ChatGPT and POPIA: can advisers use AI on client data?

The short version: POPIA does not prohibit ChatGPT or any other AI. It requires that client information is processed lawfully and for a defined purpose, with appropriate safeguards (section 19), under a written agreement with anyone who processes it for the practice (sections 20 and 21), and with a lawful basis for any transfer outside South Africa (section 72).

Measured against that, the personal ChatGPT plans are no place for identifiable client information. ChatGPT Business, Enterprise and the OpenAI API can be used with conditions. The cleanest route is to remove the client's identity before anything reaches any model.

ChatGPT plans compared under POPIA

OpenAI sells ChatGPT in two families: plans for individuals, and plans for organisations with a workspace the organisation controls. The POPIA questions are the same for each: does OpenAI use what you type to train its models, how long does it keep it, is there a written agreement that makes OpenAI the practice's operator, where is the data stored, and what control does the practice have over its people's accounts.

What OpenAI's own pages state, checked on 15 October 2026. Plans and terms change; check the current page before relying on a cell.
Question	Free, Go, Plus, Pro (individuals)	Business (formerly Team)	Enterprise and Edu	OpenAI API
Content used to train models by default	Yes: OpenAI may use your content to train its models	No	No	No (since 1 March 2023)
Opting out, or in	Turn off "Improve the model for everyone" under Settings, Data controls, or opt out in OpenAI's Privacy Portal. A thumbs up or down can still put that whole conversation into training	Training only if the organisation agrees to it separately; feedback buttons do not permit training	As for Business	Training only if the organisation owner turns on data sharing
Retention	Chats stay until you delete them; deleted chats are scheduled for permanent deletion within 30 days, with security and legal exceptions. Temporary chats are not used for training and may be kept up to 30 days	Admins set retention; deleted conversations are removed within 30 days unless the law or harm prevention requires longer	Admins set retention; deleted conversations are removed within 30 days unless the law requires longer	Inputs and outputs kept up to 30 days for abuse monitoring by default (some features store data until deleted); zero data retention for eligible endpoints on approval
Data processing addendum (an operator agreement)	Not offered: OpenAI's DPA covers Business, Enterprise and the API	Yes, through OpenAI's DPA form	Enterprise yes; Edu under a student data privacy agreement	Yes, through OpenAI's DPA form
Data residency	Not offered	Not offered (Enterprise, Edu and the API only)	New workspaces can store content at rest in Europe, the UK, the US, Canada, Japan, South Korea, Singapore, India, Australia or the UAE; in-region processing in Europe, the US or the UAE. No South African region	The same ten regions, set per new project for approved customers; regions other than the US also need abuse-monitoring controls and a signed amendment. No South African region
Admin controls	None: the account belongs to the person	SAML or OIDC single sign-on and domain verification; admins can view, export and delete members' conversations; no automatic directory provisioning	SAML single sign-on, fine-grained access and feature controls, admin-set retention, a conversation audit log through the Compliance API, and customer-held encryption keys	Organisation and project settings, including retention controls once approved

Sources: OpenAI's Enterprise privacy page (updated 8 January 2026), its help articles on model training, data controls, deleting chats, ChatGPT Business, single sign-on and data residency, the API data controls guide, the data residency announcement of 25 November 2025 and the Data Processing Addendum effective 1 January 2026. All are listed under Sources below. On the business plans OpenAI also states encryption at rest (AES-256) and in transit (TLS 1.2 or later) and a SOC 2 Type 2 audit.

What the plans mean under POPIA

Operator and written agreement (sections 20 and 21). When a practice puts client information into ChatGPT, OpenAI processes it for the practice. POPIA then requires a written contract that obliges the operator to process only with the practice's authority, keep the information confidential, maintain security measures and report a compromise. The individual plans come with OpenAI's consumer terms and privacy policy, not an operator agreement. On Business, Enterprise and the API, OpenAI's DPA says it acts as processor on the customer's instructions, notifies breaches without undue delay and binds its sub-processors to comparable terms.
Purpose (sections 13 and 15). Client information gathered to give advice may not be used for an unrelated purpose such as training a model. On the individual plans that is the default unless the person opts out; on the business plans and the API it does not happen unless the organisation opts in.
Security safeguards (section 19). A business workspace lets the practice decide who has an account, require single sign-on, set retention and remove a departing employee's access. A personal account gives the practice none of that: a shared login or a former employee's account holds client information the practice cannot see or delete. The practice's own side still counts on any plan: devices, passwords and who may paste what.
Cross-border transfer (section 72). None of the plans stores data in South Africa, so any client information sent to ChatGPT leaves the country, even with a European or US residency region chosen. The practice must be able to show a section 72 ground: usually a binding agreement giving protection substantially similar to POPIA, or the client's consent. OpenAI's DPA deals with European and Swiss transfers through standard contractual clauses and does not mention South Africa, so the information officer should read it against the POPIA conditions and record the conclusion.
Special personal information (sections 26 and 27). Health details such as medical history relevant to cover may be processed only within the exceptions POPIA allows. OpenAI's DPA, Schedule 1, states that "No sensitive data is intended to be transferred". Keep health detail out of every AI tool that is not on the practice's own server.
Automated decisions (section 71). A client may not be subject to a decision with legal consequences, or a substantial effect, based solely on automated processing that profiles them, for example their health, creditworthiness or reliability. A model can draft the analysis; the representative decides, edits and signs, as FAIS already requires.

The conclusion. In a personal ChatGPT account (Free, Go, Plus or Pro): no identifiable client information, at all; generic work with no client in it, such as explaining a product type, is a different matter. ChatGPT Business, Enterprise or the API with a signed DPA can be used with client information if the practice records its section 72 basis, enforces single sign-on, sets retention, keeps health detail out and has the adviser approve everything. De-identification is the cleanest route: remove identity on a server the practice controls before anything goes to any model; information that cannot be re-identified is outside POPIA (section 6).

What the Information Regulator has said about AI

As at 15 October 2026 the Information Regulator has issued no guidance note, code of conduct or rule on artificial intelligence or generative AI. Its published guidance notes cover information officers, direct marketing, special personal information, children, elections and Covid-19; none deals with AI tools.

The chairperson's media address of August 2026, marking ten years of the Regulator, names artificial intelligence and automated decision-making among the developments that bring new risks to privacy, transparency and accountability. At an event in September 2026, reported by ITWeb, members of the Regulator doubted that privacy by default and impact assessments are actually being done, and raised AI models keeping personal information beyond the purpose it was collected for.

So the law to apply is POPIA itself: the eight conditions, sections 20 and 21, 71 and 72, and section 22 if something goes wrong. Regulation 4 of the POPIA Regulations makes the information officer responsible for a personal information impact assessment; bringing in an AI tool is the moment to do one, and to keep it on file.

The roles

Responsible party. The FSP. It decides why and how client information is processed and carries the accountability condition.
Operator. Anyone who processes personal information for the responsible party under a contract, such as a software vendor with access to the data. Operators must have a written agreement and adequate security, and must notify the responsible party of any compromise.
Data subject. The client, and also spouses, dependants and beneficiaries who appear in the file.

An AI provider that receives identifiable client information is an operator, and an overseas one triggers section 72 as well. An AI provider that receives only de-identified facts is, in POPIA terms, not processing personal information at all, although a careful practice still records the arrangement.

The conditions that bite

Processing limitation and minimality. Send only what the task needs. A needs analysis needs the client's age, dependants, income, assets and cover; it does not need their name, identity number or address.
Purpose specification and further processing. Information gathered to advise a client may not be used to train a model or for anything unrelated. Check the provider's terms: OpenAI's business plans and API do not train on customer data by default, while its individual plans may unless the user opts out.
Security safeguards (section 19). Appropriate, reasonable technical and organisational measures. For AI tools this means access control, encryption in transit, an audit trail of what was sent, and a written policy.
Cross-border transfer (section 72). Personal information may only leave South Africa if the recipient is bound by law or binding agreement to substantially similar protection, or the data subject consents, or the transfer is necessary for the contract, among other grounds. A personal AI account satisfies none of these in a documented way.
Special personal information. Health details in meeting notes (medical history relevant to cover) carry stricter rules. Keep clinical detail out of what leaves the practice.

De-identification as the design principle

POPIA does not apply to information that has been de-identified so that it cannot reasonably be re-identified. That makes de-identification the cleanest way to use a cloud AI model for analysis and drafting. Done properly it means:

Identity fields are removed before anything is sent: name, identity number, date of birth, email, phone, address.
Those values are also scrubbed from free text, because a summary that says "Ms Fortuin, a conveyancer in Sea Point" identifies the client as surely as a field does.
The model works with placeholders, and identity is put back inside the practice.
The process is tested, not assumed. A practice should be able to show what the model received for a given case.

This is how Tallify is built. The client completes the fact find through the practice's onboarding link, and the facts are read from it by code. Identity is removed on the practice's server by code, and a fail-closed check stops any request that still carries it. Claude, from Anthropic, reads only the de-identified facts and drafts the documents, under commercial terms that exclude training on the data. Names are put back on the practice's server. Nothing goes to ChatGPT or any consumer AI tool, and every drafted client message waits for a person's approval.

Practical rules for a practice

Never

Client notes, fact finds or documents in a personal AI chat account, on any device.
Identifiable information to any model without a written operator agreement.
Health detail from meeting notes in anything that leaves the practice.
An AI-drafted message to a client that no named person approved.

Always

Strip identity on the practice's server before anything is sent, and test that it works.
Record AI processing in the processing records and the client privacy notice.
Log what was sent to any external model, by whom and when.
Have the adviser review and sign everything AI drafts.

In full:

No client information in personal AI chat accounts (ChatGPT Free, Go, Plus or Pro, or their equivalents), on any device, by anyone. Write it into the practice's AI usage policy.
Any AI tool used with client data must either run on a server the practice controls, or be contracted as an operator with an agreement that covers security, no training on your data and breach notification, with the section 72 basis recorded, or receive de-identified information only.
Record AI processing in the practice's POPIA processing records and mention it in the client privacy notice.
Keep a log of what was sent to any external model, by whom and when.
The adviser reviews and signs everything AI drafts. No AI-drafted message goes to a client without a named person approving it; anything sent automatically is limited to what a step just taken calls for, such as a one-time signing code, or to a kind of notice the practice has decided in writing to send without approval; the practice's own templated emails wait for approval too.
Communications consent is captured and enforced: no automated client updates without a recorded yes.
Retention follows FAIS (five years minimum for advice records) and the practice's own schedule; AI drafts that were superseded can be deleted.
Test the de-identification once and then every time the tool changes.

The rules above, and the checks before a tool is approved, are set out as an editable policy the practice can adopt:

AI usage policy template for a practice (Word)Free and editable, written to POPIA and FAIS. No sign-up.

This guide is a practical summary, not legal advice. The practice's information officer and compliance officer remain responsible for its POPIA programme.

Questions

Is ChatGPT POPIA compliant?

No product is POPIA compliant on its own; compliance is about how the practice uses it. A personal ChatGPT account (Free, Go, Plus or Pro) should not receive identifiable client information: by default OpenAI may use the content to train its models, and there is no operator agreement. ChatGPT Business, Enterprise and the OpenAI API do not train on business data by default and come with a data processing addendum, so they can be used if the practice records its section 72 basis for the transfer abroad, controls accounts and retention, and keeps health information out. Removing the client's identity before anything is sent is the safest route.

Can I paste client notes into ChatGPT to write a Record of Advice?

Not into a personal ChatGPT account if the notes identify the client: by default the content may be used for training, there is no operator agreement under sections 20 and 21, and the transfer outside South Africa has no documented section 72 basis. A business plan or the API with a signed data processing addendum can work, with conditions, and de-identified notes are safer still. Either way the adviser writes the advice and signs the record.

Does ChatGPT Enterprise or Business train on our data?

Not by default. OpenAI states that it does not use inputs or outputs from ChatGPT Business, Enterprise, Edu or the API to train its models unless the organisation opts in, and that a thumbs up or down in those workspaces does not permit training on the conversation. Retention is a separate question: workspace admins set it, and deleted conversations are removed from OpenAI's systems within 30 days unless the law requires longer. Checked against OpenAI's pages on 15 October 2026.

Do we need an AI usage policy under POPIA?

POPIA does not name one, but section 19 requires reasonable organisational measures to secure personal information, and the information officer must make sure a compliance framework and a personal information impact assessment are in place. A short written policy that lists the approved tools, says what may never be entered, and requires the adviser to approve every AI draft is the simplest way to show those measures. This guide has a free Word template.

Is de-identified information still personal information under POPIA?

POPIA does not apply to information that has been de-identified to the extent that it cannot be re-identified again (section 6). Removing names, identity numbers, dates of birth and contact details, and scrubbing them from free text, is the standard; the practice should be able to show how it is done.

Who is the responsible party when a practice uses Tallify?

The practice, always. On a practice's own server, BlueBird Digital, which builds Tallify, only becomes an operator if the practice grants access for support. Where Tallify hosts the installation for the practice, BlueBird is the practice's operator under a written operator agreement and the practice remains the responsible party. Anthropic, whose model Claude reads the facts and drafts the documents, receives de-identified facts only.

Do I need client consent to use AI in producing their advice?

Processing for the advisory relationship rests on the contract and the FAIS duties, not on consent, so consent is not the lawful basis for drafting. Consent matters for communications: a practice should only send automated updates to clients who have agreed to receive them. Transparency still applies: tell clients in your privacy notice that AI tools are used and how their information is protected.

ChatGPT and POPIA: can financial advisers use AI with client data?