POPIA-compliant AI in South Africa: What POPIA asks of an AI system.

Yes. The Protection of Personal Information Act 4 of 2013 regulates the processing of personal information. It does not mention AI and does not prohibit it. In the Act, "processing" means any operation concerning personal information, "whether or not by automatic means" (section 1), so reading a customer's message with a language model is processing like any other. The Act's conditions for lawful processing apply to an AI system as they do to a filing cabinet or a CRM.

What changes with AI is who else touches the data. A typical system involves the business, the company that builds and runs it, a cloud provider and a model provider. POPIA has specific rules for that chain.

The business is. Under section 1, the "responsible party" is the body that "determines the purpose of and means for processing personal information". A person who processes personal information for the responsible party "in terms of a contract or mandate, without coming under the direct authority of that party" is an "operator". The firm that builds and runs your AI system is an operator, and so are the cloud and model providers it uses.

Two sections govern operators:

• Section 20. An operator may process the information only with the knowledge or authorisation of the responsible party, and must treat it as confidential.
• Section 21(1). The responsible party must, in terms of a written contract, ensure that the operator establishes and maintains the security measures section 19 requires.

In practice there must be a written contract with whoever builds and runs the system. It should say what data they may touch and for what, which other companies they use (cloud and model providers), and how the data is secured.

No. POPIA has no data-residency rule. Section 72(1) says a responsible party in the Republic may not transfer personal information to a third party in a foreign country unless one of five grounds applies:

• The recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to POPIA's conditions for lawful processing, including on further transfers (section 72(1)(a)).
• The data subject consents to the transfer (section 72(1)(b)).
• The transfer is necessary for the performance of a contract between the data subject and the responsible party (section 72(1)(c)).
• The transfer is necessary for a contract concluded in the data subject's interest between the responsible party and a third party (section 72(1)(d)).
• The transfer is for the data subject's benefit, consent is not reasonably practicable to obtain, and the data subject would be likely to give it (section 72(1)(e)).

An AI system that uses an overseas model provider usually rests on the first ground: a binding agreement with the provider. That agreement has to exist, and someone has to have read it. Some businesses keep data in the country anyway, as policy, or because a sector regulator or a client contract asks for it.

It can be done. Microsoft Azure, Amazon Web Services and Google Cloud each run a cloud region in South Africa: Azure and Google Cloud in Johannesburg, AWS in Cape Town. Which AI models can run inside those regions differs by provider and changes often, so it is checked when the system is designed, not assumed.

Section 19(1) requires a responsible party to secure the integrity and confidentiality of personal information by taking "appropriate, reasonable technical and organisational measures" to prevent loss of, damage to or unauthorised destruction of it, and unlawful access to or processing of it. Under section 19(2) the responsible party must identify the reasonably foreseeable risks, establish safeguards, regularly verify that they are effectively implemented, and keep them updated. Section 19(3) adds due regard to generally accepted information security practices.

For an AI system, that usually means:

• The system has its own logins, with the narrowest access the job needs. It does not borrow a staff member's password.
• Personal information goes to a model only when the task needs it, and only the fields it needs.
• The model provider's terms say whether your data is kept and whether it is used for training, and the setting chosen is written down.
• Every action the system takes is logged, so access can be reviewed.
• The safeguards are tested again whenever the system changes.

Not alone, where the decision matters. Section 71(1) says a data subject may not be subject to a decision which results in legal consequences for them, or which affects them to a substantial degree, if it is "based solely on the basis of the automated processing of personal information intended to provide a profile of such person", including their performance at work, creditworthiness, reliability, location, health, personal preferences or conduct.

There are exceptions in section 71(2), including a decision taken in connection with a contract where appropriate measures protect the data subject's legitimate interests. Under section 71(3) those measures must give the person an opportunity to make representations, and enough information about the underlying logic of the automated processing to do so.

The working rule: an AI system can sort, score and recommend, and a person makes any decision that seriously affects someone, such as a loan, a job, a claim or a contract ended. The approval step is built in from the start.

Section 21(2) requires an operator to notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. Section 22 then requires the responsible party to notify the Information Regulator and the data subjects, as soon as reasonably possible after the discovery of the compromise.

So the contract with your builder should say how fast they tell you, and the system's logs should be good enough to show what was touched.

• Where is our data stored, and in which country?
• Which cloud and model providers process it, and under what agreement?
• Does the model provider keep our data, and is it used for training?
• Will you sign a written operator agreement that covers the section 19 security measures?
• Which decisions does a person approve?
• How quickly do you tell us if something goes wrong, and what will the logs show?
• If we part ways, how is our data returned or destroyed?

ZAIQ builds to these answers. The accounts and the data stay in the client's name, the providers and their terms are named in the proposal, and anything that seriously affects a person goes through an approval the client sets. See what we do or how to choose an AI agent development company.

This guide summarises the text of the Protection of Personal Information Act 4 of 2013 as enacted (Government Gazette 37067, 26 November 2013), read on 11 November 2026. It is general information, not legal advice. Regulations and guidance from the Information Regulator add detail, and a sector regulator may add rules of its own. For a specific decision, ask an attorney.