What is POPIA?
The Protection of Personal Information Act 4 of 2013, South Africa’s data-protection law, in force in full since 1 July 2021. It sets eight conditions for processing personal information: accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation. It creates the Information Regulator, which can investigate, issue enforcement notices and impose administrative fines of up to ten million rand; failing to comply with an enforcement notice is an offence carrying a fine or imprisonment of up to ten years 1.
Is it enforced?
Yes, since 2023. The Regulator’s first administrative fine, five million rand, was issued against the Department of Justice and Constitutional Development after a ransomware incident and a failure to comply with an enforcement notice 2. The practical lesson for a business was in the detail: the fine followed a failure to do what the notice said, not the breach alone.
How does POPIA apply to AI tools?
Exactly as it applies to a spreadsheet. A chatbot that asks for a name and a phone number is processing personal information on your behalf; you are the responsible party and the vendor is an operator. The eight conditions translate into a short list of design decisions.
| Condition | What it means for a chatbot or email agent |
|---|---|
| Minimality | Collect a name, a number and the reason. Never an ID number, a card number or health details in a chat. |
| Purpose | Say what the information is for, in the chat, before asking. |
| Consent and openness | A consent line the visitor sees; a privacy page the bot can point to. |
| Security safeguards | Encrypted in transit and at rest; access limited; an operator agreement with the vendor. |
| Data-subject participation | A way to see, correct and delete what was collected, from your dashboard. |
| Retention | A retention window; conversations deleted when it passes. |
| Direct marketing (s69) | Electronic marketing needs consent; keep the opt-out one click away. |
What about special personal information?
Health, religion, race, biometrics, criminal history and a child’s information carry a higher bar under sections 26 to 35. A medical practice’s chatbot must not collect symptoms; a gym’s must not collect a health form; a school’s must not talk to a child without the consent regime. The safe design is the same in every case: the chatbot books and answers, and the sensitive form is completed with a person.
What about email marketing?
Section 69 governs direct marketing by electronic means: it needs the recipient’s consent, or an existing customer relationship for similar products, and every message needs a working opt-out. A mass-email product that captures consent, honours unsubscribes in one click and keeps the record is doing the compliance work for you; a bought list is doing the opposite.
How are DoubleDown AI’s products built for this?
The website chatbot collects what the conversation needs, shows a consent line, hands sensitive questions to a person and gives you the transcript to export or delete. The email agent and the lead-generation product work the same way. We are an operator under the Act; ask for the operator terms before you sign, and read them.
Questions people ask
Does a chatbot need a privacy notice?
Yes. The chatbot should link to your privacy page and say, before it asks, what a name and number will be used for.
Can a chatbot ask for an ID number?
It can, but it almost never should. Collect the minimum; an ID number belongs in a verified form with a person, not a chat window.
Who is liable, the business or the vendor?
The business is the responsible party; the vendor is an operator acting on its instructions. Both have duties, and the contract between them should say who does what.
Sources
- Protection of Personal Information Act 4 of 2013, section 109 (administrative fines) — popia.co.za
- Bowmans, “Information Regulator issues first fine of ZAR 5 million under POPIA” (2023)
Where we do this
The same build runs for businesses in Kimberley, Mahikeng and Gqeberha, and the city pages set out what changes locally — the languages, the trading hours and the sectors that dominate. Everything is deployed and supported remotely from Vanderbijlpark.