No contract, no customer data.
Before an AI vendor touches personal information, you need answers to a few questions, and, under POPIA, a written agreement.
Ask every vendor
Due Diligence
- Where is our data processed and stored?
- Is it used to train your models?
- How long is it kept, and can we delete it?
- Which security certifications do you hold?
- What changes between free and business plans?
POPIA operators
Sections 20–21
- A vendor processing personal info for you is an “operator”
- It may only process with your authorisation
- You need a written contract requiring security measures
- It must tell you if the data is compromised
Sources: popia.co.za ↗ · Anthropic Privacy Center ↗
Check the vendor. Sign the contract.