POPIA-Compliant Data Analytics: A Practical Guide

You can analyse customer and sales data under POPIA, as long as you have a legitimate purpose, use only the personal information you need, and protect it properly. In practice, most business analytics does not need names, ID numbers or phone numbers at all, so the simplest route to POPIA-compliant analytics is to strip or mask those fields before the analysis starts. This guide walks through how to do that in a way that works for a small or mid-sized business.

What counts as personal information in your data

POPIA protects information about an identifiable, living person and, unusually, about an identifiable existing juristic person such as a company. In a typical business dataset that includes more than the obvious columns:

• Direct identifiers: names, SA ID numbers, passport numbers, email addresses, phone numbers, physical addresses.
• Financial details: bank account numbers, card numbers, credit history.
• Indirect identifiers: a customer number, a delivery address or a date of birth combined with a suburb can identify someone.
• Free text: notes fields, support tickets and call transcripts often contain names, numbers and addresses nobody planned to collect.
• Special personal information: health, religion, race, biometrics and criminal records carry stricter rules, and usually do not belong in routine sales reporting at all.

The POPIA principles that matter most for analytics

POPIA sets out eight conditions for lawful processing. For analytics work, four of them do most of the heavy lifting:

The others (accountability, information quality, openness and data subject participation) still apply to your business as a whole, but they are usually handled by your privacy notice and your Information Officer rather than by each report.

Step 1: Minimise before you analyse

Start with the question and work backwards to the columns. Say you want to know which product lines grew in March. You need order date, product, quantity, value and perhaps region. You do not need the customer’s email or phone number. Export only those columns, or delete the rest before the file leaves your accounting or e-commerce system.

1. Write down the business question in one sentence.
2. List the columns that question actually needs.
3. Export only those columns, or drop the others straight after export.
4. If you need to count unique customers, keep a customer number or a hashed ID rather than the name.

Step 2: Mask what you can’t remove

Sometimes a personal field is useful in aggregate. Postal codes let you map sales; a date of birth lets you group by age band. Convert these into less identifying forms before analysis:

• Replace dates of birth with age bands such as 25–34.
• Truncate postal codes or use the city or province instead of the street address.
• Replace names and emails with a random or hashed customer key.
• Scan free-text columns for email addresses, phone numbers and 13-digit SA ID numbers and redact them.

Masked data is not automatically outside POPIA if it can easily be re-identified, but it dramatically reduces the harm if a report or file ends up in the wrong place.

Step 3: Control access to data and reports

A surprising amount of risk comes from copies: the spreadsheet emailed to five people, the export on a laptop, the shared folder nobody cleaned up. Good habits include:

• Give people the role they need: most staff only need to view finished reports, not raw data.
• Use read-only database accounts for reporting so an analysis tool can never change or delete records. See our guide to connecting a SQL database read-only.
• Share reports through links that expire rather than attachments that live forever.
• Switch on two-factor sign-in for any tool that holds business data.
• Keep an audit trail of who ran, viewed or exported what.

Step 4: Be careful with AI and cloud tools

When you upload a spreadsheet to an AI tool, you are sharing it with an operator, and POPIA expects you to have a written agreement that the operator will keep it secure. Transfers outside South Africa have their own conditions too. Before you paste customer data into any chatbot, work through our POPIA checklist for AI tools.

Summarix was designed with this in mind: before any AI call, it removes sensitive columns such as emails, phone numbers, ID numbers, card and bank numbers, addresses and dates of birth, and scans free text for things like SA ID and card numbers. The AI only sees a statistical profile and a small masked sample of at most 15 rows, while the numbers in the report are calculated by Summarix’s own code.

Step 5: Keep, then delete

POPIA does not want records kept longer than needed for their purpose, subject to other laws that require you to keep some records. For analytics, that usually means keeping the aggregated report (which rarely contains personal information) and deleting working extracts once the report is done. Make it a line on your month-end checklist: delete last month’s raw exports from desktops and downloads folders.

Putting it together

POPIA-compliant analytics is mostly discipline, not paperwork: define the purpose, take only the columns you need, mask what remains, limit who can see it, choose tools that respect those limits and clean up afterwards. Do that consistently and you get the insight from your data with far less exposure if something goes wrong.