How to anonymise data before using AI (POPIA-safe, step by step)

The safest way to use AI on customer data is to make sure it is no longer personal information. That is what it means to anonymise data before using AI: remove or blur every detail that could lead back to a real person, so POPIA’s rules on personal information stop applying. The work is not complicated, but it is more than deleting the name. Here is the POPIA-safe way to do it.

Why anonymising works under POPIA

POPIA (the Protection of Personal Information Act 4 of 2013) governs personal information. Section 6 says the Act does not apply to personal information that has been de-identified to the extent that it cannot be re-identified again. So if you genuinely de-identify a dataset, it falls outside POPIA and you can put it to work in an AI tool without the Act’s conditions on processing, security or cross-border transfer.

That matters because most AI tools process data outside South Africa, and consumer plans often use what you type for training. OpenAI’s pricing page, for example, says content on its consumer ChatGPT plans is used to train its models unless you opt out, and Google says some Gemini chats are read by human reviewers while Keep Activity is on. Anonymised data takes those worries off the table.

Anonymise vs pseudonymise: the difference that matters

These words get used as if they were the same, and the gap between them is where businesses get caught.

Anonymised data is irreversible: the identifying detail is gone and cannot be rebuilt, so under section 6 it is outside POPIA. Pseudonymised data is reversible: you swap a customer’s name for a code such as Customer 12 but keep a key that maps it back. While that key exists, the data still identifies someone, so it remains personal information.

POPIA’s own definition sets a high bar. To de-identify means to delete any information that identifies the person, that can be used or manipulated by a reasonably foreseeable method to identify them, or that can be linked by a reasonably foreseeable method to other information that identifies them. Swapping in a label while you hold the key does not meet that test.

How to anonymise data before using AI, step by step

Work through it in order; each step removes a layer.

List the identifiers. Go through the dataset and find every field that could identify a person, on its own or in combination: name, ID number, account or policy numbers, email, phone, physical address.

Remove direct identifiers. Delete or replace the obvious ones before anything goes near the AI tool. These name a person outright, so they go first.

Generalise quasi-identifiers. Blunt the details that can identify someone in combination: exact date of birth becomes an age band, a full address becomes a suburb or region, a rare job title becomes a broad category. This step is what separates real de-identification from a deleted name.

Check re-identification risk. Look at what is left and ask whether someone could still work out who it is, especially in a small town or a niche dataset where one record is unusual. If yes, generalise further.

Keep any key separate. If you have to keep a mapping to the real person, store it separately and securely, and never paste it into the AI tool.

Record what you did. Note what you removed and why. A short record lets you show your de-identification was reasonable if anyone asks.

Direct identifiers, quasi-identifiers and linking fields

A worked example

Here is a hypothetical case. A Pretoria physiotherapy practice wants AI to find patterns in which treatments lead to fewer follow-up visits. Its spreadsheet has patient names, ID numbers, dates of birth, suburbs, medical aid numbers, treatment codes and visit dates. Health information is special personal information under section 26, so it must not reach an AI tool in identifiable form.

The practice could delete names, ID numbers and medical aid numbers; turn dates of birth into ten-year age bands; replace suburbs with broad regions; and turn exact visit dates into weeks since the first visit. If one patient is the only 80-year-old from a small area, it could group that record further or leave it out. What remains, treatment codes and follow-up counts by age band, answers the question without identifying anyone.

Checking re-identification risk

De-identification is judged on whether the data can realistically be re-identified, not on whether you ticked off a list of fields. Risk rises sharply in small populations and unusual combinations. A record describing a 42-year-old female attorney in a town of 3,000 may point to exactly one person with no name attached, while the same details in Johannesburg point to thousands.

So the test is contextual. In a large, ordinary dataset, modest generalisation may be enough. In a small or unusual one, generalise harder, or do not use that data in a public AI tool at all. A useful check is to ask a colleague who does not know the customers whether they could name anyone from what is left.

When anonymising is not enough

Sometimes the task is about a specific, named person: drafting a reply to a named customer, working a real claim, acting on one client’s account. You cannot anonymise that and still do the job. Use a business AI plan with a data processing agreement and training switched off, so the personal information is handled under contract as POPIA requires. Remember that while data is still personal information, sending it to an AI service outside South Africa is also a cross-border transfer under section 72.

For how the main tools compare on this, see POPIA-compliant AI tools, can you put customer data into ChatGPT and ChatGPT free vs paid in South Africa. If you want anonymisation built into your own workflow so staff cannot skip it, Zaiq’s AI automation work covers that kind of build.

This is general information, not legal advice. For a high-risk or consequential processing decision, confirm with a POPIA practitioner.