By Sagar Shankaran, Founder of CallSphere
POPIA's eight conditions still bind every AI voice and chat operator. The April 2026 Draft National AI Policy commits to POPIA-first governance and Section 71 automated-decision transparency. Here is what to do.
Key takeaways
South Africa's Protection of Personal Information Act has been fully in force since 2021. The April 2026 Draft National AI Policy folds AI governance under POPIA's eight conditions and Section 71's automated-decision-making transparency clause.
The Protection of Personal Information Act, 2013 (Act No. 4 of 2013) — POPIA — sets eight conditions for lawful processing: accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards, and data subject participation. Special personal information (religion, race, health, sex life, biometric, criminal behaviour, children) requires specific authorisation. The Information Regulator enforces; civil fines reach R10M and criminal penalties reach 10 years' imprisonment for serious offences.
Section 71 grants every data subject the right not to be subject, under certain circumstances, to a decision based solely on automated processing of personal information that produces legal consequences or substantially affects the data subject — with required safeguards including notification, opportunity to make representations, and meaningful information about the underlying logic. Transborder transfers (Section 72) require recipient adequate protection or one of five enumerated bases.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
The Draft National AI Policy, published in April 2026 by the Department of Communications and Digital Technologies, harmonises AI governance with POPIA, calls for Privacy Impact Assessments where sensitive information is processed, and points to Section 71 as the transparency safeguard. (The first draft contained AI-hallucinated citations and was reissued.)
A South-African-facing voice or chat agent runs a PIA before launch when special personal information or solely-automated decisions are involved, issues an Information Regulator-aligned notice at collection, captures specific authorisation for special personal information, supports access and correction, applies Section 71 safeguards on solely-automated decisions, and documents transborder transfers under Section 72. Voice biometrics for unique identification are special personal information.
CallSphere — 37 agents, 90+ tools, 115+ DB tables, 6 verticals, 50+ businesses, 4.8/5, HIPAA and SOC 2 aligned — provides POPIA-aligned templates: a PIA template tied to the eight conditions, a Section 71 notice and human-review pathway, a special-personal-information consent flow, and a Section 72 transborder transfer log. The Information Regulator's recent guidance on direct-marketing call consent is built into the outbound workflow. Pricing $149 / $499 / $1,499; 14-day trial; 22% affiliate; see /pricing and /contact.
flowchart LR
A[ZA Caller] --> B[Voice Agent]
B --> C[Eight Conditions]
B --> D[Section 71]
D --> E[Notification]
E --> F[Representations]
F --> G[Human Review]
B --> H[Section 72\nTransfer]
Does POPIA apply extraterritorially? Yes when an automated means in South Africa is used or when the data subject is in South Africa.
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
Are voice recordings special personal information? Recordings can contain special information (health, religion). Voice biometrics for unique identification are special personal information.
What is "specific authorisation"? A clear, voluntary, informed expression of will related to a particular purpose of processing.
Is consent the only basis for direct marketing? For unsolicited electronic communication to non-customers, yes. Existing customer relationships have a narrower basis.
Are children's data special? Yes — children under 18 are protected under Section 35; competent person consent is required for under-18 processing.
Written by
Sagar Shankaran· Founder, CallSphere
Sagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
Anthropic chose not to release Mythos publicly. Inside the dual-use cybersecurity calculus, what restricted release means for enterprises, and the ripple effects.
CAISI announced new agreements with Google DeepMind, Microsoft, and xAI in May 2026. What gets tested, what changes for enterprise AI buyers, what to watch.
Commerce Secretary Howard Lutnick's America's AI Action Plan sets the federal posture for 2026. CAISI, Pentagon contracts, enterprise compliance — what to watch.
How ICASA's Numbering Plan Regulations 2016, the online Numbering Portal, the i-ECNS licensing requirement, and POPIA on voice biometrics shape AI voice agents in South Africa.
An examination of the sovereign AI movement — why nations are investing billions in domestic AI infrastructure, models, and talent, and what this means for the global AI landscape, enterprise strategy, and geopolitics.
Navigate the evolving regulatory landscape for AI agents across the EU AI Act, US state laws, and emerging industry standards. Learn how agents are classified, what compliance obligations apply, and how to build regulation-ready agent systems.
© 2026 CallSphere LLC. All rights reserved.