By Engelsman Magabane Incorporated | May 2026
Many businesses treat AI software like stationery: choose a subscription, add staff, and start using it.
Under POPIA, that approach is risky.
The moment an AI service touches personal information—customer details, employee records, call recordings, support tickets, ID numbers, addresses, or voice data—you have created a processing relationship where accountability does not disappear simply because the work is outsourced.
POPIA is explicit about the foundation: a responsible party must secure personal information in its possession or under its control through appropriate technical and organisational measures. That duty does not switch off because a vendor is involved. Instead, the vendor becomes part of your compliance posture—and your contract becomes the place where safeguards either exist or fail.
This article explains what businesses should demand before signing with an AI vendor, why breach response is non-negotiable, and why cross-border processing is often the hidden compliance gap.
This article is general information and not legal advice.
1) The concept that changes everything: POPIA’s “security safeguards”
POPIA’s security safeguards are not vague aspirations. Section 19 requires a responsible party to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, and unlawful access or processing.
The practical meaning for procurement is simple: AI procurement is not only a “features” decision. It is a security decision.
If your vendor processes personal information, you need to know:
- what security measures exist,
- how they are verified,
- and what happens when something goes wrong.
POPIA also expects ongoing risk management—reasonable measures to identify foreseeable internal and external risks, establish safeguards, and regularly verify and update them.
2) The vendor is not “just a tool”: POPIA’s operator rules apply
POPIA anticipates third-party processing. It states that an operator (or anyone processing personal information on behalf of a responsible party) must process only with the knowledge/authorisation of the responsible party and must treat the information as confidential.
Crucially, POPIA also requires a written contract: the responsible party must ensure, through a written contract, that the operator establishes and maintains the security measures referred to in section 19.
If your AI vendor cannot meet this in writing, you are exposed before you even start using the product.
3) Breach response is not optional: POPIA expects fast, lawful notification
One of the most common vendor failures is not the breach itself—it is delay, vagueness, or incomplete incident reporting.
POPIA’s position is clear. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the responsible party must notify:
- the Regulator; and
- the data subject (unless the identity cannot be established).
The timing standard is equally clear: notification must be made “as soon as reasonably possible” after discovery, while allowing for legitimate law enforcement needs and reasonable steps to determine scope and restore system integrity.
For operators, the Act tightens the timeline further: the operator must notify the responsible party immediately where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person.
The due diligence implication is straightforward: if your vendor cannot provide fast, accurate incident reporting, your business may be unable to comply with POPIA in real time.
4) Cross-border processing: section 72 is where many AI deals quietly fail
Most major AI providers process data outside South Africa.
POPIA section 72 provides that a responsible party may not transfer personal information to a third party in a foreign country unless one of the listed conditions applies.
A common compliance route is where the foreign recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection substantially similar to POPIA’s lawful processing conditions and includes safeguards for onward transfers.
Other routes include consent, and transfer necessity linked to contract performance (depending on the facts).
This is not a technicality. It is a contract and governance requirement. If a vendor cannot give you a credible cross-border protection mechanism, you carry the compliance risk.
5) Biometrics raises the stakes: voice and face data are legally sensitive
AI procurement becomes higher-risk when biometrics enter the picture—voice authentication, face matching, “voiceprints”, identity verification, or any system that uses biological or behavioural traits for identification.
POPIA’s definition of biometrics expressly includes voice recognition.
POPIA also treats biometric information as part of “special personal information” and generally prohibits processing it unless a lawful basis or an authorisation pathway applies.
In practice, this means biometric AI systems require:
- clearer legal justification upfront,
- tighter security controls,
- stricter vendor selection,
- and more disciplined incident response planning.
6) A practical AI vendor due diligence checklist (before you sign)
A workable POPIA-aligned AI vendor review usually answers five questions. If you cannot answer these, you are not ready to sign.
(1) What personal information will be processed?
If the business cannot describe the data, it cannot protect it. Start by listing the categories: customer info, employee info, recorded calls, support tickets, IDs, addresses, voice data, or anything else.
(2) Where will it be processed and stored?
If processing/storage occurs outside South Africa, identify the section 72 route you rely on (adequate protection via binding agreement/rules, consent, contractual necessity, etc.).
(3) What security safeguards are contractually guaranteed?
POPIA expects reasonable safeguards. Your contract should align the vendor’s commitments with your legal duties and include enforceable controls (not marketing promises).
(4) What is the incident notification timeline?
Your vendor should be able to meet “immediate” notification to you as responsible party where unauthorised access is reasonably suspected. And you should be able to comply with your “as soon as reasonably possible” duty to notify the Regulator and data subjects if required.
(5) What happens at contract end?
Data retention and deletion rules must exist. “We keep it for improvement” is not a safe default. Your contract should clearly state return/deletion expectations and timeframes.
7) What we expect to see more of in South Africa
As AI services become standard business infrastructure, three trends are predictable:
- More contract disputes about data use, retention, audit rights, and breach responsibility.
- More compliance pressure where businesses cannot explain their data flows or cross-border safeguards.
- More biometric disputes, because voice recognition is expressly included in POPIA’s biometrics definition and biometric info is legally sensitive.
Conclusion
In South Africa, buying AI is also buying a processing relationship.
POPIA requires reasonable security safeguards, written operator controls, breach notification discipline, and strict conditions for cross-border transfers.
The safest procurement question is not “What can the tool do?” It is: Can we defend its data practices if we are audited, breached, or challenged?