When a customer messages your business, they hand over personal information: a name, a phone number, and whatever they choose to write. South Africa's Protection of Personal Information Act, POPIA, governs what you do with it. Bringing AI into those conversations adds a few things to check.

Start with who is responsible. Under POPIA, that's you. Your business is the "responsible party", and a company that supplies or runs the AI for you is an "operator". Section 21 says you must have a written contract with the operator that obliges them to keep the information secure. Ask to see it before you sign anything.

Section 18 covers telling people what is going on. You have to take reasonably practicable steps to make them aware of what you collect, why, who is collecting it, and whether it will be sent to another country. A privacy notice that mentions your use of AI is the usual way to do this.

That last point is worth chasing, so find out where the data goes. A lot of AI services run on servers outside South Africa. Section 72 restricts sending personal information to a third party in another country, with several lawful routes. One is that the recipient is bound by a law or binding agreement that gives adequate protection. Another is that the person consents. Your provider should be able to tell you where messages are processed and what protection applies.

Section 71 deals with automated decisions. A person can't be subject to a decision with legal consequences, or one that affects them to a substantial degree, if it is based solely on automated processing that profiles them, for example on creditworthiness or reliability. There are exceptions. An assistant that answers questions and hands the chat to you is a different thing from one that screens people out. If AI plays any part in deciding who gets a service, keep a person in that decision.

Section 22 deals with breaches. If there are reasonable grounds to believe someone unauthorised has accessed personal information, you must notify the Information Regulator and usually the people affected. Ask your provider how they would tell you, and how fast.

The Information Regulator can impose administrative fines of up to R10 million, which is reason enough to ask these questions early.

This is a plain-language overview, not legal advice. For your own business, speak to an attorney.