AI and POPIA, in Plain Language
Written for people who are asked to make decisions about AI and are not technologists. It starts further back than most writing on the subject — with what physically happens when someone types a question into an AI — and works up to the question everyone actually has: can we use this for our data? Along the way it deals with what POPIA really says about sending personal information abroad (conditions, not a prohibition), why “local” means three different things, how to classify data before comparing tools, and three worked examples that each reached a different, correct answer. A plain-language explainer, not legal advice.
6 articles
- Part 1Where does the AI actually think?Before any conversation about POPIA, one thing has to be clear: what physically happens when someone types a question into an AI. No jargon, no acronyms — just where your words go and who has them along the way.7 min read
- Part 2POPIA does not say your data must stay in South AfricaThe single most repeated belief about POPIA and AI is not what the Act says. Section 72 sets conditions for sending personal information abroad — five of them — rather than forbidding it. Being wrong in the cautious direction still costs you.8 min read
- Part 3Which data can AI touch? A traffic-light guideMost organisations argue about which AI tool to use before deciding what data it will see. Sort the data first and most of the argument disappears — because a large share of everyday AI use involves no personal information at all.8 min read
- Part 4Follow one question all the way throughThe single most useful exercise in AI governance takes an afternoon and needs no technical skill: take one real question from one real person, and write down every place it goes. The gaps you cannot fill in are the finding.8 min read
- Part 5Three organisations, three different right answersA small firm, a medical practice and a public service each asked whether they could use AI. All three got a different answer, and all three were correct — because in every case a single checkable fact about the data decided it.8 min read
- Part 6What to ask before you let AI touch your dataSix questions any non-technical person can ask a supplier, what a good answer looks like, and the one page worth keeping for every AI use. Plus the risk nobody procures for: staff quietly pasting things into a chat window.8 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala