Your team is probably already using AI
If someone pastes a client email, a CV or a disciplinary note into a chatbot to “tidy it up”, your business has just processed personal information through a third party, often on servers outside South Africa. The Protection of Personal Information Act (POPIA) applies to that exactly as it applies to your filing cabinet.
POPIA requires personal information to be processed lawfully, for a specific purpose, and kept secure. It also places conditions on sending personal information outside the country. A free AI tool with unclear data terms can make all three hard to show.
Wearable AI changes what “being recorded” means
Smart glasses and AI recording pins can capture faces, voices and conversations without anyone noticing. A person’s image and voice are personal information, and biometric information is treated as special personal information under POPIA, with stricter rules. If staff wear these devices in meetings with clients or colleagues, you need a clear rule on when that’s allowed and how people are told.
AI in recruitment needs a human in the loop
Tools that score or filter CVs automatically are attractive when you’re hiring on a small budget. POPIA restricts decisions about a person that are based solely on automated processing where they have legal consequences or substantially affect that person. Use AI to help sort, but make sure a person reviews and makes the decision, and keep a record of why.
What the risk looks like
The Information Regulator can impose administrative fines of up to R10 million, and some POPIA offences carry prison sentences. For most small businesses the bigger cost is reputational: a client finding out their details were fed into a public AI tool.
Five things to put in place
- An AI use policy: which tools are approved, and what information must never go into them
- A rule on recording devices, including smart glasses, in meetings
- Updated privacy notices for staff and job applicants that mention AI tools
- A person reviewing every AI-assisted hiring or disciplinary decision
- Your Information Officer registered with the Information Regulator, and staff knowing who it is