POPIA and AI chatbots: what South African businesses need to know

If your business uses an AI chatbot, a WhatsApp bot or any automated messaging, it is processing personal information: names, phone numbers, email addresses, and often much more. In South Africa, that means the Protection of Personal Information Act (POPIA) applies.

This guide explains how POPIA affects AI chatbots and automated messaging in plain language. It is not legal advice - for that, speak to an attorney - but it will help you ask the right questions.

POPIA in one paragraph

POPIA sets out how organisations may collect, use, store and share personal information about people and companies in South Africa. It has been enforceable since 1 July 2021, and it is overseen by the Information Regulator. It is built on eight conditions for lawful processing, which boil down to: have a good reason, collect only what you need, be open about it, keep it safe, and let people see and correct their information.

How POPIA applies to chatbots and WhatsApp bots

Collect only what you need

A booking bot needs a name, a number and a time. It rarely needs an ID number, a home address or health details. Design every conversation to ask for the minimum - and nothing "just in case".

Tell people what happens to their information

At the start of a conversation, or through a short link, explain who is collecting the information, why, and how to get in touch about it. A clear privacy notice on your website covers most of this.

Direct marketing needs consent

Section 69 of POPIA covers direct marketing by electronic communication, which includes WhatsApp, SMS and email. In short:

• You may market to existing customers about similar products or services, as long as you gave them a chance to opt out when you collected their details, and in every message after that.
• For anyone else, you need their consent first.
• Every marketing message must make it easy to opt out.

Keep it secure

Personal information collected by your AI must be stored securely, accessed only by the people who need it, and deleted when it is no longer needed. Ask your provider where data is stored, who can access it and how long it is kept.

Use operators you trust

If a software company processes personal information on your behalf, POPIA calls them an operator. You remain responsible, so you need a written agreement that they will keep the information secure and use it only for your purposes.

A POPIA checklist for your automation

1. List every channel where your AI collects information (calls, WhatsApp, web chat, social, email).
2. For each one, write down what you collect and why you need it.
3. Remove any question you do not strictly need.
4. Add a short privacy notice or link at the start of conversations.
5. Record how and when each person consented to marketing.
6. Include an easy opt-out in every marketing message - and honour it.
7. Confirm your software provider's security, data location and retention.
8. Register your Information Officer with the Information Regulator.
9. Decide who handles requests from people to see or delete their information.

Why this is good for business

POPIA compliance is not just box-ticking. Customers are more willing to share information - and to keep talking to you - when they trust how you handle it. A respectful, transparent bot builds that trust from the first message.

If you are planning WhatsApp automation or an AI agent, we build consent, opt-outs and minimal data collection in from the start.

Talk to us about responsible automation