South Africa's POPIA and Automated Decision-Making

South Africa’s automated decision provision is older than the GDPR in conception and stricter than it in one respect that almost never gets mentioned: it protects juristic persons. A credit decision made about a company by a model is within it.

What section 71 prohibits

The Protection of Personal Information Act 4 of 2013 commenced for its substantive provisions on 1 July 2020, with the enforcement grace period ending on 30 June 2021. Section 71 is headed “Automated decision making”. The Act is published by the government: POPIA as enacted, and the regulator is the Information Regulator of South Africa.

Section 71(1) provides that a data subject may not be subject to a decision which results in legal consequences for them, or which affects them to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to provide a profile of that person—including their performance at work, creditworthiness, reliability, location, health, personal preferences or conduct.

Three elements have to hold: a decision with legal consequences or substantial effect, based solely on automated processing, of personal information intended to provide a profile. The profiling element is a genuine limit—an automated decision that does not rest on a profile of the data subject is arguably outside section 71—though the listed profile characteristics are broad enough that most consequential automated decisions about a person will engage it.

It protects companies too

POPIA is unusual among data protection statutes in defining a data subject to include a juristic person, and section 71 tracks that definition. The section’s own language refers to creditworthiness alongside personal characteristics, which reads naturally only once you notice that a company can be the protected party.

This matters commercially in a way the European analysis never has to consider. Automated business credit scoring, automated supplier risk assessment and automated commercial underwriting are all activities that fall outside the GDPR entirely for want of personal data, and that can be within POPIA when carried out about a South African juristic person. A business-to-business model that has been scoped out of privacy analysis elsewhere on the ground that it processes no personal data needs a different answer here.

The comparison worth holding in mind is that both the GDPR’s “solely automated” test and section 71 turn on the same conceptual question—whether a human contributes to the decision or merely records it—but that the class of protected subjects differs.

The two exceptions

Section 71(2) sets out when the prohibition does not apply.

• Contract, paragraph (a). The decision has been taken in connection with the conclusion or execution of a contract, and either the data subject’s request in terms of the contract has been met, or appropriate measures have been taken to protect their legitimate interests. As in Switzerland, an automated yes is treated more leniently than an automated no: if the request was granted, the exception is available without further measures.
• Law or code of conduct, paragraph (b). The decision is governed by a law or code of conduct in which appropriate measures are specified for protecting the legitimate interests of data subjects. POPIA provides for sector codes of conduct issued by the Information Regulator, which is the route by which a sector can supply its own safeguards.

Note what is absent. There is no consent exception in section 71. The GDPR’s Article 22(2)(c) permits an otherwise prohibited automated decision where the data subject has given explicit consent; South Africa does not carry an equivalent. A consent-based design imported from a European product will not discharge section 71.

The logic disclosure duty

Section 71(3) says what the “appropriate measures” in subsection (2)(a)(ii) must do, and it is more specific than the equivalent European text. They must give the data subject an opportunity to make representations about the decision, and they must require the responsible party to provide the data subject with sufficient information about the underlying logic of the automated processing to enable them to make those representations.

The framing is the interesting part. The disclosure is not an abstract right to an explanation; it is instrumental, calibrated to what the person needs in order to argue back. That gives a workable test where the European debate about explainability has struggled to find one: enough information that a reasonable person could formulate a challenge. A response of “a machine learning model considered your application” plainly fails it. A response identifying the factors considered, the direction of their influence and the material inputs used for this decision plainly satisfies it, without requiring anyone to explain the model’s internals.

Operationally this means a system relying on the contract exception has to retain, per decision, the inputs used and a description of the factors that drove it, for as long as a representation could be made. Retrofitting that onto a model that has since been retrained is generally impossible, which is the same constraint that shapes what counts as compliance evidence under every regime with a contestation right, including Brazil’s Article 20.

Enforcement and what it means in practice

Enforcement runs through the Information Regulator rather than directly through fines for a breach of section 71. A complaint may be investigated and, where the Regulator is satisfied there has been interference with the protection of personal information, it may serve an enforcement notice requiring the responsible party to take or to stop specified steps. Failure to comply with an enforcement notice is an offence, and POPIA provides for administrative fines up to R10 million as well as criminal penalties for the more serious offences, with imprisonment available at the top of the range.

The structure means the practical exposure is usually the enforcement notice rather than an immediate penalty—but an enforcement notice can require a system to stop operating, which for an automated credit or screening decision engine is the more consequential outcome. Section 5 also lists the right not to be subject to a decision as described in section 71 among the data subject’s rights, and Chapter 11 provides for civil action for damages by a data subject against a responsible party, which does not require proof of intent or negligence.

For anyone building automated decisioning for the South African market, the short version is: assume section 71 applies, assume consent will not save you, decide which exception you are relying on before launch, and build the representation channel and the per-decision record at the same time as the model rather than after the first complaint.