A tool name doesn't answer the legal question
A client file can contain personal information. It can also contain confidential business information that POPIA doesn't define as personal information. Your contracts and professional rules can still protect it. You need to check both sets of duties.
Start with the task. What do you need the AI to do? Which fields does it need? Could you remove names, identity numbers, contact details and other identifying clues first? If the task works with a made-up or properly de-identified example, use that. You can often test the task without real client details.
Check the whole trip
Write down where the prompt and its attachments go. Check whether the provider acts as an operator, what its terms say about your information, who can access it, how long it is retained and whether it can be used for another purpose. You should check the account your staff actually use. Read the provider's terms yourself.
If personal information goes to a recipient in another country, section 72 of POPIA sets conditions for that transfer. Check the actual recipient, contract and processing route. A paid plan, a company account or a privacy toggle doesn't answer those questions by itself. Ask where the file goes and who can reach it.
Your organisation also needs reasonable technical and organisational safeguards. Section 19 covers those safeguards. Sections 20 and 21 address processing by operators and the written contract with them. You need to know who handles the information at each step. If you can't verify the route, don't send the file.
Approve one workflow before the team uses it
Name the business owner who approves the workflow. Set the allowed information, the approved account, the access rules, retention, review and the process for mistakes. Tell staff what must never go into an unapproved chat. Make the rule clear enough for someone on a busy day. You set the boundary. Your staff follows it. Can you say the rule in one line? Your staff should be able to repeat it.
Then test with safe examples. Check the output against the source. A person still approves anything that goes to a client, changes a record or makes a decision about them. You stay responsible for that approval. If you're the owner, make sure you can explain the rule to your team.
If you can't answer those questions
Keep client-identifiable information out for now. Use a fictional example or remove the identifying details. Ask your Information Officer, privacy adviser or lawyer to review the workflow before real files go in. You can pause that task until the review is done.
That is a practical control, not a declaration that your whole business is compliant. POPIA compliance depends on the facts and the way you process the information. You need advice on your own circumstances.
A client file is not a test prompt.
Map the information first. Then choose the workflow.
See how we handle dataSources behind this page
Here's where the public figures on this page come from. They aren't our client results. They don't endorse us. And they're no substitute for your own professional advice.