Legal updates and opinions
News / News
AI and the Data Privacy Elephant in the Room
“The real problem is not whether machines think, but whether men do.” – B.F. Skinner
by Ahmore Burger-Smidt, Director and Head of Regulatory
Insights from the 2025 Report: AI Risk & Readiness in the Enterprise[1] Underlines the exponential threat that is not being addressed by AI progress. Data Privacy, a pressing issue that demands immediate attention!
From data leaks to regulatory “blind spots to shadow AI running amok“, the report highlights the fact that there are risks that cannot be ignored while organisations move towards the adoption of AI.
But what are these risks? More importantly, the question should be asked how to identify these risks.
Understanding and visibility into how AI models interact with personal data and sensitive personal data are crucial in identifying risks from a data privacy perspective. Without such insight, organisations will remain blind to data privacy risks within their environment, significantly increasing the risk associated with exposure to unauthorised use, access or further processing of personal information and data breaches.
The more data an AI model relies on, the higher the risk of exposing personal data and sensitive personal information. Shadow AI, meaning unauthorised or unmonitored AI use and tools, further compounds the above risk by operating outside of the organisation’s security visibility.
One of the core outcomes of the Report is the alarming statistic that 69.5% of organisations surveyed rank AI-powered data leaks as their biggest security concern.
As such, data leaks remain the most feared threat, informed by AI’s interaction with unstructured data and the rise of unauthorised models. But what to do?
Mitigating against data privacy breaches requires an understanding of what specific data is used for the particular AI model. Also, what the internal and external rules are in relation to the use of personal data and what the lawful basis is for doing so.
Organisations must conduct data privacy impact assessments to gain the necessary insight into privacy risk when considering AI. These assessments are a powerful tool in limiting the risk of exposure and detecting rogue model activity that could result in a data breach. Therefore, they are a crucial part of ensuring compliance with privacy legislation and protecting data subject rights.
The message: Understand what data the AI model relies on.
_________________________________________________
[1] AI Risk & Readiness in the Enterprise- 2025 Report.pdf (accessed 11 July 2025)
_________________________________________________
Read more about our Regulatory practice area.
Latest News
Tainted treats, spoiled foods and potential dangers…are there any legal safeguards for consumers?
In recent weeks gone by, there have been numerous food poisoning cases reported[1] resulting in serious health issues and, in [...]
It is not only diamonds that are forever – a snapshot of forever and hazardous chemicals
A recent study conducted by the Manchester Metropolitan University revealed that the processes intended to decontaminate noxious liquid landfill waste [...]
Going nowhere fast, proposed amendments to the direct marketing regulations under the CPA published, and your comments are sought!
On October 28, 2024, the Department of Trade, Industry and Competition (dtic) published draft amendments to the regulations under the [...]
The Collection of Premiums on Behalf of Insurers – A Look at the Impact of The Exemption of Juristic Representatives from Section 13(1)(C) of FAIS
and Khanyisa Tshoba, Candidate Attorney Introduction: In practice the need may arise for an insurer to appoint a third party [...]
The effects of the CPA Amendment Act, 2017
and Elia Chitata - Candidate Attorney With the introduction of the Restitution of Land Rights Act 22 of 1994, which [...]
Section 22 – A Springboard into Business Rescue
and Caitlin Steytler – Candidate Attorney In August 2024, Statistics South Africa revealed that 1020 entities filed for liquidation in [...]