POPIA section 71: automated decision-making, explained

What section 71 says

The Protection of Personal Information Act (POPIA) contains one section written directly about machines making decisions about people. Section 71 says a data subject may not be subject to a decision which results in legal consequences for them, or which affects them to a substantial degree, where that decision is based solely on the automated processing of personal information intended to provide a profile of that person.

The section names the kinds of profile it has in mind: performance at work, creditworthiness, reliability, location, health, personal preferences and conduct. Commentators read the list as examples rather than a closed set, so a model that profiles people in some other way is not outside the section simply because its subject is not named.

The three tests that bring a decision inside it

1. 1It is a decision with real effectLegal consequences (a contract refused, a benefit stopped) or a substantial effect (a job application rejected, a claim delayed, a price that shuts someone out).
2. 2It is based solely on automated processingNo person meaningfully considered it before it took effect. A human who signs off every output without looking does not change this; a human who can and does disagree does.
3. 3The processing profiles the personIt evaluates aspects of them: how risky, reliable, healthy or productive they are, or what they will probably do.

When an automated decision is still allowed

Section 71 does not ban automated decisions. It allows them in two situations:

• The decision is taken in connection with concluding or performing a contract, and either the person's request was granted or appropriate measures protect their legitimate interests.
• A law or a code of conduct governs the decision and itself sets out appropriate measures to protect the people affected.

For the contract route, the measures must at least give the person an opportunity to make representations about the decision, and give them enough information about the underlying logic of the automated processing to make those representations meaningful.

What that means in practice

Read together, the safeguards describe something an organisation can build and show: someone the affected person can reach, a way to contest the outcome, an explanation that reflects what actually drove the decision, and a person with the authority to change it. Most organisations that run credit, insurance, hiring or fraud models already have some of this. What they rarely have is evidence that it works: that people find the route to contest, that someone answers, and that decisions are overturned when they should be.

• Know which of your systems make or shape decisions about people. You cannot apply section 71 to a model nobody has listed.
• Name a person accountable for each one, and give them a real override.
• Tell people, before the decision, that automated processing is involved, in words specific to that decision.
• Give a reason that matches the actual drivers of the decision, not a generic one.
• Make the route to contest easy to find, and measure how quickly it is answered and how often it changes the outcome.

The Information Regulator enforces POPIA. It has issued administrative fines, including R5 million each against two national departments, and in 2026 signalled an end to leniency. The maximum administrative fine under POPIA is R10 million.

Where AIC fits

The AIC standard turns these safeguards into 44 requirements an assessor can test, from a named accountable person for each system (HU-1) to a correction route an ordinary person can find (CO-2) and reasons that match the real drivers of a decision (EX-5). It is published in full, and AIC Aware is a free ten-minute self-assessment against it.