An AI assistant on your website or WhatsApp is one of the most useful first uses of AI for a business. It answers routine questions 24 hours a day and passes other questions to your team.
It is also a new channel through which personal information enters your business. Some of what people type goes to an AI provider that you may not have worked with before. The Protection of Personal Information Act (POPIA) applies to a chatbot. It applies in the same way as it does to your contact form, your CRM and your email.
POPIA allows you to use a chatbot, provided you set it up properly. This guide covers what to consider before you launch, and ends with a checklist.
This article is general guidance. It is not legal advice. For decisions about your own business, speak to a qualified adviser.
What personal information a chatbot handles
A chatbot handles more personal information than most people expect:
- What people type in: names, email addresses, phone numbers, and order or account numbers
- What people volunteer: people explain their situation in full, which can include ID numbers, health details or a complaint about a named staff member
- Technical details: IP addresses, device information and, on WhatsApp, the person’s phone number and profile name
- Transcripts: the full conversation, stored by the chatbot platform and often copied into your CRM or inbox
- Records it can look up: a bot connected to your bookings or CRM can read existing customer records as well as collect new ones
POPIA protects information about companies as well as individuals, so the details of a business customer are also covered.
Two categories need extra care. Special personal information has stricter rules. It includes information about health, religious beliefs, race, biometrics and criminal behaviour. Children’s personal information also has stricter rules. A chatbot can collect either kind if someone types it into the chat. Plan for this. Ask people not to share sensitive details in the chat, and pass those conversations to a person.
Who is responsible
Under POPIA, your business is the responsible party. You decide why and how personal information is processed. The responsibility stays with you even when someone else does the processing.
The chatbot platform, the AI provider and your hosting company are usually operators. They process information on your behalf. POPIA requires a written contract with each operator that obliges it to keep the information secure. Operators must also tell you if the information is compromised. For large providers, this contract is normally their data processing terms. Read them, and keep a copy.
Your Information Officer should know that the chatbot exists and what it does. By default, the Information Officer is the head of the business.
Notice and consent
People should know that they are using an AI assistant, and what happens to their information, before they start typing.
Tell them it is an AI assistant. A short line in the chat window is enough. Include a way to reach a person instead.
Tell them what happens to their information. POPIA requires you to be open about what you collect, why you collect it, who you share it with and whether it leaves South Africa. Link to your privacy policy from the chat window. Update the policy to cover the chatbot and the providers it uses.
Consent is one of several lawful bases. POPIA also allows processing on other grounds, such as taking steps that a person has asked for, or a legitimate interest. Answering a question that someone asks your chatbot usually falls under these grounds. Consent matters most when you want to use information in a way the person would not expect:
- Using chat details for marketing by email or SMS generally needs opt-in consent, with a limited exception for existing customers
- Using transcripts for a new purpose, such as training your own model or building profiles, needs to be considered before you start
Use the information only for the purpose you told people about. If that purpose changes, tell them again.
Where the data goes
List every system the data passes through: the chat widget, the chatbot platform, the AI model provider, then your CRM, inbox or helpdesk. Each of these stores personal information, even if only for a short time.
Cross-border transfers. Most large AI providers process data outside South Africa. POPIA allows this only in certain circumstances. One example is where the recipient is bound by laws, binding corporate rules or an agreement that gives a similar level of protection. Transfers are also allowed where the person consents, or where the transfer is needed to perform a contract with that person. Work out which one applies, and record it in writing.
Training on your data. Free and consumer AI tools may use what is typed into them to improve their models. Business and API tiers of the major providers generally do not do this by default. Check the terms of the service you use.
Send only what is needed. A bot answering questions about opening hours does not need a customer’s ID number. Collect personal details only when the task needs them. Pass them to the AI provider only when it has to see them.
How long you keep it
POPIA says you should not keep personal information for longer than you need it for the purpose you collected it for. The exception is where a law, a contract or a similar reason requires you to keep it.
For a chatbot, decide how long to keep transcripts. Then apply that period in every place the transcripts are kept. This includes the chatbot platform’s settings, copies in your CRM or inbox, your own logs, and the AI provider’s own retention.
People can also ask what information you hold about them, and ask for it to be corrected or deleted. Make sure you can find a person’s conversations when they ask.
Security
A chatbot connected to your systems is a new access point to them. Secure it as you would any other access point.
- Give the bot access only to what it may share. If it can read the whole CRM, a determined user may persuade it to reveal more.
- Limit who on your team can read transcripts, and log what the bot does.
- Know what to do if there is a breach. POPIA requires you to notify the Information Regulator and the people affected when personal information has been compromised.
Passing conversations to a person
A good chatbot recognises when it should stop and pass the conversation to a person.
- There should always be a clear way to reach a person. The conversation should go to that person too, so the customer does not have to repeat anything.
- The bot should pass the conversation to a person when it is unsure, when someone is upset, and when sensitive information is mentioned.
- A person should make significant decisions, such as approving or declining an application. POPIA restricts decisions with legal or substantial effects that are based solely on automated processing. The bot collects the details, and a person makes the decision.
A checklist before you launch
- Write down what the bot collects, what it can read and where it stores information
- List every operator, and keep a copy of each operator’s data processing terms
- Record where each operator processes data, and the basis for any transfer outside South Africa
- Use a business or API tier that does not train on your inputs
- Add a short notice in the chat window, and update your privacy policy
- Give the bot access only to what it may share
- Set a retention period for transcripts, and apply it everywhere they are copied
- Make sure you can find, correct and delete a person’s conversations
- Give users a clear way to reach a staff member, and have a person make significant decisions
- Brief your Information Officer, and know what to do if something goes wrong
Building it properly from the start
We build enquiry and support agents with these safeguards included. We use business-tier AI services that do not train on your data, and we send the provider only what the task needs. We document the data flows, and a person stays involved in the process. Where data should not leave your control, we run an open-source model on a server we manage.
If you are still deciding whether a chatbot is the right first project, read where AI fits in a small business. You can also talk to us about a free AI review.
Filed under AI Services.