POPIA AI Compliance: What SA Businesses Must Do
Using AI with personal information in South Africa means applying POPIA's eight conditions to every AI tool and agent you use. In practice, that means having a lawful basis, collecting only what you need, telling people, securing the data, signing operator agreements with AI vendors, checking cross-border transfers and keeping a human involved in decisions that significantly affect people.
The checklist
- Inventory. List the AI tools and agents in use, who uses them and for what.
- Lawful basis and purpose. Record why personal information is processed in each use case.
- Minimality. Stop staff pasting unnecessary personal information into AI tools.
- Openness. Update your privacy notice, and tell callers and chat users when they're dealing with AI.
- Operators. Sign written agreements with AI vendors that process data for you, covering security and confidentiality.
- Security safeguards. Access control, logging, retention limits and breach procedures for AI systems.
- Cross-border transfers. Many AI services process data outside South Africa; confirm a section 72 ground applies.
- Automated decisions. Under section 71, don't let AI alone make decisions with legal or similarly significant effects on people without proper safeguards.
- Data subject rights. Be able to find, correct or delete personal information held in AI systems.
- Information Officer. Make sure your Information Officer knows about and oversees AI use.
Common risk points
Staff using personal accounts on public AI tools; AI chat logs kept forever; call recordings stored offshore without a transfer assessment; and agents with broader system access than they need. Each has a straightforward fix once it's visible.
Get help applying it
We review your AI use against this checklist and give you a prioritised fix list. See AI governance services. This page is general information, not legal advice.
Questions, answered.
01Is using an AI receptionist POPIA compliant?
It can be, if callers are told they're speaking to AI, only necessary information is collected, the vendor signs an operator agreement, retention is limited and any cross-border processing is assessed.
02Where is AI call and chat data stored?
It depends on the provider. Many process data outside South Africa, which is why the section 72 cross-border check matters. We document this for each system before go-live.
03What does section 71 of POPIA mean for AI?
It restricts decisions with legal or similarly significant effects that are based solely on automated processing. Keep a human in the loop for those decisions or apply the safeguards the Act requires.
04Is this legal advice?
No. It's a practical checklist. For legal opinions, consult an attorney; we work alongside your legal advisers.
Talk to AiTronetiX
Tell us what you'd like to achieve. We'll recommend the simplest option that works and quote in rand.