SA’s data legislation advancing but gaps remain as AI is entrenched in workplaces SA’s data legislation advancing but gaps remain as AI is entrenched in workplaces By Chris Tredger, Technology Portals editor, ITWeb Dr Cordell Robinson, CEO of Brownstone Consulting Firm. South Africa has made progress in digital security and data protection legislation, but challenges remain, particularly around the governance and regulation of AI. This was a key takeaway from the ITWeb Governance, Risk and Compliance 2026 event, held yesterday in Bryanston, Johannesburg. Sizwe Snail ka Mtuze, professor of cyber law at Nelson Mandela University and MD of Snail Attorneys, provided an overview of the Protection of Personal Information Act (POPIA). Mtuze said that, five years after coming fully into effect, POPIA was beginning to deliver results. He described it as strong and “a great piece of legislation”, adding that the Information Regulator (InfoReg) was taking a more proactive approach to enforcement. Citing the recent R1 million administrative fine imposed on First National Bank (FNB), after the regulator found that the bank had contravened multiple provisions of POPIA following an incident in which clients’ data was compromised, Mtuze said the regulator “had pressed to show its teeth”. “The courts have been busy...POPIA compliance has come a long way, especially within the private sector,” he noted. ITWeb GRC 2026: Scaling trust amid rising AI adoption tops agenda However, challenges remain. These include concerns about whether POPIA has kept pace with international legislation such as the General Data Protection Regulation (GDPR), as well as its provisions for the protection of data belonging to juristic persons, including companies, trust funds and organisations, rather than only private individuals. AI governance also featured prominently in discussions about regulatory challenges. Mtuze said the InfoReg should not also become an AI regulator. He suggested that establishing an AI governance institute could complement the regulator's existing role. In his opening keynote address, Dr Cordell Robinson, CEO of Brownstone Consulting Firm, said AI without governance posed the next cyber security crisis. He stressed that human accountability was critical to any governance strategy. Dr Robinson said trust was the most sought-after commodity in the AI-driven digital and data economy, including trust in organisations, institutions, systems and decisions. He said organisations needed to move from AI to trusted intelligence, adding that cyber security was increasingly about protecting decisions. Governance in the context of AI, he said, involved understanding risk, identifying who was accountable and being prepared to stand behind decisions. “Trust is when we introduce technology, we understand that we are accountable for the consequences.” Robinson said the goal was not to slow AI adoption. Organisations that used the technology responsibly could benefit in areas such as customer service, fraud detection, healthcare, finance, education and government. “But who is governing the algorithm? Who owns it? Approved it? Validated it? Monitors it? Who is accountable when it is wrong, or manipulated? … and perhaps the most important question of all – who can shut it down? AI without authority is just software. With authority, it becomes an organisational actor,” he added. Robinson said AI brought together multiple areas of risk and therefore required board-level oversight. Responsibility for its governance could not be delegated entirely to the CISO or CIO, legal or compliance teams. He advised organisations to ask five questions: Robinson said Africa had an opportunity to take a leading role in trusted AI. “There’s an opportunity to lead, not just consume,” he added. “AI plus capability plus authority minus governance equals unmanaged risk… AI plus governance plus security plus human accountability equals trusted innovation.” Experience seamless workflow automation with SigniFlow. Simplify, sign, and secure documents effortlessly. Transform your business. A successful combination of specialized skills and industry leading vendor partnerships. Make Galix your preferred partner for security. Email [email protected] for more info. We modernise Data Platforms, optimise Database Performance, and ensure seamless Azure integration for the world’s most data-driven businesses.