Summarise core duties of POPIA and Eswatini's Data Protection Act
Classify data into share-never / share-carefully / share-freely
Apply minimisation and anonymisation before any AI use
The law in one breath
South Africa's POPIA and Eswatini's Data Protection Act (2022) both require: lawful, specific purpose for processing; minimisation; security safeguards; and accountability, with rights for people to access and correct their data. GDPR in Europe set the template. If you process personal data for others, you have duties, full stop.
The three-bucket rule
Share-never: IDs, passwords, banking, medical records, children's data, client files. Share-carefully: anonymised or aggregated data, your own drafts. Share-freely: public information, your own non-sensitive ideas. Sort before you paste; sorting is the skill.
Anonymise like a pro
Replace names with codes, drop exact dates and addresses, aggregate small groups, and strip metadata from files. If a stranger could re-identify someone from your paste, it is not anonymised.
Key terms
Personal data
Any information identifying a natural person.
Minimisation
Processing only what the purpose needs.
Anonymisation
Removing identifiers so re-identification fails.
Accountability
Being able to demonstrate compliance.
🛠 Hands-on task: Bucket-sort 10 items
Tools: Notes
List 10 data items from your life/work.
Assign each to share-never / carefully / freely.
Anonymise one 'carefully' item properly and show before/after.
Key takeaways: Before you go, three takeaways from this lesson. One: Summarise core duties of POPIA and Eswatini's Data Protection Act. Two: Classify data into share-never / share-carefully / share-freely. Three: Apply minimisation and anonymisation before any AI use. And your hands-on task: bucket-sort 10 items. List 10 data items from your life/work. When it is done, mark the lesson complete on your dashboard, keep the artifact for your portfolio, and step into the next lesson. I will see you there.
