Futureproofing: AI, IoT, and the Next Wave of POPIA Cyber Challenges

POPIA was drafted to govern personal information broadly, but the technologies generating and processing information are evolving faster than most compliance programs can keep up with. AI adoption and the growth of connected devices are introducing new categories of risk that businesses need to plan for now, not after the next breach.

AI Systems and Personal Information

Generative AI tools and machine learning models are increasingly fed personal information — customer chat logs, employee records, CVs, support tickets — often without a clear audit of where that data ends up or how long it's retained by the AI vendor.

Key considerations: - Third-party AI tools are operators too. If an AI platform processes personal information on your behalf, the same operator obligations discussed earlier in this series apply — written agreements, security guarantees, and oversight. - Training data risk. Feeding personal information into a model for training (rather than just inference) can create data retention and purpose-limitation concerns under POPIA's minimality and purpose specification conditions. - Automated decision-making. POPIA includes provisions around automated processing that significantly affect data subjects, meaning affects decisions about customers or employees who may need human oversight and transparency safeguards.

IoT: An Expanding Attack Surface

Internet of Things devices — from smart office equipment to connected point-of-sale systems and wearables — often collect personal information with weaker built-in security than traditional IT systems. Common issues include default credentials, infrequent firmware updates, and devices that were never designed with data protection regulation in mind.

Each connected device is effectively a new endpoint that can be exploited to reach the personal information stored elsewhere on your network, making device inventory and network segmentation increasingly important compliance activities, not just IT hygiene tasks.

Practical Steps for Emerging Technology

1. Vet new technology before adoption, not after — treat AI tools and IoT devices as you would any new operator or vendor, with a data protection review before rollout.
2. Segment IoT devices into separate network zones so a compromised device can't be used as a steppingstone to core systems holding personal information.
3. Maintain an inventory of AI tools in use across departments, including "shadow AI" adopted informally by teams without IT's knowledge.
4. Build flexibility into policies so they can be updated as new technology categories emerge, rather than rewriting your entire framework each time.

Staying Ahead, Not Behind

Regulatory guidance on AI and connected devices will continue to develop, but the underlying POPIA principles — accountability, minimality, security safeguards — remain the constant thread. organizations that apply these principles proactively to new technology, rather than waiting for explicit regulatory clarification, will be far better positioned when scrutiny inevitably catches up with innovation.

This concludes our ten-part series on the overlap between POPIA compliance and cybersecurity. The throughline across every article: compliance and security are not separate disciplines competing for budget — they are two expressions of the same underlying responsibility to protect the people whose data you hold.