POPIA section 71 and automated decision-making

What it is

The Protection of Personal Information Act 4 of 2013, known as POPIA, is South Africa’s data protection law. Section 71 is its rule on automated decision-making. It is short, and it is the main binding rule in South African law aimed at decisions made by algorithms, including AI systems, about people.

Section 71(1) says a data subject may not be subject to a decision which results in legal consequences for them, or which affects them to a substantial degree, where the decision is based solely on automated processing of personal information intended to provide a profile of the person. The Act lists examples of what a profile covers, namely performance at work, creditworthiness, reliability, location, health, personal preferences and conduct.

Section 5(g) of POPIA restates this as one of the data subject’s rights, the right not to be subject, under certain circumstances, to a decision based solely on automated processing intended to profile them.

Who it applies to

POPIA applies to the processing of personal information entered in a record by a responsible party that is domiciled in South Africa, or that is not domiciled there but uses automated or non-automated means in South Africa. Means used only to forward information through the country do not count. A responsible party is the public or private body, or person, that decides the purpose and means of processing.

POPIA’s definition of a data subject includes existing juristic persons as well as natural persons, so section 71 can protect companies as well as individuals.

The duty sits with the responsible party. An organisation that uses a vendor’s AI system to screen applicants, score credit or flag fraud is still the responsible party for those decisions. The vendor is usually an operator acting on its behalf.

What it requires

Section 71 is engaged when three things are true. There is a decision with legal consequences or a substantial effect on the person. The decision is based solely on automated processing, with no meaningful human involvement. And the processing is intended to build a profile of the person.

Where all three are present, the decision is allowed only under one of the exceptions in section 71(2).

• Contract. The decision is taken in connection with concluding or executing a contract, and either the data subject’s request under the contract has been met, or appropriate measures have been taken to protect their legitimate interests.
• Law or code of conduct. The decision is governed by a law or code of conduct that specifies appropriate measures for protecting data subjects’ legitimate interests. Section 60(4) requires codes of conduct issued under POPIA to specify such measures where automated decision-making is concerned.

Section 71(3) defines the appropriate measures for the contract route. They must give the data subject an opportunity to make representations about the decision, and require the responsible party to give the person sufficient information about the underlying logic of the automated processing so that they can make those representations.

For an AI system, that turns into three practical questions. Which systems make decisions about people with real consequences, and is a person genuinely involved before the decision takes effect? Where a system decides on its own, which exception applies? And can the organisation explain the logic of the system well enough for an affected person to challenge it, and receive and act on that challenge?

The rest of POPIA applies alongside section 71. The conditions for lawful processing in Chapter 3 cover purpose, minimality, openness and security. Section 18 requires notice when personal information is collected. Section 57 requires prior authorisation from the Information Regulator for some kinds of processing, and the Regulator has issued a guidance note on that process.

Key dates

• 26 November 2013. POPIA published in the Government Gazette.
• 1 July 2020. Most of POPIA, including section 71, commenced by proclamation.
• 1 July 2021. End of the one-year grace period under section 114(1), by which existing processing had to conform to the Act.
• 10 April 2026. Draft National AI Policy gazetted for public comment.
• 26 April 2026. The Minister of Communications and Digital Technologies announced the draft’s withdrawal, and the withdrawal notice was gazetted in June 2026.

How it relates to other frameworks

Section 71 is close in structure to GDPR Article 22. Both target solely automated decisions with significant effects, both allow them for contracts and where law provides safeguards, and both rest on the person being able to understand and contest the decision. POPIA has no explicit consent exception, and it reaches juristic persons, which the GDPR does not. Brazil’s LGPD Article 20 takes a different route, giving a right to request review of automated decisions rather than restricting them.

South Africa has no AI-specific law. The withdrawn Draft National AI Policy was built on the National Artificial Intelligence Policy Framework of August 2024, and Cabinet has said a reworked policy will follow. Until then, organisations using AI in South Africa often pair POPIA with an international framework such as ISO/IEC 42001 or the NIST AI RMF to structure their risk and impact assessments.

A note on this page

This is Aicura’s reading of POPIA section 71. It is not legal advice and it is not the Act itself. Read the primary source published by the Information Regulator, and take advice on how POPIA applies to your organisation.