SA’s data legislation advancing but gaps remain as AI is entrenched in workplaces

South Africa's digital security and data protection legislation, particularly the Protection of Personal Information Act (POPIA), has seen advancements since its full implementation five years ago. According to Sizwe Snail ka Mtuze, a professor of cyber law at Nelson Mandela University and MD of Snail Attorneys, POPIA is strong and considered a great piece of legislation.

The Information Regulator (InfoReg) is also taking a more proactive approach to enforcement. A recent example of this is the R1 million administrative fine imposed on First National Bank (FNB) after clients' data was compromised.

However, challenges remain in the realm of AI governance. Mtuze cautioned that POPIA should not become the primary regulator for AI. He proposed establishing an AI governance institute to complement the regulator's role. Dr Cordell Robinson, CEO of Brownstone Consulting Firm, emphasized that AI without governance poses a significant cybersecurity crisis.

He stressed that human accountability is crucial in any governance strategy, highlighting trust as the most sought-after commodity in the AI-driven digital and data economy. Organizations must transition from AI to trusted intelligence, ensuring they understand the risks, identify accountability, and are prepared to stand behind their decisions.

The ultimate goal is not to hinder AI adoption, but rather to ensure it benefits sectors such as customer service, fraud detection, healthcare, finance, education, and government. Central to this discussion is the question of who governs the algorithm, who owns it, who approves and validates it, and who monitors it. The most critical question remains: who is accountable when the AI is wrong, manipulated, or not functioning as intended?