Data Governance in the AI Era: Analysing the Effectiveness of Information Regulator in Implementing POPIA

Abstract

With the Fourth Industrial Revolution (4IR) accelerating digital transformation, emerging technologies such as Artificial Intelligence (AI) pose complex challenges to data protection and regulation enforcement. This study assesses the effectiveness of South African Information Regulator (IR) in enforcing the Protection of Personal Information Act (POPIA) in the dynamic changing data economy driven by 4IR technologies. Utilising a qualitative research approach through interviewing industry participants and the review of regulatory frameworks, supported by the review of existing literature, the study concludes that while South Africa’s Protection of Personal Information Act (POPIA) represents a crucial step towards strengthening data protection, its enforcement faces significant challenges, including regulatory inefficiencies, inadequate penalties to deter non-compliance, and the rapid evolution of emerging technologies outpacing existing legal frameworks. The Information Regulator’s limited capacity, coupled with insufficient public awareness about data privacy risks and challenges relating to IR accessibility at predominately rural area, further undermines effective oversight and compliance. Key recommendations include enhancing regulatory enforcement through stricter penalties and clearer breach reporting obligations, strengthening the regulator’s capacity with additional funding and resources, and working in collaboration with other sister regulators in developing AI-specific guidelines to address emerging risks. Moreover, increasing public education on data privacy and embedding data protection practices across sectors are essential for fostering a culture of compliance and safeguarding personal information in the digital era.