Collected for X? Don't quietly use it for Y.
Consent is only one lawful basis under POPIA. What trips up most AI projects is purpose: using data for something new that customers didn't expect.
Lawful grounds
Section 11
- Consent
- Needed for a contract with the person
- Required by law
- Protects the person's legitimate interest
- Your or a third party's legitimate interest
Purpose checks
Sections 13 & 15
- What was it collected for?
- Is the new AI use compatible with that?
- Would the person reasonably expect it?
- Do you need to tell them, or ask?
Source: popia.co.za ↗
Same data, new purpose? Check.