How can HR teams use AI safely under POPIA?
Short answer: Decide which AI tools are approved, decide what personal information may and may not go into them, and make sure the people using them know the rule. Do that before the team starts experimenting, not after.
HR handles some of the most sensitive information in a company: CVs, ID numbers, performance notes, medical and disciplinary records. The Protection of Personal Information Act (POPIA) applies to how that information is handled, including when it is typed into an AI tool.
What to settle first
- Which tools are approved. Name them. "Whatever people have on their phones" is not a policy.
- What may go in. For example: anonymised or fictional examples are fine for drafting and practice. Named employee records are not, unless your Information Officer has cleared the tool for it.
- Who checks the output. AI can draft a warning letter or a job ad quickly. A person still owns the decision and the wording.
- Where the rules are written down. One page that staff can find and follow.
Where training helps
Rules only work when people understand why they exist. We run practical sessions where HR staff practise with realistic, made-up cases, so they learn what to leave out, how to check the answer and when to stop and ask.
This page is general information, not legal advice. Ask your Information Officer or your lawyer about your own situation.
Want to talk it through?
Next step: write to tshibangu@fluenceai.co.za. The first conversation is free.
More questions
Written by Tshibangu Kalambaie, Founder, Fluence AI.