South Africa’s POPIA applies to personal information practices, including many AI workflows. Its automated-decision protections are more specific than a general prohibition on every automated recommendation.
Map POPIA to model life cycle
A recruitment model can collect application files, derive scores and share results with an employer. Each stage needs an accountable processing purpose, limits on data collected, safeguards and retention decisions. Include input histories, embeddings, system logs and any training reuse in the mapping; a model output may itself contain personal information.
Understand section 71 context
POPIA addresses certain decisions based solely on automated processing intended to create profiles and producing legal or similarly substantial effects, subject to statutory conditions. Do not state that every algorithmic score is banned or that adding an honorary human sign-off always avoids the rule. Evaluate the decision’s actual role and the possibility of meaningful contestation.
Cross-border processing
A globally hosted LLM may process South African customer information abroad. Check POPIA transfer provisions, recipient protections, consent where relevant and procurement representations. Hosting geography is one piece: customer-support access, backups and incident forensic copies may involve other destinations.
Document controls the regulator could understand
Provide accurate privacy notices, access controls, data subject request procedures, human review for consequential outputs, an appeal route and breach response. A practical control is a signed record showing why an automated result was accepted or overridden, not merely a generic “AI is unbiased” statement.
Scope and alternatives
This guide does not substitute for section-by-section legal advice or Information Regulator interpretations. For high-impact hiring or credit decisions, consider using AI only to organize materials and leave substantive judgments to qualified decision-makers until the automated-decision analysis is complete.
Sources & Further Reading
- Protection of Personal Information Act 4 of 2013 — Government of South Africa.
Jurisdiction/scope: South Africa; POPIA scope. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.