clause: POPIA children's information

premise: Our gaming-platform onboarding for the under-16 tier requires a parent or guardian to complete an OTP-verified mobile-number check and explicitly accept a child-data notice before the account is provisioned.

hypothesis: The responsible party has obtained consent from a competent person before processing the child's personal information.

label: entailment

scenario: gaming-platform-otp


premise: Our after-school robotics club records each minor's full name, school, contact details and medical conditions in a Google Sheet that we never share, with explicit signed authorisation from each parent at enrolment.

scenario: robotics-club-enrolment


premise: We allow learners as young as 9 to register with their own email address for our music-practice tracking app, with no parental verification step at any point.

label: contradiction

scenario: music-app-no-parent


premise: Our coding-bootcamp marketing team buys mobile-number lists of Grade 9 learners from a third-party data broker and sends them WhatsApp messages promoting our holiday camps.

hypothesis: The responsible party has a lawful basis to process the children's personal information for direct marketing.

scenario: coding-bootcamp-marketing


premise: Our paediatric dental practice processes minors' clinical history only with the written consent of their parent or legal guardian.

scenario: paediatric-dental


premise: Our church's youth-group register contains photos, contact numbers and dates of birth of every minor in the programme, all collected without any parental-consent process or notice.

scenario: church-youth-register


premise: Our public hospital sends every paediatric in-patient's parent a written summary explaining what clinical data is being captured before treatment begins.

hypothesis: The processing of children's personal information is justified by a lawful basis and parents are informed.

scenario: public-hospital-paediatric


premise: Standard Bank reviews a 35-year-old client's monthly statements to authorise a home-loan application.

hypothesis: The responsible party is processing children's personal information.

label: neutral

scenario: adult-home-loan


premise: Our online retailer's analytics dashboard receives only aggregated session counts with no per-user identifiers.

hypothesis: The responsible party is processing identifiable personal information of children.

scenario: retailer-anon-analytics


premise: A News24 reporter writes a feature on Matric exam pass rates using only aggregated district-level statistics.

hypothesis: The responsible party is engaged in systematic processing of identified minors' personal information for commercial purposes.

scenario: matric-aggregate-reporting


premise: A creche operator hands over each enrolled child's name, allergies and parent contact to its catering subcontractor without ever consulting the parents.

hypothesis: The responsible party has obtained consent from a competent person before sharing the child's personal information with the third party.

scenario: creche-unauthorised-share


premise: Our prep school's IT helpdesk processes parent-reported password resets for learner accounts strictly on the basis of the signed parental authorisation captured at enrolment.

scenario: prep-school-helpdesk


premise: A children's hospital ICU records minors' clinical data under its statutory obligation to deliver care, and notifies the legal guardian in writing on admission.

scenario: icu-paediatric-statutory


premise: An adult opens a Capitec savings account; the bank processes their salary deposits and transaction history.

scenario: adult-savings-account


premise: Cape Town traffic-camera data captures vehicle speeds at intersections, anonymised at source.

hypothesis: The responsible party is processing identifiable minors' personal information.

scenario: traffic-cam


premise: A wedding-photography studio shoots adult guests at a corporate event and the gallery contains no identifiable minors.

scenario: corporate-event-photo


clause: POPIA special personal information

premise: A health-tech startup ingests members' chronic-condition history from their medical-aid feed only after each member completes an in-app consent flow specific to that processing.

hypothesis: The responsible party has a lawful basis under §32 for processing health information.

scenario: healthtech-explicit-consent


premise: A police-investigator queries a national database for an arrest record for purposes of an open criminal docket, under the §29 exception for processing criminal-behaviour data by competent authorities.

hypothesis: The responsible party has a lawful basis under POPIA to process criminal-behaviour information as special personal information.

scenario: police-investigation


premise: A retail-staff scheduling tool quietly tags each employee's apparent religion based on names, then assigns shifts that avoid certain religious dates without any consent flow or legal-duty basis.

hypothesis: The responsible party is processing religious belief as special personal information on a lawful basis.

scenario: scheduling-religion-inference


premise: A mobile-network operator runs a biometric voiceprint-matching pipeline on every inbound call from its USSD line for anti-fraud, without disclosing biometric processing in its terms or seeking explicit consent.

hypothesis: The responsible party has a lawful basis under §27/§32 to process biometric special personal information.

scenario: mno-voiceprint-no-consent


premise: A hospital system uses minors' medical-record data for clinical-decision support solely with explicit parental consent and within the §32 medical-treatment exception.

hypothesis: The responsible party has a lawful basis to process special personal information.

scenario: hospital-cds-consent


premise: A jewellery store sets up its CCTV system to identify the apparent race of every customer entering, then routes the feed to a regional 'risk' dashboard with no consent or legal basis.

hypothesis: The responsible party has a lawful basis to process race as special personal information.

scenario: jewellery-cctv-race


premise: Standard Bank checks a customer's payslip and statements for a personal-loan affordability assessment under the NCA.

hypothesis: The responsible party is processing special personal information under §26.

scenario: loan-affordability


premise: An e-commerce site stores delivery addresses and order history for shipping fulfilment, with no special-category data involved.

scenario: delivery-shipping


premise: StatsSA publishes aggregated provincial unemployment data based on its labour-force survey.

hypothesis: The responsible party is processing identifiable special personal information of individual data subjects.

scenario: statssa-unemployment


premise: A medical practice publishes only aggregated anonymised consultation-pattern statistics in its annual community-health report.

scenario: practice-aggregate-stats


premise: A pharma research project processes participant health data only after each participant has signed a §32(2) compliant informed-consent document approved by an ethics committee.

scenario: pharma-research-consent


premise: A national criminal-records check on a candidate for a security-cleared role is processed under §29 by an authorised body for the legally-required vetting.

scenario: security-vetting


premise: A fitness app silently uploads heart-rate and ECG samples to a third-party analytics vendor for population studies, without informing or obtaining consent from users.

scenario: fitness-app-shadow-health


premise: A school photo gallery captures wide-angle images of sports day without identifying or focusing on any individual learner.

scenario: school-sports-photo


premise: An MNO processes monthly call-detail records for routine network capacity planning with no special-category data involved.

scenario: mno-cdr-capacity


premise: An insurance underwriter prices a life-cover policy based on the applicant's voluntarily disclosed health questionnaire and the applicant's signed consent for the insurer to access medical records.

scenario: life-cover-underwriting


clause: POPIA automated decision-making

premise: Our travel-insurance platform's pricing model is registered as part of a Regulator-approved §60 code of conduct, and each applicant can submit additional context before the final premium is fixed.

hypothesis: The responsible party is processing automated decisions in compliance with §71.

scenario: travel-insurance-code


premise: A municipal-services tariff platform auto-classifies indigent applicants under predefined rules, but every applicant flagged 'borderline' is reviewed and finalised by a human officer who can override the system.

hypothesis: The responsible party is using automated processing as decision support, not as a solely automated decision with legal effect within §71.

scenario: municipal-indigent


premise: Our buy-now-pay-later platform rejects applicants based on a black-box vendor score; rejected users get a single sentence and there is no human-review path.

hypothesis: The responsible party is complying with §71 by offering data subjects the opportunity to make representations or by providing the underlying logic of the automated decision.

scenario: bnpl-blackbox


premise: Our gig-platform deactivates drivers whose acceptance rate falls below 80% via a fully automated rule, with no notice, no logic disclosed, and no avenue for the driver to challenge the deactivation.

hypothesis: The responsible party complies with §71's requirement to inform the data subject of the underlying logic of an automated decision.

scenario: gig-platform-deactivation


premise: Our funeral-cover application form is processed by a rule-based engine that confirms eligibility within minutes; declined applicants receive a structured letter explaining the precise rule that failed and a clearly-marked human-review address.

hypothesis: The responsible party is meeting §71's requirements on automated decision-making with legal or substantial effect.

scenario: funeral-cover-rules


premise: Our home-loan affordability decisioning is automated up to a documented threshold, beyond which a human credit officer makes the final call; applicants are told this in writing.

scenario: home-loan-human-override


premise: A factory's barcode scanner-to-product-ID lookup runs as an automated pipeline.

hypothesis: The responsible party is making an automated decision with legal or substantial effect on a data subject within the scope of §71.

scenario: factory-barcode


premise: A company's email server runs an automated phishing detector that quarantines suspect messages with a one-click release option.

hypothesis: The phishing filter is the kind of automated decision §71 was designed to regulate.

scenario: phishing-filter


premise: An open-data portal runs an anonymous national budget survey, aggregating respondent opinions without making any decision about any individual.

hypothesis: The site is engaged in §71 automated decision-making about individual data subjects.

scenario: open-data-survey


premise: A bursary-screening platform uses fully automated ranking to drop candidates below a cutoff, with no human review and no notice to rejected applicants about what data was used.

scenario: bursary-blackbox


premise: A car-rental fraud-detection model auto-blocks bookings based on an opaque risk score without notice or appeal channel for the blocked customer.

scenario: car-rental-fraud


premise: A health-insurance platform offers a transparent claim-decision flow: claims are scored automatically against published rules, claimants receive a structured explanation, and disputed claims route to a human assessor within five business days.

scenario: health-claim-transparent


premise: A university applications portal auto-shortlists candidates against admission criteria, but every shortlisted candidate is finally interviewed by a human admissions panel.

scenario: university-shortlist


premise: A logistics company's route-optimisation engine assigns delivery sequences to drivers based on geofencing rules, with no individual customer decision being made.

scenario: logistics-route


premise: A national lottery's automated draw selects winning numbers each Wednesday and Saturday with no decision being made about any individual applicant.

hypothesis: The lottery draw is the kind of automated decision §71 was designed to regulate.

scenario: lottery-draw