POPIA and automated credit decisions in vehicle finance

POPIA does not ban automated decisioning, but it does demand fairness, transparency and accountability when personal information is processed — especially when software influences whether someone gets a vehicle agreement. Vehicle finance operators using scorecards and bureau data need productised controls, not a PDF policy that nobody can operate.

Consent and purpose limitation

Credit checks and decisioning should sit behind recorded consent and a clear purpose. Platforms should store consent artefacts, restrict re-use of bureau data, and make it possible to respond to data-subject requests without archaeology across mailboxes.

Reason codes and human review

Automated scores are only defensible when outcomes carry reason codes and version pins: which scorecard, which weights, which inputs. POPIA-aware operations keep a path for human review on significant automated decisions rather than a pure black box. Dual-approval overrides for exceptions should be logged with before/after state.

Minimise and protect

ID numbers, income and banking detail are high-sensitivity. Field-level encryption at rest, TLS in transit, tenant isolation and scrubbed error reporting reduce blast radius. Derived stores (application JSON, OCR extractions) should not become a second plaintext lake. See security.

Data-subject rights as workflow

Access, correction and erasure requests need queues, clocks and audit — including the hard part: erasing or anonymising while preserving financial audit trails required for other legal duties. Breach registers and retention sweeps for tokens and drafts close operational gaps that pure legal manuals cannot.

What this is not

Software vendors should not claim that using their product makes an operator POPIA-compliant by itself. Compliance is an organisational obligation. Good software makes the operational duties feasible: consent ledger, decision audit, DSR workflow, encryption and isolation. Rent 2 ships those product surfaces for multi-tenant vehicle books.

Related reading: affordability scorecards, POPIA Manual, and contact for due-diligence walkthroughs with your Information Officer present.