Legal & Risk: What Businesses Need to Watch

Legal & Risk: What Businesses Need to Watch

2026-05-20

As South African and UK businesses grapple with rapid technological and regulatory changes, the legal risks tied to AI governance and data security have emerged as silent but critical threats. Two recent stories underscore the urgency for businesses to revisit their compliance frameworks.

1. Lack of AI Policy in South Africa Exposes Schools to POPIA Risks

South Africa’s education sector faces growing risks from the absence of a national AI policy, as highlighted in “South Africa is sleepwalking into another AI policy failure” (TechCentral). With schools increasingly adopting AI tools for teaching and administrative tasks, the lack of clear regulations on data use, accountability, and bias creates legal exposure under the Protection of Personal Information Act (POPIA) 4 of 2013. For instance, AI systems processing student data (e.g., performance analytics, behavioral tracking) could violate POPIA’s principles of purpose limitation and transparency if not explicitly governed by institutional policies.

Compliance Action: Schools and edtech providers must audit AI deployments to ensure personal data is collected, stored, and processed lawfully under POPIA. This includes appointing data protection officers, conducting impact assessments, and securing explicit consent for data usage.

2. Data Breaches Targeting Political Entities Raise POPIA and Cybersecurity Compliance Concerns

The breach of the ANC’s private member data—highlighted in “ANC members under threat following data breach” (MyBroadband)—reveals vulnerabilities in how businesses handle sensitive personal information. The leaked data, including IDs and addresses, puts members at risk of identity theft, a violation of POPIA’s security obligations. For businesses handling similar data (e.g., HR systems, client databases), the incident underscores the need for robust cybersecurity frameworks and incident response plans under POPIA’s data breach notification requirements.

Compliance Action: Businesses must review third-party vendor contracts to ensure data security clauses align with POPIA. Regular penetration testing, employee training on phishing threats, and encryption of sensitive data are critical preventive measures.

3. Land Acquisition in South Africa: Environmental and Corporate Governance Risks

The “R18 billion privately-owned city being built on land bought from top university” (BusinessTech) raises questions about compliance with environmental and land-use laws. While the article does not specify regulatory breaches, the development’s proximity to protected areas or its impact on local communities could trigger scrutiny under the National Environmental Management Act (NEMA) 107 of 1998 or the Constitution’s Bill of Rights. Businesses involved in large-scale land acquisitions should ensure compliance with environmental impact assessments and community consultation processes.

Compliance Action: Conduct due diligence on land acquisition terms to confirm alignment with NEMA and the Companies Act 71 of 2008. This includes transparency in land use and mitigation of environmental harm.

---

**