POPIA — the Protection of Personal Information Act — came into full effect in South Africa in July 2021. Most businesses know it exists. Far fewer have genuinely worked through what it means for their day-to-day operations, particularly when it comes to AI tools, automated messaging, and call handling.
If your business uses an AI receptionist, records calls, sends WhatsApp automations, or stores any information about the people who contact you — you have POPIA obligations. This guide explains what they are and, critically, how a properly structured AI communication setup handles them correctly.
What POPIA actually covers in the AI context
The Act covers the "processing" of "personal information" about "data subjects." In practice, this means:
Personal information — A name, phone number, medical history, appointment details, voice recording, or any data that can identify an individual. Every call your AI answers and every WhatsApp your system sends involves personal information.
Processing — Collecting, recording, storing, using, transmitting, or deleting personal information. When your AI answers a call and logs the caller's details, that's processing. When your system sends a WhatsApp reminder, that's processing. When a recording is stored for quality review, that's processing.
Responsible party vs operator — Your business is the "responsible party" — you determine why and how personal information is processed. Your AI provider, your WhatsApp BSP (our WhatsApp platform, an alternative WhatsApp BSP), and your telephony provider (our telephony provider) are "operators" — they process information on your behalf. This distinction matters enormously for where liability sits.
The 3 most common POPIA violations in AI call handling
1. Recording calls without proper consent notification
Call recording requires notification and, in many contexts, explicit consent. A system that simply records all calls without informing callers is non-compliant. The fix is straightforward: your AI agent's opening message should include a disclosure — "This call may be recorded for quality and training purposes" — with an option to decline if recording is not essential. For medical practices, more explicit patient consent is required.
2. Sending WhatsApp messages without a lawful basis
You need a lawful basis under POPIA to send WhatsApp messages to individuals. For existing clients who have given you their number and booked an appointment, legitimate interest or contractual necessity typically provides that basis. For cold outreach to contacts sourced from third parties — this is where businesses get into trouble. Scraping LinkedIn profiles and WhatsApp-blasting them is not POPIA compliant.
3. Using third-party processors without a Data Processing Agreement
If any third-party service touches your customers' personal data — your AI provider, your WhatsApp BSP, your CRM — you need a written Data Processing Agreement with them. This agreement establishes what data they can process, how they must protect it, and what happens to it when you terminate the relationship. Operators (third parties) bear significant liability under POPIA, but only if the DPA is in place.
The Data Processing Agreement — what it is and why it matters
A DPA is a contract between your business (the responsible party) and a service provider that handles personal data on your behalf (the operator). It must cover:
- What personal information is being processed and for what purpose
- The security measures the operator has in place
- Restrictions on the operator using your customers' data for their own purposes
- The operator's obligation to notify you of data breaches
- What happens to the data when the contract ends
Reputable providers — our telephony provider, our WhatsApp platform, Google, Microsoft — all have DPAs available. In many cases you can accept them online through the provider's console. What matters is that you've done it, and that you can evidence it.
WhatsApp and POPIA — the specific grey areas
WhatsApp sits in a tricky position under POPIA because of the blurry line between personal and business use. A few specific points to be aware of:
Using a personal WhatsApp number for business — Meta's terms of service technically prohibit using the standard WhatsApp app for commercial purposes at scale. More relevant to POPIA: personal WhatsApp accounts don't provide the business controls (message logs, data portability, deletion mechanisms) needed for POPIA compliance. Businesses handling sensitive customer information should use WhatsApp Business API, not personal accounts.
Storing WhatsApp conversation history — Retaining WhatsApp message history is storage of personal information. Your retention policy must cover how long you keep these records and how they're secured.
Third-party access — If your WhatsApp management platform (our WhatsApp platform, etc.) can access your message history, they're an operator under POPIA and you need a DPA with them.
POPIA compliance checklist for businesses using AI receptionists
- AI call opening includes a call recording notification
- Call recordings are deleted within your defined retention period
- Data Processing Agreement in place with your AI provider
- DPA in place with your WhatsApp BSP (our WhatsApp platform, our telephony provider, etc.)
- DPA in place with your telephony provider
- Lawful basis documented for all categories of WhatsApp messages sent
- Opt-out mechanism included in all outbound WhatsApp templates
- Privacy notice on your website and booking pages updated to reflect AI handling
- Process in place for customers requesting access to or deletion of their data
- Data breach notification procedure documented
How Agent Help handles POPIA compliance
Agent Help is structured from the ground up to operate within POPIA requirements:
Call recording: The AI opening message includes a recording disclosure. Patients on MedDesk plans give explicit verbal consent before consultation recordings begin. Recordings are automatically deleted after transcription unless the client specifically requests retention.
Data processing: Customer data is not stored on Agent Help's own servers. Voice processing happens through our telephony infrastructure (GDPR-compliant, DPA available). WhatsApp is managed through our WhatsApp integration (GDPR-compliant, DPA available). Transcription for MedNotes uses our transcription service (SOC 2 certified, DPA available).
DPAs: Agent Help provides a Data Processing Agreement to all clients as part of onboarding. Third-party DPAs are in place and available on request.
Is Agent Help POPIA compliant? Yes — the architecture is designed to process personal information lawfully, with appropriate safeguards, through compliant third-party operators.
Questions about POPIA and your AI setup?
We're happy to walk you through how Agent Help handles compliance for your specific industry.
