and notice. A first term short enough to leave if the service slips, and a notice period that matches how long a replacement takes to stand up. No public source sets a typical notice period, so negotiate it.
• Termination for cause. Repeated service level misses, a data breach, a lost registration and a change of control should each let you end the contract early.
• Exit assistance. The provider runs the service at the same standard through the notice period and hands over to the incoming team, on terms agreed now.
• What you own. Scripts, knowledge base articles, training material, call recordings, customer records, reports, and any telephone numbers and accounts set up in your name. List each one.
• Data return and deletion. The format, the deadline, and written confirmation that copies are deleted, including backups and subcontractors' copies.
• Staff. If your own people do the work today, the Labour Relations Act's transfer rule, section 197, may move them to the provider, or from one provider to the next, so ask your attorney before you give notice.

This is not legal advice. Checked against the texts of the Protection of Personal Information Act, the Debt Collectors Act, the Labour Relations Act and the insurers' outsourcing joint standard on 9 October 2026. Have an attorney check your own arrangement.

A paid pilot on real work, with the reports you will get in production, tests everything above at small cost. Agree the success measures before it starts and decide on the numbers, not impressions.

IAMX offers business process outsourcing of all types through BPO partners: customer support, back-office work, collections and recoveries, and managed teams that scale with you, behind one accountable front door to a vetted network of specialist partners. The business process outsourcing page sets out what is included.

• What is a BPO (business process outsourcing) company?

  Business process outsourcing: you contract another company to run a process for you, such as customer support, sales calls, data capture or collections, with its people and usually its systems. You keep responsibility to your customers and, under POPIA, for their personal information.

• What is the difference between business process outsourcing and a call centre?

  A call centre handles phone contacts. An outsourcing partner may run a call centre for you, but it may also handle email and chat, back-office processing, data work and collections.

• Do I need an operator agreement with my outsourcing partner under POPIA?

  Yes, whenever the provider processes personal information for you. Section 21(1) requires a written contract that makes the operator maintain the security measures in section 19.

• What should an SLA with BPO partners include?

  For each measure: the definition, the period, exclusions, the target, reporting, the service credit for a miss and a right to terminate after repeated misses.

• How long should an outsourcing contract run?

  Give it a notice period that matches how long it would take to move the work to someone else, and a first term you can leave if service slips. No public source sets a norm, so start with a paid pilot.

• Does a collections partner need to be registered?

  Yes, if it collects debts owed to others for reward. Under section 8 of the Debt Collectors Act, such a company must be registered, along with its directors and the officers concerned with collecting. The Act's definition excludes attorneys, their employees and parties to a factoring arrangement.

• ITWeb, reporting BPESA's sector report: The global business services sector created 26,346 new jobs serving international markets in 2025, according to BPESA's sector report. Checked 9 October 2026.
• ITWeb, reporting BPESA's sector report: The Western Cape recorded 13,056 of the new international jobs in 2025. Checked 9 October 2026.
• ITWeb, reporting BPESA's sector report: KwaZulu-Natal recorded 7,709 of the new international jobs in 2025. Checked 9 October 2026.
• ITWeb, reporting BPESA's sector report: Gauteng recorded 3,969 of the new international jobs in 2025. Checked 9 October 2026.
• ITWeb, reporting BPESA's sector report: The Eastern Cape recorded 1,612 of the new international jobs in 2025. Checked 9 October 2026.
• Department of Justice and Constitutional Development: Section 1 of the Debt Collectors Act defines a debt collector as, among others, a person, other than an attorney or an attorney's employee or a party to a factoring arrangement, who for reward collects debts owed to another on the latter's behalf. Checked 9 October 2026.
• Department of Justice and Constitutional Development: Section 8(1) of the Debt Collectors Act provides that no person, other than an attorney or an attorney's employee, may act as a debt collector unless registered, and that a company's directors and officers concerned with debt collecting must also be registered. Checked 9 October 2026.
• Prudential Authority and Financial Sector Conduct Authority: Joint Standard 1 of 2024, Outsourcing by Insurers, requires a written contract for a material function that covers service levels, performance reviews, access to information, subcontracting, intellectual property, continuity, termination and a reasonable termination period. Checked 9 October 2026.
• Prudential Authority and Financial Sector Conduct Authority: An outsourcing arrangement entered into before the commencement date (1 December 2024) must comply within 24 months of that date, that is by 1 December 2026, or on renewal or renegotiation, whichever comes first (clause 11.3). Checked 9 October 2026.
• Information Regulator (South Africa): An Information Regulator enforcement notice dated 31 August 2023 found a responsible party had concluded no written contract with its operator, which then did not notify it of a security compromise, and ordered written contracts with all its operators. Checked 9 October 2026.
• Government of South Africa, Government Gazette: Section 21(1) of the Protection of Personal Information Act requires a responsible party, in terms of a written contract, to ensure that its operator establishes and maintains the section 19 security measures. Checked 9 October 2026.
• Government of South Africa, Government Gazette: Section 19 of the Protection of Personal Information Act requires a responsible party to take appropriate, reasonable technical and organisational measures to secure personal information against loss, damage and unlawful access. Checked 9 October 2026.
• Government of South Africa, Government Gazette: Section 20 of the Protection of Personal Information Act requires an operator to process information only with the responsible party's knowledge or authorisation and to treat it as confidential. Checked 9 October 2026.
• Government of South Africa, Government Gazette: Section 21(2) of the Protection of Personal Information Act requires the operator to notify the responsible party immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Checked 9 October 2026.
• Government of South Africa, Government Gazette: Section 22 of the Protection of Personal Information Act requires the responsible party to notify the Regulator and the data subject of a security compromise. Checked 9 October 2026.
• Government of South Africa, Government Gazette: Section 72 of the Protection of Personal Information Act bars transferring personal information to a third party in a foreign country unless a listed condition is met, such as adequate protection by law or binding agreement, or the data subject's consent. Checked 9 October 2026.
• Government of South Africa, Government Gazette: The texts of the Protection of Personal Information Act, the Debt Collectors Act, the Labour Relations Act and Joint Standard 1 of 2024 on outsourcing by insurers were read for this guide on 9 October 2026. Checked 9 October 2026.
• Department of Employment and Labour: Section 197 of the Labour Relations Act, as substituted in 2002, applies to the transfer of the whole or a part of any business, trade, undertaking or service as a going concern, and automatically substitutes the new employer in all existing contracts of employment. Checked 9 October 2026.