Home / Insights / ChatGPT and POPIA
Pasting information about a person into an AI tool is "processing" under POPIA, and sending it to an overseas provider is a cross-border transfer. Neither is banned. Both come with conditions. Here is the plain-language version.
POPIA never mentions AI, but it governs personal information wherever that information goes. If a prompt contains information about an identifiable person, pasting it into an AI tool is processing under the Act, and your business stays responsible for it. Whether that processing is lawful depends on what the information is, which tier of the tool you use, and the safeguards around it.
More than most people think. Under POPIA it includes a person's name together with contact details, ID and account numbers, employment and salary details, location data, correspondence, and even opinions or assessments about a person. Two categories carry stricter rules: special personal information (health, biometrics, race, religion, among others) and children's information. If a prompt would let someone identify a real person, assume POPIA applies to it.
This is the test we put in client AI policies, and it covers almost every everyday case.
The same product behaves differently at different tiers, and the difference is contractual. Ask two questions of any AI tool: does the provider train its models on what your staff paste, and what does your contract say about your data?
Business tiers of the major tools (ChatGPT Team and Enterprise, Claude for Work, Copilot for Microsoft 365) commit by default not to train on your business data and give you admin controls and data processing terms. Consumer tiers vary, their settings change, and a free account creates no contract between the provider and your business at all. That is why our policy template approves tools by name and tier, not by brand.
Almost every AI provider processes data outside South Africa, which makes a prompt containing personal information a cross-border transfer under section 72 of POPIA. Such transfers are permitted on several grounds; the one most businesses rely on in practice is that the overseas recipient is bound by an agreement that upholds protection comparable to POPIA's conditions. A business-tier contract with data processing terms is how you get that agreement. A free consumer account gives you nothing to point to.
One thing does not change with geography: your business remains the responsible party. The provider processes on your behalf; accountability stays home.
This article is practical guidance from implementation work, not legal advice. For a formal opinion on your POPIA position, speak to a privacy attorney. The Information Regulator publishes guidance at inforegulator.org.za.
Not automatically. It is processing under POPIA, and processing is lawful only when it meets the Act's conditions: a proper purpose, minimality, security safeguards, and a lawful basis for any cross-border transfer. On a consumer tool with no contract and no safeguards, you are unlikely to meet those conditions. On a business tier with data processing terms, you often can.
Treat consumer tiers as unsafe for personal or confidential information by default. Their data controls vary and change, and they come with no contract between the provider and your business. They are fine for general questions and drafting that contains no personal or confidential information.
Yes. Your business remains the responsible party regardless of where the tool runs, and sending personal information to an overseas provider is a section 72 cross-border transfer. The practical mechanism most businesses rely on is a business-tier contract in which the provider commits to comparable protection.
The AI Adoption program sets up the policy, the right tool tiers and contracts, and a working first pilot, so your team gets the benefit without the exposure.
Book a call if you want one, or just send the form. We reply within one business day. POPIA-compliant.