POPIA and AI at work: what staff must know

POPIA applies to AI tools the same way it applies to email or cloud storage: if staff paste personal information into ChatGPT, Claude or Gemini, your company is processing that information and stays responsible for it. The safest everyday rule is simple: keep names, ID numbers, contact details and client records out of public AI tools unless your company has approved the tool for that data.

This guide explains what that means in practice for teams in South Africa. It is general information, not legal advice. Confirm your obligations with an attorney or your information officer.

Key facts about training your team with us

Live cohorts on Zoom that start every Monday, with seats for any number of team members
Invoiced to your company
Safe use of company data (POPIA) built in
An attendance register and certificates for your skills records
No coding needed

What is POPIA, in one paragraph?

The Protection of Personal Information Act (POPIA) sets the conditions for how organisations in South Africa collect, use, store, share and delete personal information about people and, in some cases, companies. Every organisation has an information officer, by default its head, and the Information Regulator enforces the Act.

Does using ChatGPT at work count as processing personal information?

If the text you paste in contains personal information, yes. Processing under POPIA is defined broadly, and it includes sending information to a third party's service. Asking an AI tool to summarise a complaint that names a customer, or to rewrite a CV, is processing that customer's or that candidate's information.

It does not matter that the chat felt private. What matters is where the information went, who can access it, and whether you had a lawful reason and the right safeguards.

What personal information should never go into a public AI tool?

Unless your company has approved a specific tool and account for this data, keep these out:

ID numbers, passport numbers and tax numbers.
Names together with contact details, addresses or account numbers.
Health, biometric, religious, union, criminal or other special personal information.
Information about children.
Employee records: salaries, performance reviews, disciplinary files.
Client files, contracts and anything covered by a confidentiality agreement.

A useful test for staff: would you be comfortable if this exact text appeared in a newspaper with your company's name next to it? If not, remove the details first.

Training a team? Your team members can join our live cohorts, which start every Monday, invoiced to your company, with safe use of company data (POPIA) built in and an attendance register and certificates for your skills records. Send a team enquiry.

How can staff still use AI without breaking the rules?

Most of the value of AI at work does not need personal information at all. Teach staff to:

Strip the details. Replace names with roles ("the client", "Employee A") and remove numbers before pasting.
Describe instead of paste. Explain the situation in general terms and ask for a structure, a template or a draft.
Add the details back offline. Fill in the real names in your own document after the AI has done the drafting.
Use approved tools for real data. If the work genuinely needs personal information, use the business account your company has approved and configured.
Check the output. AI can invent facts. A person checks anything that goes to a client or into a record.

What should a company put in place?

You do not need a thick manual. A small set of clear controls covers most of the risk:

A short AI use policy that names the approved tools, the data that must stay out, and who to ask. Our guide to writing an AI policy for a small business has a simple outline.
Business accounts for the approved tools, with settings checked by whoever manages your IT.
A line in your existing privacy notices if AI tools process client or employee information.
Training for every person who will use the tools, with practice on removing personal details.
A way to report a mistake quickly, so a slip can be handled as a possible security compromise if needed.

Do business versions of AI tools solve the problem?

They help, but they do not remove your responsibility. Business plans of the main tools generally offer stronger terms about how your data is used and stored. Read the current terms on each provider's own website, check where data is processed, and record the decision. POPIA has rules about sending personal information outside South Africa, so ask your attorney how they apply to the tool you choose.

Who in the company is responsible?

The company is responsible, and the information officer leads on compliance. In practice HR, IT and line managers share the work: HR includes the rules in onboarding and training, IT sets up approved tools, and managers make sure their teams follow the policy day to day.

How do we train staff on POPIA and AI?

Training works best when people practise on their own tasks. A good session shows the same task done badly, with a client's name and ID number pasted in, and done well, with the details stripped, and lets each person do it on a real example from their job. Our guide to AI training for employees covers what else to include.

Safe use of company data is built into everything we teach, so your team learns the tools and the rules together.

Is this legal advice?

No. This page is general information about POPIA and AI tools. Your industry, your contracts and the kind of information you hold all change the answer. Confirm your obligations with an attorney or your information officer before you set a policy.

Frequently asked questions

Does POPIA apply to ChatGPT at work?

Yes, when staff paste personal information into it. Sending personal information to an AI tool is processing, and your company stays responsible for it.

Can staff use AI tools without breaking POPIA?

Usually yes. Most tasks work without personal details: replace names with roles, remove numbers, and add the real details back in your own document afterwards.

Is this page legal advice?

No. It is general information. Confirm your obligations with an attorney or your information officer.