Authored By: Boitumelo Masia
Emeris
Introduction
Can people rely on cybersecurity to protect them from AI? Could advances in AI result in humans losing their privacy and is the idea of AI taking over the world realistic concern? To what extent can individuals trust cybersecurity systems to protect their personal information in the digital age? These are the type of questions that could get an individual to overthink.
The lack of comprehensive information and public awareness regarding artificial intelligence (AI) and cybersecurity has contributed to widespread uncertainty and misunderstanding. As a result, individuals may become more vulnerable to threats that could compromise their privacy, security and personal freedoms if these technologies are not properly understood and regulated. Although artificial intelligence security may still be evolving in South Africa, individuals are protected by a range of laws, regulations and policies that are designed to safeguard their rights, privacy and personal information. A policy such as the South African’s Draft National AI Policy which establishes a structured framework for responsible AI deployment. Built around six core pillars including capacity building, inclusive growth, responsible governance and ethical deployment. It aims to bridge the digital divide and protect constitutional rights.
The integration of AI systems within the legal environment could provide significant benefits due to the extensive amount of data collection, case management and confidential information handled within the legal sector. AI security systems have the potential to assist in protecting sensitive information and improve data management. However, organisations must ensure compliance with privacy regulations as any unauthorised disclosure or misuse of personal data may violate privacy laws that are included in the Protection of Personal Information Act (POPIA). This article will argue the potential benefits of AI Security and its role in enhancing data protection and risk management.
Section 1 will cover the legal framework which will proceed in analytic of case law found in section 2 and ending with section 3 of the critical evaluation.
Legal Framework
Personal Information
The Protection of Personal Information Act (POPIA) is legislation designed to protect individuals’ personal information from misuse and unlawful processing. The Act requires organisations to collect, store, process and share personal data in a lawful, transparent and secure manner. In the context of artificial intelligence (AI) and cybersecurity POPIA plays a significant role in ensuring that AI systems process personal information responsibly and maintain appropriate security measures to prevent data breaches and unauthorised access. As a result, the Act promotes privacy, accountability and public trust in the use of AI technologies.
The court’s decision in Case Munetsi v Madhuyu and Another (2024) found the respondent breached section 11 of POPIA by posting the applicant’s mobile number, ordered them to remove the posts and stop sharing the data without consent. This illustrates the government’s dedication to protecting individuals’ personal information and upholding data protection principles within the evolving digital landscape.
Data Protection
Furthermore, the Protection of Personal Information Act (POPIA) complements the Cybercrimes Act by establishing a comprehensive legal framework aimed at enhancing data privacy protection and prevent cybercrime. One of the key offences found in the Cybercrime Act Section 2 is Unlawful Access and the country has had a significant prosecution under the Act, the court case State v Lucky Majangandile Erasmus (2025). The court had established that unlawfully accessing computer systems or installing remote access tools can result in lengthy prison sentences. This case illustrates the importance of legal protection of personal data and the government’s efforts to mitigate potential harm through regulatory measures. It had illustrated that (i) individuals who contravene the law are subject to legal accountability and (ii) that the unlawful theft of data is recognised as a criminal offence.
This illustrates the effectiveness of data protection measures while emphasising that AI technologies can be employed to support lawful and beneficial objectives rather than facilitating the misuse of personal information.
Risk Management
The rise in cyberattacks and the misuse of AI technologies, such as voice cloning and the generation of fraudulent identities has prompted the government to introduce stricter regulatory measures to safeguard individuals and address emerging challenges in the evolving digital environment. The government has established a range of legislative, policy and regulatory frameworks aimed at mitigating the risks associated with AI security and the protection of personal information.
AI security risk management is governed less by specific “AI case law” and more by the application of traditional tort law (negligence), data protection statutes (e.g., POPIA), and precedent-setting regulatory enforcement that penalizes companies for failing to secure AI systems and training data. Although South Africa is still developing its legal framework relating to artificial intelligence and tort liability, it continues to draw guidance from international regulatory frameworks including the European Union Artificial Intelligence Act in the development and implementation of its own AI governance measures. AI systems can exhibit unpredictable, emergent behaviours or be susceptible to entirely novel adversarial exploits. Plaintiffs must prove the specific attack or malfunction was reasonably foreseeable to a prudent developer.
Case Law Analysis
In the case of Munetsi v Madhuyu and Another, illustrates the development of legal principles relating to the breach of personal data. The matter required the court to consider whether the party truly breached the law and accessed the applicant’s personal data. The applicant went to court seeking relief from the respondent due to the personal information that was sent out to the public by the respondent. The two parties and another had a dispute that went further than it should have leading to the applicant’s mobile number being displayed to the public. The central legal issues before the court was whether the respondent and another should apologize to the applicant, the court found that an apology is not the right remedy but damages or an interdict is. The court considered the legal principles relating to section 11 of the POPIA act, section 11(1) of POPIA stipulates that personal information may only be processed in specific circumstances, and none of those circumstances applied in this case.
The court reasoned that an apology is not enough due to the extensiveness of the case being that the public had called the applicant countless times. The judgement demonstrates that putting out one’s personal data is no longer considered a minor crime but it has developed in resulting to damages or interdict a way to pay for this crime. The court’s interpretation suggests that publicly displaying of personal data is prohibited due to the developments of the legislations, it deepens the extensiveness of POPIA act section 11.
This decision is significant because it reinforces the importance of legal protection and demonstrates the judiciary’s role in adapting existing legal principles, it illustrates the way forward in the AI security world and where we standing. This case strengthened the law and showed the importance of guarding personal information from the public. Furthermore, the case provides to the development of South African law by showing how the legal principles continue to evolve in digital age.
Critical Evaluation
The continued development of AI security indicates a gradual progression towards greater trust, acceptance and responsible utilisation of artificial intelligence technologies. AI technologies can serve as valuable tools by facilitating access to information and efficiently managing substantial amounts of data that would be difficult for individuals to process within a limited timeframe. AI also presents the cyber security sector with significant opportunities to develop new and innovative ways to defend ourselves against hostile actors. The evolving legal landscape highlights the need for strengthened regulatory frameworks to ensure the effective enforcement and application of tort law principles.
The concerns surrounding the protection of personal information may be mitigated through the establishment of governmental regulatory frameworks and policies. However, despite continued efforts to enhance data protection, inconsistencies and legislative gaps may persist where the effective implementation and enforcement of such laws remain inadequate. Regulatory gaps remain evident in relation to the misuse of AI technologies, particularly through the use of voice cloning, fraudulent schemes and the dissemination of malicious content. Such challenges have the potential to cause substantial harm to individuals and undermine public confidence in the safe and responsible use of artificial intelligence systems. AI systems have raised fundamental doubts as to the viability of this test, due to the opacity of their internal decision-making processes and the distribution of responsibility among the various actors, entities and automated processes involved in the development and deployment of AI systems.
The existence of these risks does not negate the valuable contributions of AI technologies. Instead, it emphasises the need for a balanced legal and regulatory approach that promotes innovation while ensuring accountability, security and the protection of individuals’ rights. Although AI technologies present certain risks, their potential benefits and practical applications remain significant. The advantages of AI technologies warrant continued development and regulatory efforts to manage associated risks. These technologies off substantial benefits to organisations and individuals by enabling efficient information processing, supporting informed decision making and improving the management of complex data.
Conclusion
Artificial Intelligence is the new future that individuals can benefit same as the organisations. The potential benefits of AI security extend to strengthening data protection measures and improving risk management strategies within organisations and legal frameworks.
Although the misuse of AI technologies and cyberattacks present significant challenges, these risks can be addressed through effective governance enhanced cybersecurity measures and continuous technological advancement. As a defining component of the Fourth Industrial Revolution, AI has the potential to become a transformative force globally while requiring careful regulation to ensure responsible and secure adoption.
Risk management frameworks can be strengthened through the responsible integration of AI security measures, enabling organisations to better identify, assess and mitigate potential threats. This is evident through the implementation of legislation such as the (POPIA) and the Cybercrimes Act, which establish regulatory frameworks aimed at governing digital activities, safeguarding personal information and mitigating the risks posed by the cyber related threats. Although South Africa is not governed by the European Union Artificial Intelligence Act, international regulatory frameworks, particularly those developed by the European Union provide valuable guidance for the development of domestic AI governance. These frame works promote principles of transparency, accountability and the responsible use of artificial intelligence which may inform future legislative reforms. Together with the South African legislation such as the POPIA and the Cybercrimes Act, these developments contribute to strengthening data protection and cybersecurity.
The EU Artificial Intelligence Act aims to foster trustworthy, human-centric AI across Europe while protecting fundamental rights, democracy, and safety. The AI Act ensures that Europeans can trust what AI has to offer. While most AI systems pose limited to no risk and can contribute to solving many societal challenges, certain AI systems create risks that we must address to avoid undesirable outcomes.
Reference(S):
Cases
Munetsi v Madhuyu and Another (Western Cape High Court, 2024)
State v Lucky Majangandile Erasmus and Another (2025
Legislation
Protection of Personal Information Act 2013
Cybercrime Act 2020
Secondary Sources
De Rebus ‘Responsible AI use in South African legal practice: A call for ethical guidelines’ (De Rebus 2025)
European Commission ‘AI Act’ (European Commission 2025)
Amrita Vasudevan ‘Who is Liable for AI-Driven Accidents? The Law Is Still Emerging (Centre for International Governance Innovation 2023)
[1] The Department of Communications and Digital Technologies ‘National Artificial Intelligence Policy Framework (Draft)’ (Regulations.ai, 2026) https://regulations.ai/regulations/RAI-ZA-NA-NAIDDXX-2024 accessed 20 July 2026
[2] Protection of Personal Information Act 2013, s 19
[3] Protection of Personal Information Act 2013
[4] Munetsi v Madhuyu and Another (Western Cape High Court, 2024)
[5] Cybercrime Act 2020, s 2
[6] State v Lucky Majangandile Erasmus and Another (2025)
[7] De Rebus ‘Responsible AI use in South African legal practice: A call for ethical guidelines’ (De Rebus 2025) https://www.derebus.org.za/responsible-ai-use-in-south-african-legal-practice-a-call-for-ethical-guidelines/ accessed 21 July 2026
[8]Amrita Vasudevan ‘Who is Liable for AI-Driven Accidents? The Law Is Still Emerging (Centre for International Governance Innovation 2023) https://www.cigionline.org/articles/who-is-liable-for-ai-driven-accidents-the-law-is-still-emerging/
[9] Protection of Personal Information Act 2013, s 11 (1)
[10] Munetsi v Madhuyu and Another (Western Cape High Court, 2024)
[12] Amrita Vasudevan ‘Who is Liable for AI-Driven Accidents? The Law Is Still Emerging (Centre for International Governance Innovation 2023) https://www.cigionline.org/articles/who-is-liable-for-ai-driven-accidents-the-law-is-still-emerging/
[13] European Commission ‘AI Act’ (European Commission 2025) https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
