Team Session 4: Data protection & POPIA

Before the session

Read Days 32, 34 and 37 (about five minutes each), or Module 4 on the cheat sheet.

0–5 minOpen
Quick round: what's one piece of personal information you handled yesterday?
5–15 minDiscuss three days
- Day 32: Need it? Strip it. Or don’t paste it.Which of our regular AI tasks would work just as well with the personal details removed?
- Day 34: Collected for X? Don't quietly use it for Y.Are we using any information for a purpose other than the one people gave it to us for?
- Day 37: Keep it only as long as you need it.Where does our AI work leave copies behind: chat histories, uploads, shared threads?
15–25 minExercise: Strip the prompt
Write out one real prompt the team uses on customer or staff information, with placeholders like [name] and [ID number] where the real details would go. Circle only the ones the task truly needs. Rewrite the prompt without the rest, using reference numbers where you can.
25–30 minAction for the week
Each person checks the chat history in one AI tool they use for work and brings back how much personal information was sitting there.
Agree the team rule: “Leave personal details out by default.”

Thinking POPIA is only about databases and marketing lists (Day 31). A single prompt can be processing, so keep the talk on everyday tasks.

A whiteboard or shared doc, one example prompt with placeholders, and a timer.

Next session: Module 5 · Shadow AI & security. Bring the rewritten prompt, and what you found in your chat history.