Online learning platforms, AI tutors, student data systems and digital credentialling are reshaping education across South Africa. This guide examines the regulatory, data protection and IP obligations for EduTech operators.
Introduction: Education in the Digital Age
South Africa's education system is undergoing a digital transformation driven by improved connectivity, the proliferation of mobile devices, and the acceleration of online learning during and after the COVID-19 pandemic. EduTech companies, higher education institutions, private schools and corporate training providers are deploying learning management systems, AI-powered tutoring platforms, digital credentialling frameworks and student analytics tools at scale. However, the legal and regulatory environment governing these innovations is complex and spans multiple statutory frameworks, with particular sensitivity around the data of minors.
POPIA and the Processing of Learner Data
The most significant legal obligation facing EduTech operators is compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). Learner data — including academic records, assessment results, learning behaviour data, health information, and biographical details — constitutes personal information under POPIA. Where learners are minors (under 18), their personal information receives the heightened protection applicable to children's information under Section 34 of POPIA, which prohibits processing of children's personal information without the consent of a competent person (parent or guardian) unless a statutory exception applies.
EduTech platforms must carefully structure their consent mechanisms to obtain valid parental consent for data collection in respect of minor learners. This applies not only to obvious personal data such as names and contact details, but also to learning analytics data, device identifiers, and any biometric data such as facial recognition used for proctoring or attendance management.
AI in Education: Algorithmic Accountability
AI-powered tutoring systems, adaptive learning platforms and automated assessment tools make consequential decisions affecting learners' educational trajectories. South Africa currently has no dedicated AI regulation, but EduTech AI systems must comply with existing legal frameworks. Algorithmic systems used for student assessment or progression decisions must not discriminate unfairly on the grounds listed in the Equality Act (race, gender, disability, etc.). Where AI systems process learner personal information in their operation or training, POPIA applies. Platform providers should document the operation of AI systems used in educational decision-making and implement human review mechanisms for material educational decisions.
Digital Credentialling and Blockchain Certificates
Blockchain-based academic credentials and digital badges are increasingly used by universities, professional bodies and corporate training providers. The Electronic Communications and Transactions Act 25 of 2002 (ECT Act) provides that electronic signatures and records have legal validity equivalent to their paper counterparts, provided applicable requirements are met. Digital credentials issued on permissioned blockchain platforms with appropriate audit trails are legally valid under the ECT Act. However, the recognition of digital credentials by professional licensing bodies — the Health Professions Council, the Engineering Council, the LPC — requires engagement with each body's specific requirements, as not all have updated their record-keeping frameworks to accommodate blockchain-native credentials.
Copyright and Educational Content
The Copyright Act 98 of 1978 (currently under reform through the Copyright Amendment Bill) provides a fair dealing exception for educational purposes, but this exception has defined boundaries. EduTech platforms that reproduce, adapt or distribute third-party educational content must obtain appropriate licences. AI systems trained on educational content may face copyright infringement claims where the training process constitutes reproduction of protected works without authorisation. The unresolved status of the Copyright Amendment Bill — which has been referred back to Parliament multiple times — means operators should monitor legislative developments closely.
Higher Education: Regulatory Considerations
Private higher education institutions must be registered with the Department of Higher Education and Training (DHET) under the Higher Education Act 101 of 1997. EduTech platforms that award qualifications or credits that learners may apply toward formal qualifications must ensure that the qualifications are registered on the National Qualifications Framework (NQF) by the South African Qualifications Authority (SAQA). Operating a private higher education institution without registration is a criminal offence.
Labour Law: Online Training and the Workplace
Corporate EduTech platforms used to deliver employee training must comply with the Skills Development Act 97 of 1998 and the requirements of the relevant Sector Education and Training Authority (SETA). Training programmes for which employers wish to claim SETA grants must be aligned with registered qualifications or skills programmes. Digital delivery of workplace training is generally accepted but must meet the same substantive requirements as classroom delivery for SETA grant claim purposes.
How Mashiane Attorneys Can Assist
Our Smart Education practice advises EduTech companies, private schools, higher education institutions and corporate training providers on POPIA compliance for learner data, parental consent frameworks, AI accountability systems, digital credentialling legal frameworks, educational copyright licensing, DHET and SAQA registration, and SETA compliance. Contact us at hello@mashiane.law for a confidential consultation.