POPIA and AI governance for South African businesses
We review how your business collects, shares and secures personal information, including the AI tools your staff already use. You get a clear list of gaps, ranked by risk, and the documents to close them.
Start with a paid 30-minute scope call. We discuss your needs, confirm the scope and send you a quote. If you go ahead, the fee is deducted from your quote. See how booking works.
Enforcement is real
R1 million
The administrative fine the Information Regulator imposed on FNB in October 2026, after customers' account numbers were exposed.
If a customer warned your business about the same thing tomorrow, who would investigate it?
Source: Information Regulator enforcement notice, infringement notice and media statement, October 2026. The account-number offence under s 105 was central to this fine, so not every security incident attracts the same sanction. The maximum administrative fine under POPIA is R10 million (s 109).
Services
Every engagement starts with what your business does with personal information, then builds the paperwork around it. Policies that describe a different business help nobody when the Regulator calls.
A review of your information practices, followed by the documents and processes to fix what it finds.
Rules and contracts for the AI tools your business uses or builds, measured against the law that already applies.
Practical sessions for staff and leadership, built on real South African cases and your own systems.
Also available: service agreements, NDAs, terms of service and website privacy policies for technology businesses.
How a POPIA review works
A 30-minute call about your business, your systems and what worries you. We then send a quote setting out what the review includes and any follow-up work, such as drafting and training. The call is paid, and the fee is deducted from your quote if you go ahead within 60 days. See how booking works.
We list every system, vendor and AI tool that touches personal information, including free tools staff signed up for themselves.
A short written report that ranks each gap by risk and names the section of POPIA it relates to.
We draft or update your policies, vendor agreements and breach plan, and train the people who will use them.
Or email "POPIA review" and a short note about your business to rene@piconsulting.tech
AI governance in South Africa
Where AI inputs, training data or decisions involve personal information, POPIA governs them today, alongside other laws such as consumer protection, employment and intellectual property law. The national draft AI policy was withdrawn in June 2026 and is being revised, and the SABS draft AI standards are voluntary. Waiting for an AI law leaves your business exposed under the law it already has.
Legal position reviewed on 1 November 2026.
Talk about your AI useData you collected to serve customers is not automatically data you may use to train or test AI.
An AI vendor processing your data needs a written operator agreement. If it trains on your inputs for its own purposes, test that against the law.
Find out where your data goes. If it reaches a third party abroad, identify the lawful route for the transfer.
POPIA restricts decisions with legal or substantial effects that are based solely on automated processing of personal information intended to profile a person, subject to the exceptions and safeguards in s 71.
For your organisation and your family
Many of the people we work with protect a company's data at work and their own children at home. Pattern Interrupt Consulting helps the organisation. Keep Me Safe Online, René's separate programme, helps the family.
Book a 30-minute scope call to find out where your business stands and what to fix first. The fee is deducted from your quote if you go ahead.
Book a scope callPractical guides, workshops and resources for parents, teens and schools, and the book Keep Me Safe Online: A Parent's Guide to Protecting Children in the Age of AI. The site also sets out René's view on social media age bans.
Visit keepmesafeonline.orgKeynotes, panels, fireside chats and in-house briefings, tailored to the audience in the room. Available in person in Cape Town, and online anywhere. For events outside Cape Town, the organiser covers flights and accommodation. Send your event details and you'll receive a fee proposal by email.
A short form about your event, date and audience. Or email rene@piconsulting.tech with "Speaking enquiry" in the subject line.
Client reviews
“Phambano Technology Development Centre NPC was fortunate to host Rene Mattheus for both our ‘Women’s Day: GBV, online safety and the law’, and our ‘Information Officers Executive Briefing on AI, POPIA and NPO Governance’ webinars. Rene unpacked complex legislation, from the Cybercrimes Act to POPIA, into plain, practical terms and steps that NGO leaders could understand and act on, evaluate their privacy settings, understanding security breaches and what needs to be reported. For South Africa’s nonprofit sector, where teams are stretched thin but handle highly sensitive information about the communities they serve, AI Safety and Security needs to be foremost on our minds. That is why this kind of accessible, expert-led training is invaluable, and we are proud to have Rene as a trusted resource for our network.”
“I recently had the pleasure of working with René Mattheus on a POPIA ACT related matter, and I couldn’t be more satisfied with the outcome. From the very first meeting, she demonstrated a deep understanding of the law…”
“René is exceptional at what she does, especially given this is in an emerging sector and in often unknown territory. Her knowledge and depth of experience in this field is second to none…”
“Got straight onto what needed to be done. Straightforward and open with costings. Outcomes and risks stated right from the get go. Followed up on time every time.”
“I recently attended the workshop on Cyber Security and AI to better understand what we, both as business professionals and private individuals, need to know to protect our privacy and stay aware of potential risks. It was extremely informative…”
“René is an absolute pro when it comes to handling non-paying clients and contracts. She’s sharp, strategic, and knows exactly how to protect businesses from unnecessary headaches…”
Some quotes are shortened. Read all reviews on Google
About René
René is an admitted attorney in South Africa and the director of Pattern Interrupt Consulting, which she founded in 2024. Her work covers POPIA compliance, AI governance, cybercrime and platform accountability.
She advises South African businesses on what the law expects of them when they collect personal information and adopt AI tools, and she trains the staff who carry that work day to day.
Contact
Start with a 30-minute scope call, or email "POPIA review" and a short note about your business.
Book a scope call