Start with the information, not the hardware
POPIA applies to personal information. Your client documents may also carry confidentiality, contractual or professional duties. List the information in the task, its purpose, who may use it and what the output will do. You need to include the connected tools too.
Then decide what the system needs. Remove information the task doesn't need. Set who can access the files and outputs. Decide what gets kept, for how long and who checks the work. You choose the purpose and the people who may use it.
What private AI can change
A private setup can be designed so documents are processed on equipment inside your business rather than sent to an outside AI provider. That gives you a different place to set access, retention and operating controls. You can design those controls around your work.
But location is only one part of the picture. A private system can still expose data through weak permissions, poor security, unnecessary collection, unsafe backups or a badly designed workflow. A system inside your office is not automatically a safe system. You still have to check the full setup.
What the law still asks you to do
Section 19 requires reasonable technical and organisational measures to protect personal information. Sections 20 and 21 cover people or operators processing it on your behalf, including written security commitments for operators. You need to review those arrangements.
If a workflow transfers personal information to a third party in another country, check section 72 and the actual arrangements. On-premise processing may reduce one transfer. It doesn't settle every transfer made by connected tools, support services, backups or people. You should map each route the information takes.
Keep a human responsible for outputs. Review the result before it reaches a client or changes a record. Agree what the system may do, what it must not do and how someone stops it. Your team needs to know who takes that decision.
A sensible first test
Choose one recurring task. Use a sample without personal information. Map the source files, access, output, reviewer and failure route. Then test the same task with approved information only after the responsible people have signed off. You can start with a fictional example.
Measure whether the process improved. Keep a record of the controls you chose. Recheck them when the data, provider or workflow changes. You should revisit the controls when the work changes too.
If your staff already paste client files into ChatGPT, read that situation first. Then you come back here. You see what private AI can change for you. Have your lawyer review your own facts.
Private is a design choice. Compliance is the work around it.
Map the information and the workflow before you deploy.
Read our data and security pageSources behind this page
Here's where the public figures on this page come from. They aren't our client results. They don't endorse us. And they're no substitute for your own professional advice.