South Africa: Data Legislation Progresses Amid AI Governance Gaps

At the ITWeb Governance, Risk and Compliance 2026 event in Bryanston, Johannesburg, yesterday, legal experts highlighted South Africa's progress in data protection under POPIA, exemplified by the Information Regulator's recent R1 million fine against FNB, while also identifying significant gaps in AI governance.

This development underscores the Information Regulator's increasing assertiveness in enforcing the Protection of Personal Information Act (POPIA) in South Africa, signaling a maturing regulatory landscape for data privacy and a growing focus on the complex challenges posed by artificial intelligence. The R1 million administrative fine against First National Bank (FNB) serves as a clear warning to all entities processing personal information that non-compliance will result in tangible penalties, moving beyond mere advisory roles to active enforcement. Furthermore, the discussions around AI governance indicate an urgent need for a dedicated regulatory framework to address the ethical, legal, and operational implications of AI adoption, which currently falls outside the primary scope of POPIA.

The core legal framework discussed is South Africa's Protection of Personal Information Act (POPIA), which came fully into effect five years ago. POPIA establishes conditions for the lawful processing of personal information, grants rights to data subjects, and empowers the Information Regulator (InfoReg) to monitor and enforce compliance, including imposing administrative fines. The mention of the General Data Protection Regulation (GDPR) highlights the international standards against which POPIA is being measured, particularly concerning its scope for protecting juristic persons' data versus only private individuals. The current legal vacuum or nascent stage of AI regulation in South Africa is also a critical contextual point, with experts suggesting a new, dedicated AI governance institute rather than expanding the InfoReg's mandate.

The key parties involved are the Information Regulator (InfoReg), responsible for enforcing POPIA; First National Bank (FNB), which received a R1 million administrative fine for POPIA contraventions; legal experts such as Sizwe Snail ka Mtuze (Professor of Cyber Law at Nelson Mandela University and MD of Snail Attorneys) and Dr Cordell Robinson (CEO of Brownstone Consulting Firm), who presented at the ITWeb Governance, Risk and Compliance 2026 event; and implicitly, all South African entities that process personal information.

Attorneys and legal professionals in South Africa must advise clients to urgently review and bolster their POPIA compliance frameworks, particularly in light of the Information Regulator's demonstrated willingness to impose significant administrative fines, as evidenced by the FNB penalty. Businesses should conduct thorough data protection impact assessments and ensure robust data breach response plans are in place. Furthermore, practitioners should closely monitor legislative and regulatory developments concerning artificial intelligence, as the call for a dedicated AI governance framework suggests that new compliance obligations are on the horizon, requiring proactive engagement with emerging AI ethics and data usage guidelines to mitigate future legal risks.