Is ChatGPT POPIA-compliant? Assess the account and the workflow

OpenAI says content from individual services such as ChatGPT may be used to improve models, with an option to opt out. Temporary Chats are not used for training. Switching off training is useful, but does not by itself settle retention, access or your organisation’s responsibilities.

OpenAI separately states that business products and the API do not train on business data by default, and makes a Data Processing Addendum available for ChatGPT Business, Enterprise and the API. Do not assume every plan has identical controls.

Begin with a sentence such as: “An approved employee uses selected support notes to draft a reply, then checks it before sending.” List the fields needed, who can enter them, where outputs are saved and who receives them.

Use synthetic examples for the first test. Remove unnecessary identifiers and check whether the remaining context could still identify someone. Replacing a name with “Customer A” is not a reliable guarantee of anonymisation.

Record the workspace owner, applicable agreement, retention settings and any connected apps or external actions. A connected service may receive information under its own arrangements. Check the exact feature rather than relying on a general product badge.

For international processing, document the applicable transfer basis and relevant safeguards. POPIA section 72 permits transfers under specified conditions; neither an overseas server nor a privacy-notice sentence settles the assessment by itself. Do not advertise a residency option unless it is actually available and enabled for your account.

Keep a short approved-use guide with realistic examples of allowed and disallowed inputs. Define who checks factual accuracy, quotations, calculations and any customer commitment. Keep consequential decisions with an appropriately responsible person.

Test an incorrect answer, a confidential attachment and a request outside the approved scope. Staff should know when to stop, where to report a mistake and how to obtain help. Review the arrangements when the product, connected apps or intended use changes.

Use a focused privacy or legal review where the proposed processing needs it, especially for sensitive records or consequential decisions. The practical output should be a documented decision and implemented controls, not a generic assertion that an AI brand is compliant.

Aitsa can scope staff training or a controlled workflow separately after a free initial conversation.