When AI recommends and a person approves: understanding section 71 in everyday business decisions.

More South African businesses now use AI for tasks that sit close to decisions about people: shortlisting CVs, flagging risky customers, ranking leads, scoring staff. Section 71 of POPIA is the provision most directly aimed at this.

What section 71 says

A person may not be subject to a decision that has legal consequences for them, or affects them to a substantial degree, if the decision is based solely on automated processing of personal information intended to profile them. The Act names the kinds of profile it has in mind: performance at work, creditworthiness, reliability, location, health, personal preferences and conduct. The list is not closed.

The exceptions, and what they ask of you

There are two. The first covers a decision taken in connection with concluding or carrying out a contract, where appropriate measures protect the person’s legitimate interests. The second covers a decision governed by a law or code of conduct that sets protective measures.

For the contract exception, the measures must include giving the person a chance to make representations, and enough information about the logic of the automated processing for them to do so. That is where “black box” tools become a problem. If nobody in your business can explain how the tool reached its result, you cannot give the person what the Act expects.

Where it can show up in a small business

• Hiring: AI that screens CVs and rejects applicants before a person has looked.
• Customer vetting: a score of reliability or payment risk that decides whether you take someone on, or on what terms.
• Staff: performance scores that feed into discipline, pay or retrenchment.
• Sales and service: lead scoring. One that only decides which enquiry gets a call first is unlikely to affect anyone to a substantial degree. One that decides who gets a service is a different matter.

The word that matters: “solely”

Section 71 applies to decisions based solely on automated processing. A person who genuinely reviews the output, forms their own judgement and can override it takes you outside the core of the section. The risk is the rubber stamp: someone who clicks approve on every recommendation, cannot explain it, or is not allowed to disagree.

We are not aware of published guidance from the Information Regulator, or of court decisions, on how “solely” will be read in practice. Check the Regulator’s website for anything issued since this was written. Treat it as a risk judgement, not a safe harbour. Law firms advising employers describe the same approach: AI output is an input to a human decision, and the person deciding must be able to explain the reasons and be empowered to override.

A five-question test before AI touches a decision about a person

1. Does the decision affect someone’s job, credit, access to a service or something similar? If not, section 71 is unlikely to be the issue, though the rest of POPIA still applies.
2. Who looks at the AI’s output before the decision is final? Name the role, not “the team”.
3. Can that person explain, in plain words, why the tool produced this result?
4. Can they override it, and have they ever done so? If they never do, ask why.
5. Does the affected person know AI is involved, and can they ask for a person to look again?

Beyond section 71

Where section 71 is not triggered, the rest of POPIA still applies. Tell people their information is processed by an AI tool and why (section 18). Collect no more than you need (section 10). Use it only for the purpose you collected it for (sections 13 and 15). Secure it (section 19). Do not keep it longer than necessary (section 14). Where an AI vendor processes information for you, you stay accountable as the responsible party, and you need a written contract with that operator (section 21).

Our view

For most small businesses the answer is not to avoid AI in decisions about people. It is to use it to prepare the decision and not to make it: summarise the CVs, flag the anomalies, show a draft score with its reasons, then put a trained person at the end with the authority and the information to disagree. Write down how that works. It is also better business. A score nobody can explain is hard to defend to a candidate, a customer or a regulator.