South Africa: Protection of Personal Information Act (Act No. 4 of 2013)

South AfricaLegislationApplicable

The Protection of Personal Information Act, 2013 (Act No. 4 of 2013) establishes South Africa's comprehensive statutory framework for the protection and lawful processing of personal information by public and private bodies. Warden Watch focuses specifically on the provisions governing automated decision-making and profiling within employment and recruitment, centered on Section 71, read alongside Section 5(g), Section 26, and Section 57. Section 71 establishes a general restriction providing that an individual may not be subjected to a decision that results in legal consequences or affects them to a substantial degree when based solely on automated processing intended to create a profile, including evaluations of performance at work, reliability, conduct, or health. Solely automated profiling decisions are permitted only under narrow contract-related exceptions or where governed by law or an approved code of conduct, provided the employer affords the individual an opportunity to make representations and supplies sufficient information regarding the underlying decision logic. The Act does not require independent algorithmic bias audits or impose direct statutory duties on software providers.

Impact

What this means for HR and vendors

HR and recruitment teams

HR and talent acquisition teams in South Africa must audit recruitment, applicant screening, and workforce assessment workflows to identify any tools that make consequential employment decisions without human involvement. Organizations cannot reject candidates, terminate contracts, or adjust working conditions based solely on automated profiling unless a statutory exception applies. When utilizing permitted solely automated profiling systems, employers must provide individuals with sufficient information about the system's underlying logic and maintain operational channels allowing candidates or employees to submit representations. This increases the importance of training recruiters to ensure human oversight is substantive and documenting decision rationale.

HR technology vendors

HR technology vendors supplying automated screening, psychometric evaluation, or workforce management tools to South African employers face strong commercial expectations to facilitate customer compliance. While POPIA places direct statutory compliance duties on employers as responsible parties, software providers must supply transparent documentation explaining the underlying logic, variables, and profiling criteria of their tools. Providers should design applications that incorporate human-in-the-loop oversight by default to prevent purely automated adverse determinations. Additionally, systems should provide interfaces that allow employer clients to log human reviews and support candidate representations.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerAutomated Decision Safeguards

Provider System Logic Documentation and Oversight Support

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

Restriction on Solely Automated Profiling Decisions

Pre-Collection Openness and Processing Notification

Prior Authorization for Identifier Linking and High-Risk Processing

Provider System Logic Documentation and Oversight Support

Keep up with changes to employment AI rules and cases.

Manage Consent Preferences