South Africa: privacy laws and AI data licensing

Is your business the responsible party or an operator under POPIA?#

The business that decides why and how personal information is processed is the responsible party; a business that processes it for that party under a contract or mandate, without coming under its direct authority, is an operator. POPIA defines both terms in section 1, and more than one responsible party can act together.

The label decides who carries the duties. Under section 8 the responsible party must ensure that all eight conditions for lawful processing are met. Under section 20 an operator may process only with the responsible party's knowledge or authorisation and must keep the information confidential. Section 21 requires a written contract that makes the operator establish and maintain the security safeguards in section 19, and the operator must notify the responsible party immediately when there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person.

A vendor that prepares or de-identifies records strictly on a company's instructions usually looks like an operator. A recipient that decides its own purposes for the data, such as training its own models, usually looks like a responsible party in its own right, which is why the sharing itself needs a lawful basis and not only an operator contract. Counsel should confirm the roles on the actual facts.

Which POPIA conditions decide whether records can be reused for AI work?#

Reuse is lawful only if all eight conditions are met: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. For records collected for one purpose and reused for another, the further processing limitation in section 15 is usually the deciding test.

Section 15(2) weighs five factors: the relationship between the new and original purposes, the nature of the information, the consequences for the data subject, the manner in which it was collected, and any contractual rights and obligations between the parties. Section 15(3) treats further processing as not incompatible in listed cases, including consent and historical, statistical or research purposes where the processing is solely for those purposes and the information will not be published in an identifiable form.

Two limits change the analysis. Under section 6(1)(b) the Act does not apply to information de-identified to the extent that it cannot be re-identified again, and de-identifying means deleting what identifies a person or could be linked to them by a reasonably foreseeable method. Special personal information under section 26, which includes health, biometric information, race or ethnic origin, religious beliefs and criminal behaviour, has its own prohibition and exceptions, such as the research exception in section 27.

When can personal information leave South Africa under section 72?#

Section 72 bars a responsible party from transferring personal information to a third party in a foreign country unless one of five grounds applies: the recipient is bound by a law, binding corporate rules or a binding agreement giving an adequate level of protection; the data subject consents; the transfer is necessary for a contract with the data subject; it is necessary for a contract concluded in the data subject's interest; or it benefits the data subject, consent is not reasonably practicable and the data subject would be likely to give it.

Adequate protection means rules that effectively uphold principles for reasonable processing substantially similar to POPIA's conditions, including substantially similar rules on onward transfers to further countries. Binding corporate rules are processing policies followed within a group of undertakings.

A stricter step applies to sensitive data. Under section 57, a responsible party needs the Information Regulator's prior authorisation before transferring special personal information or children's personal information to a third party in a foreign country without an adequate level of protection. The Regulator says it informs the applicant in writing within four weeks.

What should be checked before South African records are shared?#

Run these checks in order; a record that fails one is fixed, de-identified or excluded before anything leaves the business. The Information Regulator has said that failure to comply with certain POPIA provisions can lead to an administrative fine of up to R10 million or imprisonment of up to 10 years, or both.

SourceX can consider companies in South Africa when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.

• 1Name the responsible party for the reuse and every operator that touches the records
• 2Record the section 15 compatibility assessment or the section 15(3) exception relied on
• 3Remove special personal information and children's information unless a specific exception applies
• 4Test de-identification against reasonably foreseeable re-identification, not just removal of names
• 5Put a section 21 operator contract in place for any vendor that prepares the data
• 6Identify the section 72 ground for any recipient outside South Africa, and check whether section 57 prior authorisation is needed