POPIA automated decision-making rules sit in section 71 of South Africa’s Protection of Personal Information Act 4 of 2013. A person may not be subject to a decision that has legal consequences for them, or affects them to a substantial degree, if it is based solely on automated processing of personal information meant to build a profile of them. The Act gives examples such as work performance, creditworthiness, reliability, location, health, personal preferences and conduct. There are two exceptions: decisions made in connection with a contract, where the person’s request has been met or appropriate measures protect their interests, and decisions governed by a law or code of conduct that sets out such measures. In the contract case, the person must be able to make representations about the decision and be given enough information about the underlying logic of the processing to do so.
Section 71 came into force on 1 July 2020. The Information Regulator gave organisations a one-year grace period, and its enforcement powers took effect on 1 July 2021. South Africa has no AI-specific law. Its draft National AI Policy, published for comment in 2026, was withdrawn with Cabinet approval in June 2026 after it was found to cite fictitious sources.