Document processing and data capture in South Africa: outsourced, automated or both

Choose by document type, not by provider. Typed documents with consistent layouts, in volume, suit automated extraction with a person checking whatever the software is unsure of. Handwriting, poor scans and documents that differ every time still need people, your own or an outsourced capture team. Most insurers and financial services firms end up with both: software reads the straightforward majority, trained people handle the rest, and every correction is logged.

Whichever you choose, write three things into the contract: how accuracy is measured, the turnaround by document type, and the basis of the fee. Sign a POPIA operator agreement before the first document moves, and test the provider on a sample of your own documents before you commit.

There are three ways to turn documents into data:

• Manual capture. People read each document and key the fields into your system, in your office or at an outsourced team. Suits handwriting, poor scans, low volumes and documents that change every time. Its limits are speed, cost at volume and fatigue errors, which is why careful teams key important fields twice or check a sample.
• Automated extraction, often called intelligent document processing. Software turns the image into text (optical character recognition, or OCR), a model finds the fields that matter, and rules check them against your other systems, such as a claim against its policy. Each field comes with a confidence score. Suits volume and consistent layouts. Fails quietly on layouts it has not seen and on handwriting, unless low-confidence fields go to a person.
• Both, with a person in the loop. Software does the first pass. Fields below an agreed confidence, and documents that fail a check, go to a reviewer. The reviewer's corrections are recorded and used to improve the set-up. This is the usual shape of a mature operation.

Older OCR tools work from templates: they read a fixed position on a known form and break when the form changes. Newer extraction models read layouts they have not seen, but they can also return a confident answer that is wrong. The checks against your own data matter as much as the reading.

No single figure describes handwriting. Accuracy depends on the writing, the scan, the form design (a box for each character helps) and the field. Printed text on a clean scan reads far better than handwriting on a fax or a phone photo. A provider that quotes one accuracy figure without saying how it was measured is quoting its best case.

Ask which of three measures a figure uses:

• Character accuracy: the share of characters read correctly. It flatters, because one wrong digit spoils an identity number or a bank account number while almost every character is still right.
• Field accuracy: the share of fields captured exactly right. This is the measure that matters for a policy or claim record.
• Document accuracy, or straight-through rate: the share of documents completed with no person touching them and no error found later.

Then ask for the exception rate: the share of fields or documents sent to a person. A provider can raise its accuracy by sending more work to reviewers, which raises cost and turnaround, so the two figures only make sense together.

To measure it yourself:

1. Build a sample of your real documents, including the worst ones: handwriting, phone photos, faxes and long medical reports.
2. Have your own people capture the same fields independently and settle every disagreement, so each field has a known correct answer.
3. Compare the provider's output field by field, and report accuracy by document type and by field. An average across all documents hides the weak type.
4. Weight the fields. A misspelt suburb and a wrong bank account number do not carry the same risk.
5. Repeat the check on a sample every month once live, because new form versions and new sources of documents change the result.

Define turnaround from the moment a document arrives to the moment its data is in your system and checked, in business hours, and say what happens to documents that arrive after the daily cut-off. Ask for it by document type rather than as one average, agree a separate target for exceptions (they wait for a person), and track the backlog of items older than the target as well as the average.

Insurers have a fixed point to work back from. The Policyholder Protection Rules for short-term and long-term insurers say an insurer must record a claim by no later than the first business day after the date that the initial claim is received, and may not wait until every requirement for the claim has arrived. A capture queue that holds new claims for days works against that rule, so the claims turnaround belongs in the contract.

No public source sets typical South African rates for document capture, so compare quotes on the same basis rather than against a published norm. The common bases:

• Per document: simple to budget, but a long claim pack and a single form cost the same unless the quote defines a document.
• Per page: common for scanning and automated extraction. Ask what counts as a page: a photo, one side of a sheet, each page of an email attachment.
• Per field or per record: closest to what you actually use, and fairest when documents vary in length. It needs an agreed field list.
• A dedicated team, charged by the full-time equivalent (FTE): suited to steady volumes and work that needs judgement. Ask how leave, sickness and month-end peaks are covered.
• Set-up and change fees: for configuring extraction on your document types, connecting your systems, and changes when a form is redesigned.
• Minimums and volume bands: a monthly minimum, and what happens to the fee when volume drops or spikes.

Compare on the cost of one correct, checked record in your system, including the exceptions your own staff still handle. A low fee per page with a high exception rate can cost more than a higher fee that sends fewer documents back to you.

By category:

• New business and onboarding: application and proposal forms, identity documents, proof of address, bank confirmation letters, debit order mandates, policy schedules and replacement forms.
• Claims: claim forms and the evidence behind them, such as medical reports, death certificates, police case details, repair quotes, invoices and photographs, then the correspondence and decisions that follow.
• FICA and client due diligence: identity and address verification, company registration documents, and records of beneficial ownership and source of funds.
• FAIS: records of advice, needs analyses, disclosures and client communications kept by financial services providers and their representatives.
• Policy servicing: changes of beneficiary, banking details and cover, cancellations and complaints.

Many of these carry health information, which POPIA treats as special personal information, and identity numbers and bank details, which fraud depends on. Treat those fields as the high-risk ones, both in the accuracy check and in the security controls below.

There is no single period. Each rule starts its clock from a different event, so a record can be due for deletion under one rule and still required under another.

• Policyholder Protection Rules. Short-term and long-term insurers keep policy records, policy-related communications and the material documentation relating to the policy for at least five years after the policy came to an end, or five years after the communication where the record does not relate to a particular policy. Electronic records are allowed if they are accessible and readily reducible to written or printed form. Every claim, irrespective of whether the claims are valid or not, must be recorded with the claimant's details, copies of the evidence, correspondence and decisions, and its progress.
• FICA. An accountable institution keeps records of a business relationship for at least five years from the date on which the business relationship is terminated, and records of a transaction for at least five years from the date on which that transaction is concluded.
• FAIS. The General Code of Conduct requires a provider to keep records for a period of five years after termination of the product concerned, or after the service was rendered.
• POPIA. Section 14 says personal information may not be kept longer than its purpose needs, unless a law, a contract, consent or the business's lawful functions require it. Once keeping it is no longer authorised, the record must be destroyed or deleted, in a way that prevents it being reconstructed, or de-identified.

The practical rule: keep each record for the longest period that applies to it, then delete it, including every copy the capture provider holds.

Paper after scanning. Under section 16 of the Electronic Communications and Transactions Act, a legal duty to retain information may be met by keeping it electronically if it stays usable for later reference, is in its original format or one shown to represent it accurately, and shows where it came from, where it went and when. That section does not itself say when paper originals may be destroyed, some documents are excluded from parts of that Act, and some laws still ask for an original, so take advice before you destroy paper.

The FIC Act applies to accountable institutions, listed in its first schedule. The list includes a person who carries on a life insurance business under the Insurance Act, excluding reinsurance, and financial services providers that advise or act as intermediaries on the investment of a financial product, other than a non-life insurance policy. When we checked, short-term insurance business was not named on the list. The Act's duty to report suspicious and unusual transactions applies to anyone who carries on a business, accountable institution or not.

For a life insurer, or an adviser the list covers, capturing and storing FICA documents through someone else brings three duties:

• A third party may keep the records only while you have free and easy access to the records and they are readily available to the Financial Intelligence Centre and your supervisor. You remain liable if the third party fails, and you must give the Centre and your supervisor the third party's particulars.
• Records may be kept in electronic form and must be capable of being reproduced in a legible format.
• FAIS records may also sit with someone else, but must be available for inspection within seven days of the regulator's request.

Put access, retrieval times and the end-of-contract handover into the agreement, so these duties hold whatever happens to the provider.

A capture provider that processes your clients' personal information for you is an operator under POPIA, and you stay responsible for that information.

• Written contract. Section 21(1) requires a written contract that makes the operator maintain the security measures in section 19.
• Breach notice. Under section 21(2) the operator must tell you immediately when it has reasonable grounds to believe information was accessed by an unauthorised person. Under section 22 you notify the Information Regulator and the people affected.
• Health and other special information. Section 26 makes health information special personal information, along with biometric information, race and several other categories. Section 32(1)(b) lets insurance companies, medical schemes, medical scheme administrators and managed healthcare organisations process health information where it is necessary to assess the risk to be insured (if the person has not objected), to perform the insurance or medical scheme agreement, or to enforce contractual rights. It may then be processed only by those subject to an obligation of confidentiality. Our advice: write that duty into the operator agreement and into the capture staff's terms.
• Offshore teams and cloud services. Section 72 bars sending personal information to a third party in another country unless a listed ground applies. Ask where documents and extracted data are stored and processed, including where any extraction model runs.
• Keeping and deleting. Agree how long the provider keeps document images and extracted data and how it deletes them, in line with section 14.

The Regulator enforces the operator rule. Its briefing on enforcement outcomes reported a breach of a pharmaceuticals company's database affecting 3.6 million data subjects, and an enforcement notice ordering written contracts with all its operators.

Controls to ask a capture operation for:

• Named, vetted staff, each with access only to the queues and fields their work needs.
• Work done inside your system or a locked-down environment: no downloads, no printing, no personal phones at the capture desk.
• Masking of identity numbers and bank details wherever a field does not need to be read in full.
• A log of who viewed and changed each record.
• Encryption of documents in transit and in storage.
• Subcontractors listed, approved by you, and bound by the same terms.
• Return and deletion of everything at the end of the contract, confirmed in writing.

Insurers have one more layer. An outsourced capture function may be a material function under Joint Standard 1 of 2024, which sets what the written contract must cover, and arrangements made before it began must comply by 1 December 2026, or on renewal or renegotiation if that comes first.

This is not legal advice. Checked against the texts of POPIA, the FIC Act, the FAIS General Code of Conduct, the Policyholder Protection Rules and the Electronic Communications and Transactions Act on 12 October 2026. These texts are amended from time to time, so have an attorney check your own arrangement against the current versions.

Put the same questions to each provider, in writing, and compare the answers side by side:

1. Which of our document types have you processed before, and can we see accuracy by document type and by field, and how it was measured?
2. Is your accuracy figure character, field or document level, and what share of documents goes to a person?
3. What happens to a field the software is unsure of: who reviews it, in which country, and how quickly?
4. How do you handle handwriting, phone photos, long medical reports and layouts you have not seen?
5. Which checks run against our own data, such as a claim against its policy or an identity number against its check digit?
6. What turnaround will you commit to by document type, and how do you cover month-end peaks?
7. What is the fee basis, what counts as a page or a document, and what are the minimums and change fees?
8. Will you sign our operator agreement, where will documents and data be stored, and which subcontractors and model providers touch them?
9. How long do you keep images and extracted data, and how do you prove deletion?
10. Can we see every decision and correction in an audit trail?
11. If we leave, what do we get back: our data, our field definitions and the extraction set-up built on our documents?
12. Can we run a paid pilot on our own documents before we sign?

A pilot on your own documents shows more than any demonstration on the provider's samples:

1. Pick one document flow with real volume and a clear owner, such as one type of new claim or one new-business form.
2. Draw a sample of real documents from a normal month, including the hard ones, and settle the correct answer for each field with your own people.
3. Agree the measures before the pilot starts: field accuracy by document type, exception rate, turnaround, and the cost of a correct record.
4. Sign the operator agreement first, and use the provider's production security controls, not a demonstration environment, if live personal information is involved.
5. Run the pilot alongside your current process, so nothing depends on it.
6. Compare the results field by field, and read the errors themselves, not only the rates.
7. Decide on the numbers. If they hold, widen to the next document type; if not, you have spent little to find out.

IAMX's Document processing and data capture service automates document work for insurers, brokers and financial services firms. Documents arrive by email, upload, shared drives or messaging apps; the fields that matter are read; each item is checked against your other systems; simple cases are handled automatically and anything unusual goes to a person for a decision, with every step recorded. It covers policy onboarding, claims from intake to reconciliation, and FICA and FAIS checks. Where the work needs a team of people, IAMX's business process outsourcing service provides back-office work through BPO partners. IAMX is one accountable front door to a vetted network of specialist partners.

• How accurate is OCR on handwritten forms?

  Too variable for one honest figure: it depends on the writing, the scan, the form and the field. Ask whether a quoted figure is character, field or document level, insist on field accuracy by document type, and test on a sample of your own forms. For handwriting, plan on a person reviewing the fields the software is unsure of.

• What does document processing cost per page in South Africa?

  No public source sets a typical rate. Providers charge per page, per document, per field or record, or for a dedicated team, often with set-up fees and monthly minimums. Compare quotes on the cost of one correct, checked record, including the exceptions your own staff still handle.

• How long do insurance companies keep records of claims?

  Under the Policyholder Protection Rules, policy records and the documentation relating to the policy are kept for at least five years after the policy came to an end, and every claim must be recorded with its evidence, correspondence and decision. Other laws can run longer: a life insurer keeps FICA records of a client relationship for at least five years from the date on which the business relationship is terminated. After the longest period that applies, POPIA's section 14 requires the record to be deleted or de-identified.

• Does FICA apply to life insurance?

  Yes. The FIC Act lists a person who carries on a life insurance business, excluding reinsurance, as an accountable institution, so a life insurer must keep records of a client relationship for at least five years from the date on which the business relationship is terminated. When we checked, short-term insurance business was not named on the list.

• What does POPIA mean for insurers?

  An insurer is responsible for the personal information it collects, including what its capture providers and other operators process for it. Health information is special personal information, and section 32(1)(b) allows an insurer to process it only where necessary to assess the risk (if the person has not objected), to perform the policy, or to enforce contractual rights, and only by people bound to confidentiality. Records may not be kept longer than the law and the purpose require.

• How do we outsource data entry safely?

  Sign a written operator agreement before any document moves, as section 21(1) of POPIA requires. Ask where the work and the data will be, limit each person's access to what their work needs, block downloads and personal devices, log every view and change, agree how long images are kept, and run a paid pilot on your own documents first.

• Can we destroy paper originals after scanning?

  Possibly, but check first. Section 16 of the Electronic Communications and Transactions Act lets an electronic copy meet a legal duty to retain information if it stays accessible, accurately represents the original, and shows its origin, destination and dates. It does not itself say when paper may be destroyed, and some documents and some laws still need the original, so take advice first.

• South African Government (gov.za), Government Gazettes 41321 (long-term insurers) and 41329 (short-term insurers): Rule 17.8.7 of the Policyholder Protection Rules for long-term insurers (Government Gazette 41321) and for short-term insurers (Government Gazette 41329), both published on 15 December 2017, says an insurer must record a claim by no later than the first business day after the date that the initial claim is received, and may not delay recording it until all requirements relating to the claim have been received. Checked 12 October 2026.
• South African Government (gov.za): Section 16(1) of the Electronic Communications and Transactions Act 25 of 2002 says that where a law requires information to be retained, the requirement is met by retaining it as a data message if the information is accessible for subsequent reference, the message is in its original format or one shown to represent the information accurately, and its origin, destination and date and time of sending or receipt can be determined. Checked 12 October 2026.
• South African Government (gov.za), Government Gazettes 41321 (long-term insurers) and 41329 (short-term insurers): Rule 16.4 of the Policyholder Protection Rules for long-term insurers (Government Gazette 41321) and for short-term insurers (Government Gazette 41329), both published on 15 December 2017, says policy records, policy-related communications and material documentation relating to the policy and policyholder may be kept in an electronic or recorded format that is accessible and readily reducible to written or printed form, and must be kept for at least five years after the policy came to an end, or five years after the communication where the record does not relate to a particular policy. Checked 12 October 2026.
• South African Government (gov.za), Government Gazettes 41321 (long-term insurers) and 41329 (short-term insurers): Rule 17.7 of the Policyholder Protection Rules for long-term insurers (Government Gazette 41321) and for short-term insurers (Government Gazette 41329), both published on 15 December 2017, requires accurate, efficient and secure recording of all claims received, irrespective of whether the claims are valid or not, including the claimant's details, copies of all relevant evidence, correspondence and decisions, and the progress and status of the claim. Checked 12 October 2026.
• Financial Intelligence Centre: Section 23 of the Financial Intelligence Centre Act 38 of 2001 requires an accountable institution to keep records of a business relationship for at least five years from the date on which the relationship is terminated, records of a transaction for at least five years from the date on which it is concluded, and records behind a section 29 report for at least five years from the date the report was submitted. Checked 12 October 2026.
• Moonstone, consolidated text of Board Notice 80 of 2003 as amended to Board Notice 706 of 26 June 2020: Section 3(2)(b) of the General Code of Conduct for Authorised Financial Services Providers and Representatives (Board Notice 80 of 2003, in the consolidated text as amended up to Board Notice 706 of 26 June 2020) requires records to be kept for five years after termination, to the knowledge of the provider, of the product concerned or, in any other case, after the rendering of the financial service concerned. Checked 12 October 2026.
• South African Government (gov.za): Section 14 of POPIA says records of personal information must not be retained longer than necessary for the purpose unless retention is required or authorised by law, reasonably required for lawful purposes related to the responsible party's functions, required by a contract or consented to, and that a record no longer authorised to be kept must be destroyed, deleted or de-identified as soon as reasonably practicable; destruction or deletion must be done in a manner that prevents its reconstruction in an intelligible form. Checked 12 October 2026.
• Financial Intelligence Centre: Item 8 of Schedule 1 to the Financial Intelligence Centre Act lists as an accountable institution a person who carries on a life insurance business as defined in the Insurance Act, 2017, but excludes reinsurance business; at the date checked, no item of the schedule named short-term (non-life) insurance business. Section 29(1) separately requires a person who carries on, manages or is employed by any business to report suspicious and unusual transactions. Checked 12 October 2026.
• Financial Intelligence Centre: Item 12 of Schedule 1 to the Financial Intelligence Centre Act lists a financial services provider requiring authorisation under the FAIS Act to provide advice or intermediary services in respect of the investment of any financial product, excluding a non-life insurance policy, reinsurance business and the business of a medical scheme. Checked 12 October 2026.
• Financial Intelligence Centre: Section 24(1) to (3) of the Financial Intelligence Centre Act lets a third party keep the records on an accountable institution's behalf as long as the institution has free and easy access to them and they are readily available to the Centre and the supervisory body; the institution is liable if the third party fails, and must forthwith give the Centre and the supervisory body the prescribed particulars of the third party. Checked 12 October 2026.
• Financial Intelligence Centre: Section 24(4) of the Financial Intelligence Centre Act says records kept in terms of sections 22 and 22A may be kept in electronic form and must be capable of being reproduced in a legible format. Checked 12 October 2026.
• Moonstone, consolidated text of Board Notice 80 of 2003 as amended to Board Notice 706 of 26 June 2020: Section 3(2)(c) and (d) of the FAIS General Code of Conduct, in the consolidated text as amended up to Board Notice 706 of 26 June 2020, say providers are not required to keep the records themselves but must ensure they are available for inspection within seven days of the registrar's request, and that records may be kept in an electronic or recorded format that is accessible and readily reducible to written or printed form. Checked 12 October 2026.
• Information Regulator (South Africa): The Information Regulator's media briefing of 26 March 2024 reported a May 2022 breach of a pharmaceuticals company's e-Statement database affecting 3.6 million data subjects, and an enforcement notice ordering written contracts with all operators compelling the same or better section 19 security measures. Checked 9 October 2026.
• Financial Sector Conduct Authority and Prudential Authority: Joint Standard 1 of 2024 (Outsourcing by Insurers), clause 9.1, requires a written contract for a material function that gives continued access to information, addresses ownership of intellectual property, provides for continuity if the provider becomes insolvent, and provides a reasonable termination period. Checked 9 October 2026.
• Prudential Authority and Financial Sector Conduct Authority: An outsourcing arrangement entered into before the commencement date (1 December 2024) must comply within 24 months of that date, that is by 1 December 2026, or on renewal or renegotiation, whichever comes first (clause 11.3). Checked 9 October 2026.
• South African Government (gov.za): The texts of the Protection of Personal Information Act, the Financial Intelligence Centre Act, the FAIS General Code of Conduct (as amended up to Board Notice 706 of 2020), the Policyholder Protection Rules for short-term and long-term insurers and the Electronic Communications and Transactions Act were read for this guide on 12 October 2026. Checked 12 October 2026.
• South African Government (gov.za): Section 21(1) of POPIA requires a written contract between the responsible party and the operator that ensures the operator establishes and maintains the security measures in section 19. Checked 9 October 2026.
• South African Government (gov.za): Section 19 of POPIA requires the responsible party to identify all reasonably foreseeable internal and external risks to personal information and to establish, verify and update safeguards against them. Checked 9 October 2026.
• South African Government (gov.za): Section 21(2) of POPIA says the operator must notify the responsible party immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Checked 9 October 2026.
• South African Government (gov.za): Section 22 of POPIA requires the responsible party to notify the Information Regulator and the data subject of a security compromise as soon as reasonably possible after it is discovered. Checked 9 October 2026.
• South African Government (gov.za): Section 26 of POPIA prohibits, subject to section 27, processing personal information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information or criminal behaviour. Checked 12 October 2026.
• South African Government (gov.za): Section 32(1)(b) of POPIA lifts the prohibition on processing health information for insurance companies, medical schemes, medical scheme administrators and managed healthcare organisations where the processing is necessary for assessing the risk to be insured (and the data subject has not objected), the performance of an insurance or medical scheme agreement, or the enforcement of contractual rights and obligations. Checked 12 October 2026.
• South African Government (gov.za): Section 32(2) of POPIA says health information processed under section 32(1) may only be processed by responsible parties subject to an obligation of confidentiality by virtue of office, employment, profession or legal provision, or established by a written agreement between the responsible party and the data subject. Checked 12 October 2026.
• South African Government (gov.za): Section 72 of POPIA bars transferring personal information to a third party in a foreign country unless a listed ground applies, such as a recipient bound by a law, binding corporate rules or binding agreement giving adequate protection, or the data subject's consent. Checked 9 October 2026.