POPIA and AI Assistants: A Plain-Language Checklist for South African SMEs

AI assistants can take a lot of admin off a small business: summarising messages, filing documents, following up on leads. But almost everything they touch contains personal information. Customer names, phone numbers, email addresses, staff updates, job cards with site contacts. In South Africa, that means the Protection of Personal Information Act (POPIA) applies.

POPIA doesn't stop you from using AI. It does mean there are a few things to think through before you switch anything on. This checklist covers the questions we work through with every client. It's a practical guide, not legal advice, so for anything high-risk, speak to a POPIA specialist.

1. Know what personal information the assistant will touch

Start by listing what goes in and out: which WhatsApp groups, inboxes, spreadsheets and folders the assistant can access, and what personal information is in them. POPIA's minimality principle says you should process only what you need for the purpose. If the assistant only needs a customer's name and the status of their job, it shouldn't have access to their ID number.

Check: Can you explain, in a sentence or two, what personal information the assistant uses and why?

2. Know where the data goes

Most leading AI models are hosted outside South Africa. When an assistant sends a message to an AI model to summarise or classify it, personal information may leave the country.

Section 72 of POPIA allows personal information to be transferred outside South Africa in certain cases. These include when the recipient is bound by a law, binding corporate rules or a binding agreement that provides adequate protection; when the person consents; or when the transfer is necessary to perform a contract with them.

Check: Do you know which AI provider processes your data, where, and under what terms? Business and API plans from the major providers typically come with data processing terms and commitments not to train on your data. Use those, not free consumer accounts.

3. Have a written agreement with anyone processing data for you

Under POPIA, an "operator" is anyone who processes personal information on your behalf. Section 21 requires a written contract that makes sure the operator keeps appropriate security measures in place. That includes the company that builds and runs your automation.

Check: Do you have a written agreement with your automation provider covering confidentiality, security, and what happens to your data if you stop working together?

4. Keep the data secure

Section 19 requires appropriate, reasonable technical and organisational measures to keep personal information safe. For an AI assistant, that means practical things:

• access limited to the accounts and folders the assistant actually needs
• passwords and API keys stored securely, not in a shared spreadsheet
• logs that show what the assistant did
• someone alerted quickly when something fails or looks wrong

If personal information is compromised, section 22 requires you to notify the Information Regulator and the affected people as soon as reasonably possible.

Check: If the assistant's access was misused tomorrow, would you know? And do you know who you'd need to tell?

5. Get direct marketing right

This is where many businesses get caught out, and it matters for any assistant that sends follow-ups, win-back emails or outreach.

Section 69 of POPIA prohibits direct marketing by electronic communication, such as email, SMS and automated calls, unless the person has consented or is an existing customer. The Information Regulator's Guidance Note on Direct Marketing spells out what that means in practice:

• New prospects: your first electronic message must be a request for consent to market to them, using the Regulator's Form 4 or something substantially similar. You may only ask once. If they don't give consent, you can't keep following up.
• Existing customers: you can market your own similar products or services if you got their details in the context of a sale and gave them a chance to opt out, both when you collected the details and in every message since.
• Every marketing message must say who it's from and give a way to ask for messages to stop.
• Keep a record of everyone who has refused consent or opted out, and make sure your systems check it before sending.

POPIA protects companies as well as individuals, so business-to-business outreach isn't automatically exempt.

Check: Does your assistant check an opt-out list before sending? Does every marketing message include your details and a way to opt out?

Because an AI assistant can send messages at scale, these rules need to be built into the system rather than left to memory. That's why our AI business assistants have opt-out lists and contact rules built in, and nothing goes to a client without your approval unless you choose otherwise.

6. Keep a person in charge of decisions that matter

Section 71 gives people the right not to be subject to certain decisions made solely by automated processing. According to the Regulator's guidance, it applies when all three of these are true: the decision has legal consequences for the person or affects them substantially; it's based solely on automated processing; and it's intended to build a profile of them, for example of their creditworthiness, reliability or performance at work.

Most admin assistants never come close to this. But if you're using AI to screen job applicants, rate staff performance or decide who gets credit, a person should review the outcome and make the final call.

Check: Does the assistant make any decision on its own that significantly affects a customer or employee? If so, add a human review step.

7. Tell people what you're doing

Section 18 requires you to tell people when you collect their personal information, including what you're collecting, why, and who it's shared with. Update your privacy notice to cover automated processing and any AI providers you use, and tell staff about any assistant that reads their messages or logs their updates.

Also make sure your business has registered its Information Officer with the Information Regulator. By default, that's the head of the business.

Check: Would a customer or employee be surprised to learn what the assistant does with their information? If yes, tell them.

8. Write it down

You don't need a 50-page policy. A short document covering what the assistant does, what data it uses, where that data goes, who has access and how opt-outs are handled will put you ahead of most businesses. It's also what you'll want to hand over if a customer or the Regulator ever asks.

The short version

POPIA and AI assistants can work together. Process only what you need, know where your data goes, keep it secure, respect consent and opt-outs, keep people in charge of decisions that matter, and be open about what you're doing.

If you're considering an AI assistant and want to see how it would handle your data, book a free consultation. We'll walk you through what we'd build and how your information would be handled before anything goes live.