POPIA and AI: What South African Small Businesses Need to Know

There's a widespread assumption that AI is unregulated in South Africa — that because there's no AI Act, there are no rules. That's not correct.

South Africa does not have a standalone AI law, and it's not getting one imminently. A Draft National Artificial Intelligence Policy was published for public comment on 10 April 2026 — then withdrawn roughly two weeks later, after it emerged the document contained fictitious academic citations, most likely generated by AI itself. The policy timeline has since stretched well beyond 2026.

But a missing AI Act does not mean a legal vacuum. POPIA already governs how AI systems handle personal information — including automated decision-making, profiling, and sending data across borders. If your AI use touches anyone's personal information, POPIA applies to you right now, today, whether or not a dedicated AI law ever arrives.

This is where most small business owners trip up, because POPIA's definition is broader than people expect. It covers information relating to an identifiable person — a customer, a supplier, an employee, a child in your care.

In practice, for a typical small business, that includes:

• Names, ID numbers, addresses, phone numbers, email addresses
• Banking and payment details
• Health information — directly relevant if you run a creche, a salon doing chemical treatments, or a beauty business recording client allergies
• Information about children, which POPIA treats with additional care
• Employment records for anyone you employ

It's worth being clear about the flip side too, because the fear is often bigger than the risk: a great deal of AI use touches no personal information at all. Asking Claude to help you think through your pricing, using Gemini to research what competitors are charging, generating a marketing image in ChatGPT, drafting a social media caption — none of that involves anyone's personal data. POPIA has nothing to say about it.

The rules kick in when real people's details are involved.

Here's the one that catches people out.

When you paste something into ChatGPT or Claude, that information is processed on servers outside South Africa. POPIA has specific provisions governing the transfer of personal information across borders — and most small business owners have never considered that pasting a client list into a chatbot is, legally speaking, a cross-border data transfer.

This doesn't mean you can't use these tools. It means you should be deliberate about what you put into them.

You don't need a compliance department. For a small business, most of the risk disappears with a handful of habits.

This one isn't about AI directly, but it catches small businesses constantly, and AI makes it easier to get wrong at scale.

Amended POPIA regulations that took effect on 17 April 2025 tightened the rules on direct marketing, requiring written consent before sending unsolicited electronic communications. Enforcement attention on electronic direct marketing has been increasing.

The practical implication: using AI to generate a marketing campaign is completely fine. Using it to blast that campaign to a list of people who never agreed to hear from you is where the risk sits — and that risk exists whether a human or an AI wrote the message.

South Africa's Information Regulator has been actively focused on data breaches. Reported security compromises between April and September 2025 numbered 1,607 — around a 60% increase on the previous year. A mandatory reporting tool went live in April 2025 to streamline how breaches get reported.

The direction of travel is clear: more attention, more reporting, more enforcement. Small businesses that build good habits now are simply better positioned than those who deal with it after something goes wrong.

There's an honest point worth making here. Compliance conversations in South Africa are usually pitched at businesses that can afford a compliance officer. That framing leaves out most of the country's actual businesses — and it creates a real problem, because fear of getting it wrong stops people from adopting tools that would genuinely help them.

The realistic position for a small business is this: you are not expected to build a corporate data governance framework. You are expected to be careful with other people's information. For most small businesses, the five habits above cover the overwhelming majority of the practical risk.

Being cautious about what you paste into a chatbot costs you nothing. Avoiding AI entirely because you're unsure about the rules costs you a great deal. If you're still weighing the broader compliance picture, our guide on township business registration is a good companion read, and the free business diagnostic will tell you where compliance sits relative to the other gaps in your business.

Compliance runs through the kasiAIhub programme rather than sitting in a separate module. In Session 1, entrepreneurs build a compliance checklist specific to their business type using Claude — and part of that work is understanding what information their business actually holds, and how to use AI tools safely with it.

The approach throughout is the same as this article: practical habits over paperwork, and confidence over fear. You should finish the Entrepreneur AI Journey using AI more, not less — just deliberately.

See how compliance is covered in Session 1 →

Michalsons commentary on South African AI policy and POPIA (April 2026); DLA Piper analysis of the withdrawal of South Africa's Draft AI Policy (May 2026); Werksmans Attorneys, South Africa's Data, AI and Cybersecurity Outlook 2026; HRSpot guidance on POPIA-aligned workplace AI policy (2026).

This article provides general information only and does not constitute legal advice.