Most South African Businesses Using AI in Hiring Are Already Covered by This Law. Here’s What POPIA Actually Requires.

Most South African employers think AI regulation for hiring is still coming. Some future bill, some future headache, something for the lawyers to worry about in a year or two.

It’s not coming. It’s already here, and it’s been here since 2021.

The Protection of Personal Information Act doesn’t mention artificial intelligence anywhere in its text. It didn’t need to. POPIA governs personal information, and an AI hiring tool that reads a CV, scores an interview, or ranks a shortlist is, at every step, processing personal information. If your business screens candidates with any kind of automated scoring, resume parsing or behavioural assessment, POPIA already applies to what you’re doing right now. Not eventually. Now.

That catches a lot of businesses off guard, mostly because AI adoption in recruitment moved faster than anyone updated their compliance paperwork.

The part that actually bites: automated decisions

Section 71 of POPIA gives candidates a right not to be subject to a decision based solely on automated processing when that decision has a legal effect on them or affects them substantially. Hiring or rejecting someone is about as substantial as it gets.

The word doing the work there is “solely.” If an algorithm scores a CV and a human at your business looks at that score before deciding anything, you’re on solid ground. If the algorithm is quietly filtering people out before a human ever sees the pile, that’s a different conversation, and it’s the conversation the Information Regulator will want to have with you if a rejected candidate ever pushes back.

A lot of recruitment software was built overseas, sold into South Africa, and switched on without anyone asking where the human checkpoint actually sits in the workflow. Worth checking. Properly checking, not just assuming it’s fine because nobody’s complained yet.

Special personal information changes the rules

POPIA treats certain categories of information differently, and more strictly, than an ordinary CV. Health data, biometric information, race, religious belief, trade union membership, sexual orientation. If your hiring process records video interviews, analyses voice, or captures anything biometric, you’ve stepped into this category, and the consent requirements go up a notch. A blanket “by applying you agree to our terms” line doesn’t cut it here. Candidates need to know specifically what’s being captured and why, before it happens, not buried in clause 14 of a document nobody reads.

The bias problem has a local flavour

Every AI hiring conversation eventually gets to bias, and rightly so. What’s less talked about is the specific way this plays out in South Africa. A model trained mostly on European or North American CVs and interview patterns can penalise things that have nothing to do with someone’s ability to do the job: regional accents, a CV format that doesn’t match what the model expects, English as a second or third language. That’s not a hypothetical. It’s a real way for a tool to end up indirectly discriminating on grounds the Employment Equity Act already protects, race, ethnicity, culture, even while the tool itself never looks at any of those fields directly.

If your AI vendor can’t tell you whether their scoring has been tested against South African candidates specifically, that’s a gap, not a technicality.

Your data doesn’t have to stay in South Africa, but it can’t just wander off either

Plenty of recruitment platforms process data offshore, in Australia, the US, wherever the servers happen to sit. POPIA doesn’t ban that. Section 72 sets out the conditions under which it’s allowed: the destination needs an adequate level of protection, or there’s a binding agreement covering it, or the candidate consented, or the transfer is necessary to fulfil the contract they’re applying for. What POPIA doesn’t allow is data drifting overseas with nobody able to point to which of those grounds applies. If you can’t answer “where does this data actually go, and under what legal basis,” that’s the question to sort out before the Regulator asks it for you.

Somebody has to actually own this

POPIA requires an appointed, registered Information Officer. Not a job title tacked onto someone’s existing role as an afterthought, an actual registration with the Information Regulator. A surprising number of businesses using AI in their hiring process couldn’t tell you who theirs is, or whether that registration ever happened. It’s the single cheapest fix on this whole list and the one most likely to get skipped.

What to actually do about it

Start with an honest inventory. What AI tools touch a candidate’s data anywhere in your hiring process, from the first CV upload to the final reference check? Most businesses find at least one tool they’d forgotten was even doing anything automated.

From there:

• Confirm a human reviews every AI-influenced outcome before a candidate is told no.
• Check whether your privacy notice actually discloses what’s collected, including anything biometric.
• Ask your vendor, directly, whether their scoring has been tested on South African data.
• Find out where candidate data physically sits, and which POPIA ground justifies it being there.
• Confirm your Information Officer is actually registered, not just assumed.

None of this requires ripping out your recruitment stack and starting again. It requires someone sitting down for an afternoon and checking the answers against what’s actually happening, rather than what the vendor’s marketing page implies is happening.

GrowMyTeam.ai builds this thinking into the platform itself. Every AI assessment is logged and clearly separated from human decisions, every automated score sits in front of a person before it becomes an outcome, and the audit trail is there if a candidate, or the Regulator, ever asks how a decision was made.

Check where your process actually stands

We’ve built a free self-assessment that maps your AI hiring process against POPIA’s eight risk areas — automated decision-making, special personal information, consent, bias, cross-border data, your Information Officer obligations, vendor contracts, and candidate rights. It takes five minutes and gives you a section-by-section gap report with specific guidance on what to prioritise. Take the POPIA AI Hiring Compliance Check →