POPIA and AI tools: a plain-English checklist
Ten questions to answer before anyone pastes client data into an AI tool. A practical POPIA checklist for South African small businesses.
Daine MawerFounder, Plaincraft
3 min read
The short answer
Before anyone in your business puts personal information into an AI tool, you should be able to answer ten questions about what goes in, where it goes, and who is accountable. This checklist isn't legal advice, but it covers the ground POPIA expects a responsible business to have thought about.
Why POPIA matters for AI tools
The Protection of Personal Information Act (POPIA) applies whenever your business processes personal information: names, ID numbers, contact details, health or financial information about clients, staff or suppliers. Pasting that information into an AI tool is processing it. So is uploading a spreadsheet or connecting a tool to your inbox.
None of that is forbidden. It just needs the same care you'd give any other system that holds client data.
The checklist
What personal information would go in?
List the actual types: client names, ID numbers, medical details, salaries. Be specific.Do we need it to?
Often the task works just as well with names and numbers removed. Use the minimum.Is it for the purpose we collected it for?
Information collected to deliver a service shouldn't quietly be used for something unrelated.Where is the data stored and processed?
Many AI tools process data outside South Africa. POPIA has specific conditions for cross-border transfers.Does the provider train on our data?
Check the plan you're on. Business plans often differ from free and personal ones.Is there a written agreement?
A provider processing personal information for you is an operator under POPIA, and you need a contract that covers security.Who in the business can use it?
Access should match job roles, the same as any other system.How long is information kept?
Know the tool's retention settings and set them deliberately.What happens if something goes wrong?
POPIA requires you to notify the Information Regulator and affected people of a security compromise. Know who would do that.Who is accountable?
Name the person. In most small businesses that's your Information Officer, often the owner.
Turning the answers into rules
Once you've answered the ten questions, write the result down as a short policy your team can follow: which tools are approved, what can and can't go in, and who to ask. Keep it to a page. The AI usage policy guide walks through that step, and the governance and policy service can do it with you.
Written by Daine Mawer
Founder of Plaincraft, an independent AI consultancy for South African SMEs, with 17 years of building websites and digital products behind it. AI is part of how I work every day, so I know where it earns its keep and where it doesn't.
More about me
