Automated decision making
(1) Subject to subsection (2), a data subject may not be subject to a decision which results in legal consequences for him, her or it, or which affects him, her or it to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person including his or her performance at work, or his, her or its credit worthiness, reliability, location, health, personal preferences or conduct.
(2) The provisions of subsection (1) do not apply if the decision— (a) has been taken in connection with the conclusion or execution of a contract, and— (i) the request of the data subject in terms of the contract has been met; or (ii) appropriate measures have been taken to protect the data subject's legitimate interests; or (b) is governed by a law or code of conduct in which appropriate measures are specified for protecting the legitimate interests of data subjects.
(3) The appropriate measures, referred to in subsection (2)(a)(ii), must— (a) provide an opportunity for a data subject to make representations about a decision referred to in subsection (1); and (b) require a responsible party to provide a data subject with sufficient information about the underlying logic of the automated processing of the information relating to him or her to enable him or her to make representations in terms of paragraph (a).
What this means for your board
- This is a genuine governance question, not just a technical one, if any system your estate or its service providers use makes a decision “based solely on automated processing” with real consequences for a resident (a credit/risk score gating a service, an automated compliance flag), the board needs to know it exists and that subsection (3)'s safeguards, a right to make representations, and an explanation of the logic, are actually in place, not assumed.
- This is exactly the kind of provision that made the recent legal contradiction in PopiGuard's own Terms and Privacy Policy worth resolving (one document referenced an “AI-guidance feature,” the other stated no AI or automated process was used), s.71 is precisely why that inconsistency mattered enough to flag, not just a wording nitpick.
- “Solely automated” is the key qualifier, a system that surfaces a recommendation for a human to review and decide doesn't trigger this section the same way a fully automated decision does.
The free POPIA Compliance Status Assessment helps you confirm you have actually asked this question, which automated systems make consequential decisions about residents, and whether s.71(3)'s safeguards are in place.