What actually happens when you press enter

You have a spreadsheet of four hundred customers and a question about it. You highlight the lot, copy, click into the chat box, paste, and type “which of these haven’t bought in six months?” The answer comes back in nine seconds and it is a good answer.

Here is what happened underneath. Four hundred names, cell numbers and email addresses left your laptop, crossed the sea to a data centre almost certainly not in South Africa, and were written down on a server belonging to a company you have never spoken to. They are still there. Depending on the account you were signed in to, they may be read by a person, kept for years, or used to train the next version of the model.

None of that is a scandal. It is how the service works, and the vendors publish it openly. The problem is that pasting feels like typing, and typing feels private. It is not typing. It is uploading.

The test is not whether the tool can be trusted. It is whether you would be happy reading that paragraph aloud to the person it describes.

One real episode shows why the account matters more than the toggle. During the New York Times’ copyright case, a United States court ordered OpenAI to preserve consumer ChatGPT and API data it would normally have deleted. By OpenAI’s own account the people caught by it were those on ChatGPT Free, Plus, Pro and Team, or using the API without a zero data retention agreement; ChatGPT Enterprise and Edu customers were not affected. Read that list again, because Team is the plan now sold as ChatGPT Business — the tier this guide points small businesses towards. The obligation ended on 26 September 2025, and nothing was disclosed to the newspaper: OpenAI says the April to September 2025 data was held in a separate, locked, audited system. Which is rather the point. Something outside your control happened in a foreign courtroom, and the tier you were on decided which side of the line you landed on. You cannot predict the next one. You can decide, once, which bucket you are in.

Personal account, business account, and the gap between them

Every big assistant now sells the same thing twice: a personal version and a version for organisations. The difference is not the model — usually it is the same model. The difference is what the company promises to do with what you send.

On the personal tiers, the default is sharing

OpenAI’s help documentation states that on a ChatGPT Free, Plus or Pro plan in a personal workspace, “data sharing is enabled for you by default”. Switch it off under Settings, Data Controls, “Improve the model for everyone”, and OpenAI says “new conversations will not be used to train our models”. Read that carefully. New conversations. Not yesterday’s.

Google is equally direct about consumer Gemini. Its privacy hub says a subset of chats are reviewed by humans and kept for up to three years, and that even with activity switched off, chats are held for 72 hours. Google’s own advice there is the plainest sentence any vendor has written on this: “Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services, including machine-learning technologies.”

Anthropic changed its consumer terms in 2025 so Claude Free, Pro and Max users must choose. Its announcement says that if you allow chats to be used for model improvement they are kept for five years; if you decline, the existing 30-day retention continues.

On the business tiers, the default is the opposite

OpenAI states that with ChatGPT Business, Enterprise, Edu and its API, “by default, we don’t use provided inputs and outputs to train our models”. Microsoft says that with enterprise data protection, “the prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models”. Google says Workspace does not use customer data for training without permission or instruction, and Anthropic says the same of its commercial products. Four wordings, one meaning — and all four say it only about the organisational tier.

The nine things owners paste without thinking

None of these are foolish. Each is a sensible person doing a sensible job faster. For each: what actually leaves, and a cleaner way to ask the same question.

1. The client list

What leaves: every name, cell number, email address and spend figure, linked together — far more revealing than any one column alone. Under POPIA that is both a use your customers did not agree to and a transfer of their information out of the country.

Instead: replace the names with row numbers before you paste. The model need not know who row 12 is to tell you row 12 has gone quiet since March. Keep the key in your own spreadsheet, where it always was.

2. A full CV, or an ID number

What leaves: a South African CV usually carries an identity number, a home address, a photograph, sometimes marital status and dependants. The ID number alone encodes date of birth, gender and citizenship. Employment equity forms add race, which POPIA treats as special personal information held to a higher bar.

Instead: cut the header block and paste the experience and qualifications only. Better still, ask for a scoring rubric for the role and score the applications yourself. Fairer process, nothing personal leaves.

3. A signed contract

What leaves: both parties’ names and addresses, signatures, sometimes banking details — and frequently a confidentiality clause forbidding disclosure to a third party. Uploading it can breach the very agreement you were asking about.

Instead: paste the clause, not the contract, and swap the names for “Party A” and “Party B”. A termination clause reads identically either way. And “how exposed am I here” is a question for an attorney, not a chatbot.

4. Patient or client case notes

What leaves: health information about a named living person. POPIA puts health and sex life in its special category, where processing is prohibited unless a specific ground applies. If you belong to a professional council, you carry a confidentiality duty on top of the Act that does not move.

Instead: be genuinely conservative here. General questions — current thinking on a condition, how to structure a treatment plan — need no patient detail at all. For a real person’s notes, use an organisational tier with a signed data processing agreement, or do not use these tools for notes. Never paste a name, date of birth, ID or medical aid number.

5. Bank statements

What leaves: your account number, branch, balance, and a month of who you paid and when — so your staff’s salaries and your suppliers’ details go too. POPIA singles account numbers out: section 105 makes it an offence for a responsible party to mishandle one where the failure is serious or persistent and likely to cause substantial damage or distress.

Instead: almost every South African banking app exports a CSV. Delete the account-number column and the header block, then paste date, description and amount only. That is all a categorisation question needs. If you do this monthly, our invoicing guide covers tools that categorise for you with no pasting at all.

6. Staff disciplinary details

What leaves: a named employee’s alleged misconduct, which can amount to information about criminal behaviour — another special category. And if the matter later reaches the CCMA, you have created a record of your own early thinking, in a system you do not control.

Instead: strip the identity out of the prompt. “An employee has been late eight times in six weeks after two verbal warnings — draft a written warning” produces the same letter as the version with a name in it. Put the name in at the end, in your word processor.

7. Source code with credentials in it

What leaves: configuration files carry database passwords, payment gateway keys and API tokens, near the top of the file where a quick copy sweeps them up. A key pasted into a chat window is a key you must treat as exposed, whatever the vendor’s policy says.

Instead: replace the value with the word PLACEHOLDER before you paste. The code still reads correctly and the model can still find your bug. If you have already pasted one, rotate it at the provider today rather than next week. Ten minutes, and the matter is closed.

8. A supplier price list under NDA

What leaves: this one is rarely a POPIA question. It is a contract question. Supply agreements routinely make pricing confidential, and handing the document to a third-party service is disclosure. The commercial risk is plainer — your best supplier terms are your margin.

Instead: strip the names and paste the numbers. A comparison works perfectly well on “Supplier A” and “Supplier B”, and you will read the answer the same way.

9. Photographs of documents

What leaves: more than you meant. These tools read images as well as text, so a photographed ID book, proof of address, delivery note or whiteboard of quarterly figures is fully legible to them. The photograph also carries the rest of the desk, the screen behind it, and sometimes location data.

Instead: crop before you upload, every time. If you need one number off a document, type it rather than photographing the page. Identity documents should not go into a chat window at all — take the single field you need.

Where POPIA comes into it

This is not legal advice, and the last section says where you need someone qualified. What follows is the shape of the obligation, so you can recognise when you are inside it.

You are a responsible party, and being small does not change that

POPIA calls you a “responsible party” when you determine the purpose of and means for processing personal information. If you decide what customer details you collect and what happens to them, that is you. The Act excludes processing done “in the course of a purely personal or household activity”, and running a business is not that.

The Information Regulator puts it without hedging: any organisation, public or private, irrespective of size, or any individual which processes personal information is a responsible party. Its guidance says sole proprietors, small businesses and firms are also obliged to register their Information Officer — which in an owner-run business is the owner. Registration is done at the Regulator’s eServices portal, and it is the most concrete thing here you can finish this week.

“Further processing” is the phrase that catches people

POPIA says further processing must be compatible with the purpose the information was collected for. Your customer gave you a cell number so you could tell them the car was ready. Feeding that list to a chatbot to write a marketing segmentation is a different purpose. Not automatically unlawful — compatibility is a judgement, and there are grounds that support it. It does mean you need to be able to answer the question if someone asks.

The vendor becomes your operator, and operators need contracts

An “operator” under POPIA is someone who processes personal information for you under a contract or mandate — exactly what an AI vendor does with your customer list. The Act requires a written contract with an operator setting out the security measures they will keep. A free account gives you terms of service. A business tier with a data processing addendum gives you the contract. That is the answer to “why pay when the free one works?”

Sending it overseas is a transfer

Section 72 governs sending personal information to another country, and permits it on a handful of grounds: a foreign law offering adequate protection, binding corporate rules, an agreement between sender and receiver, the data subject’s consent, or necessity to perform a contract. Every one of these assistants processes overseas. For most owners the practical route is the binding-agreement limb of section 72(1)(a), and a data processing addendum is what fills it.

Redaction is not tidiness — it is the exit

POPIA does not apply to information de-identified to the extent that it cannot be re-identified. That single line is why the habit in the next section outweighs every setting in this guide. Be honest about the bar, though: “cannot be re-identified” is demanding. Removing the names from a list of three clients in a small dorp de-identifies nothing, because anyone local can put them back.

If something does go wrong

POPIA requires you to notify both the Regulator and the affected people when personal information is accessed by someone unauthorised, and since April 2025 that report goes through the Regulator’s eServices portal. Its fact sheet lists ordinary office accidents among the examples — an email to the wrong recipient, a lost unprotected device — not only cyber-attacks.

The Act carries administrative fines of up to R10 million, so be level-headed about it. Enforcement so far has concentrated on large organisations, and the realistic risk to a five-person business is not a headline fine — it is a customer complaint, an enforcement notice, and weeks of your attention. Reason enough to do the small things properly.

Redact first: the ninety-second habit

Almost everything above collapses into one routine. Do not paste from the source. Paste into a plain text document first, clean it there, then paste the clean version into the chat. After a fortnight you do it without noticing.

Four moves, in this order:

1. Replace names with labels. Find and replace, or type them by hand for short pieces. Client A, Employee 1, Supplier B. Keep the key in your own file.
2. Delete identifier columns entirely. ID numbers, account numbers, cell numbers, email and physical addresses. Delete the column rather than blanking the cells — blanked cells often still carry the data underneath.
3. Cut the header block. On CVs, contracts, statements and letterheads, most of the identifying material lives in the first fifteen lines and the signature block. Take both off.
4. Read what you are about to send. Top and bottom especially. Fifteen seconds, and it catches more than the other three steps together.

One thing this habit is not: asking the chatbot to redact for you. “Remove the personal information from the following” means it has already arrived. Redaction only counts before you press enter.

The never-paste list for your wall

Print this and put it where anyone else in the business who uses these tools can see it, because the person who pastes the client list is very often not you.

NEVER PASTE THE WHOLE THING
  ID, passport and driver's licence numbers
  Bank account numbers and full statements
  Health or case notes about a named person
  A named employee's disciplinary matter
  Passwords, API keys, database strings
  Photographs of identity or address documents
  Anything under an NDA, with the names still on it

REDACT FIRST, THEN PASTE
  Client lists   ->  row numbers, not names
  CVs            ->  experience only, no header
  Contracts      ->  the clause, not the agreement
  Quotes         ->  Supplier A and Supplier B
  Statements     ->  date, description, amount only

PASTE FREELY
  Your own drafts, marketing copy and notes
  Public prices, public policies, your website text
  Invented examples that have the same shape
  Anything already published under your own name

IF YOU PASTED SOMETHING YOU SHOULDN'T HAVE
  1. Delete the chat, and clear it from history
  2. Rotate any password or key that was in it
  3. Write down what was in it, and when
  4. Only then decide whether it needs reporting

That last block matters more than it looks. The instinct after a bad paste is to close the laptop and hope. Deleting helps — OpenAI says a deleted chat leaves your account immediately and is scheduled for permanent deletion within 30 days — but it does not undo the sending. Write down what went, and when. If it later needs a notification, that note is the difference between a calm report and a fortnight of reconstruction from memory.

Choosing a tier without paying twice

Here is where the mainstream tools stand today, from each vendor’s own current documentation. These policies change often, so check the vendor’s page before committing to anything that matters.

The WhatsApp row deserves a moment, because in South Africa the business runs on WhatsApp. Meta says it does not use the content of your private messages to train its AI unless you or someone in the chat chooses to share them with it. Tagging Meta AI into a group chat is that choice, made on behalf of everyone else in the group. Meta also says it uses automated technology and people to review interactions with its AI. In May 2026 WhatsApp launched an Incognito Chat mode for talking to Meta AI, describing it as a conversation where “no one can read your conversation, not even us” — which tells you what an ordinary Meta AI chat is not. Your ordinary WhatsApp chats with people stay end-to-end encrypted either way.

A sensible order for most small businesses: sign in with the work account you already pay for; failing that, put the two or three daily users onto one assistant’s business tier rather than personal subscriptions each. If you are moving beyond pasting into something that runs on its own, read Your First AI Agent before connecting anything to live customer data.

When to stop and phone a professional

We are not attorneys and nothing here is legal advice. Five situations cost more to guess at than an hour of proper help would, and each is easy to recognise.

You handle health, biometric or criminal-behaviour information about named people. Practices, clinics, security firms, recruiters running verification. POPIA’s special categories carry a higher bar, and this is not a place to reason it out alone.

You process children’s information. Creches, schools, tutoring, kids’ sport. The Act has its own regime for children and the Regulator has published guidance on it.

Something has already gone wrong. A leak, a lost laptop, a mis-sent file. Notification has requirements about who is told and what they are told, and a clumsy first letter to customers is hard to walk back.

You are signing something about data. Either a client wants you to sign terms about how you handle theirs, or you are drafting terms for your own customers.

You are about to connect the tool to live data. Pasting by hand is a decision you make each time. A connected system processes continuously, a different obligation entirely.

Who to call: an attorney who does data protection work, or a POPIA compliance practitioner. Ask for a fixed fee for a scoping conversation before agreeing to anything ongoing. And whatever else you do, register your Information Officer — that one is yours to do, and it takes an afternoon.