South Africa's InfoReg Discusses AI Regulatory Challenges and POPIA Compliance

December 2026 marks 10 years since the establishment of SA’s independent institution responsible for the protection of the POPIA legislation. (Image source: iStock) Nearly 10 years since it was established , data privacy watchdog the Information Regulator (InfoReg) must now traverse an environment where personal information is collected, shared and processed at an unprecedented scale. InfoReg chairperson advocate Pansy Tlakula told ITWeb on the sidelines of a recent event that today’s technological progress has resulted in complexities that raise questions about compliance and privacy by default. OpenAI catapulted its ChatGPT platform into the public’s hands in November 2022, bringing worldwide attention to artificial intelligence (AI) and subsequently generative AI. Since then, AI has infiltrated almost every industry, with AI-capable devices and tools now the order of the day. Policy and lawmakers across the global community have increasingly focused on its regulation. The InfoReg, which is the enforcer of the Protection of Personal Information Act (POPIA) and Promotion of Access to Information Act (PAIA), says it now operates in a world that’s “vastly different” from the one that existed when legislations were enacted. According to the watchdog, AI, automated decision-making systems, biometric technologies and digital platforms are increasingly embedded in both public and private sector operations. Developments, it says, present immense opportunities for economic growth, innovation and improved service delivery. However, they also introduce risks to privacy, transparency, accountability and human rights. This, said Tlakula, makes the role of the Information Regulator even more important. Delving into some of these complexities, she said these include managing consent, retention, maintaining transparency and addressing the lack of a national AI policy in South Africa. She cited an example where a form for the Consumer Protection Act opt-out registry requests non-compliant information, such as marital status and gender. This is some of what the regulator witnesses when laws, policies and systems are introduced, according to Tlakula. “From where we sit, we are not convinced by the principle of privacy by default and conducting personal information impact assessments…if they happen.” Advocate Tshepo Boikanyo, InfoReg executive for POPIA, highlighted that AI models often retain personal information beyond its intended purpose, which contradicts the principles of POPIA. “That’s the challenge,” he noted. “In terms of our Act, you cannot store the personal information beyond its intended purpose. With AI models, we don’t know what then happens with this personal information.” Advocate Pansy Tlakula, chairperson of the Information Regulator. (Photograph by Strike A Pose Studio) The InfoReg was established on 1 December 2016, with the aim to, among other matters, monitor and enforce compliance by public and private bodies with the provisions of PAIA and POPIA. The purpose of the laws is to ensure all South African institutions conduct themselves in a responsible manner when collecting, processing, storing and sharing another entity's personal information by holding them accountable should they abuse or compromise personal information in any way. The country’s data privacy legislation POPIA came into force on 1 July 2021, following a year-long grace period for organisations to comply with the Act. Breaching the rules and regulations outlined by the Act can have serious, long-lasting financial and reputational implications for the affected business. It makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach. The regulator can give a public body a grace period to remedy a POPIA violation before taking further enforcement action. Tlakula commented that the past decade has been marked by both significant challenges and important achievements in safeguarding constitut