You can, but not casually. Every current chat model from OpenAI, Anthropic, Google, Microsoft Azure and AWS processes your prompt outside South Africa. Sending a customer’s personal information to one is a transfer abroad under section 72 of the Protection of Personal Information Act, and it comes with conditions. The cleaner route is to take the personal information out before the prompt leaves your system. Information that has been de-identified so that it cannot be re-identified falls outside the Act altogether, under section 6(1)(b).
This is the Act’s text and the providers’ own documentation, read on 19 October 2026. It is not legal advice.
Do any AI models run inside South Africa?
For current chat models, no.
- OpenAI processes data in-region only in the US, Europe and the UAE. South Africa is not on its list.
- Anthropic’s API runs either globally or in the US.
- Microsoft Azure has a South Africa North region, but its current GPT models there are Global deployments, which Microsoft says “might be processed in any Azure region”. The only chat model processed in South Africa is an older version of GPT-4o, on reserved capacity.
- AWS Bedrock in Cape Town reaches Claude and GPT models only through global routing, where data may be processed in any commercial region.
- Google’s list of model locations has no African region.
So hosting your application in a South African data centre does not settle it. Your app can run in Johannesburg while the model it calls runs in the United States.
What does POPIA say about sending personal information abroad?
Section 72 allows a transfer to someone in another country only if one of these is true:
- the recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA
- the person consents to the transfer
- the transfer is needed to perform a contract with that person, or to take steps they asked for before one
- the transfer is needed for a contract made in that person’s interest with a third party
- it benefits the person, asking them is not reasonably practicable, and they would probably agree if asked
Four other sections bear on AI in particular:
- Section 18(1)(g) requires you to tell people when you intend to send their information to another country, and what protection it will have there.
- Under section 21, an AI provider processing personal information for you is an operator, and you need a written contract that holds it to the security standard in section 19.
- Under section 57(1)(d), sending special personal information (health, religion, race, biometrics, criminal matters) or children’s information to a country without adequate protection needs the Information Regulator’s authorisation first.
- Section 71 says a person may not be subject to a decision with legal or substantial effect that is based solely on automated profiling, such as of their creditworthiness, health or work, unless one of the Act’s exceptions applies. Those exceptions require a chance to respond and an explanation of the logic. An AI that declines an application on its own is a risk. A person who reviews what the AI suggests is the safer pattern.
The Information Regulator had published no guidance on AI by 19 October 2026. None of its six guidance notes deals with it.
What do the AI providers do with what you send?
On their paid APIs, OpenAI and Anthropic both say they do not train their models on your data by default. OpenAI keeps abuse-monitoring logs for up to 30 days, and Anthropic deletes API inputs and outputs within 30 days. Both offer zero data retention, OpenAI after approval and Anthropic through its sales team.
That covers the API that a developer builds on. A staff member pasting customer details into a personal chat account is a different product on different terms, and it is the habit most worth stopping.
How do you use AI without sending the personal information?
On a wills platform I built, the brief was that personal data stays in South Africa, while the models worth using all run abroad. So the system is split along that line. One service is the only part allowed to reach an external model. Before a request leaves, that service strips out the personal information using Presidio, an open-source tool that started at Microsoft and is now community-run, together with recognisers written for South African identifiers. When the answer comes back, the service puts the details back in. The network boundary and the privacy boundary are the same wall.
A few things make that approach work in practice:
- Presidio ships recognisers for South African ID numbers (checked against their check digit), passports, tax and VAT numbers and mobile numbers, but they are switched off by default. Turn them on and test them against your own data.
- Presidio warns that it cannot guarantee it finds everything, so do not treat it as the only safeguard. Keep the single exit point, and log what passes through it.
- Some steps never need to leave at all. The search on JobAbroad builds its embeddings with a model that runs inside the application itself, so that step sends nothing out.
- Log every model call: the prompt, the model, the response. The EdenFintech scanner records each one before its result is used, which is also the record POPIA expects you to keep of your processing.
- Leave decisions that matter to a person, and keep special personal information out of prompts entirely.
AI can sit inside a business system without customer data leaving the country. If you have a use for it in mind, tell me what it is.
Sources
- Protection of Personal Information Act 4 of 2013, as gazetted: sections 6, 18, 21, 57, 71 and 72
- Information Regulator, Guidance notes
- OpenAI, Your data
- Anthropic, model training, data retention and data residency
- Microsoft, Foundry models by region
- AWS, Bedrock model support by region
- Google, model locations
- Presidio, project repository
Provider regions change often. I recheck this page every three months.