POPIA and AI tools: what South African SMEs should record

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's main data-protection law. Two sections matter to small businesses that use AI tools for marketing or decisions.

Section 71: decisions made only by automated processing

"a data subject may not be subject to a decision which results in legal consequences for him, her or it, or which affects him, her or it to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person including his or her performance at work, or his, her or its credit worthiness, reliability, location, health, personal preferences or conduct." (s71(1))

Section 71(2) sets out exceptions, for example decisions linked to a contract where appropriate measures protect the person's legitimate interests. If you use an AI tool to screen CVs, score credit or rank customers, you need to know which tool does it and on what basis.

Section 69: marketing by email, SMS and automated calls

"The processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject (a) has given his, her or its consent to the processing; or (b) is, subject to subsection (3), a customer of the responsible party." (s69(1))

Every direct-marketing message must identify the sender and give contact details for asking that the messages stop (s69(4)). If an AI tool writes or sends your marketing, these rules still apply.

A practical first step

Keep one list of the AI systems your business uses: what each does, what personal information it touches, and who is responsible for it. That makes it easier to answer questions about sections 69 and 71.

Official sources

Start free: EURO AI Register (1 AI system free; $19/month or $190/year). It is a record-keeping tool. It is not legal advice and not a certification.

Accountant or tax practitioner? See the partner programme.

General information, not legal advice. Checked against the official texts linked above on 14 October 2026; read the law itself or ask a qualified adviser before acting.