South African ID numbers and POPIA: detect and anonymise before AI

In South Africa, the 13-digit identity number is everywhere. It appears on credit applications, medical records, employment contracts and the RICA forms of mobile operators. So it also turns up in the spreadsheets and emails that teams paste into ChatGPT, Copilot or Gemini every day.

This number is not just an identifier. Its structure reveals information about the person. This article explains why POPIA requires you to protect it, how to detect it reliably in a prompt, and how to anonymise it without breaking the business value of AI.

POPIA and the Information Regulator: the framework

The Protection of Personal Information Act (Act 4 of 2013), known as POPIA, has applied in full since 1 July 2021, after a one-year grace period. It is enforced by the Information Regulator, an independent authority.

The Act is explicit: the definition of personal information includes any identifying number assigned to a person. It requires responsible parties to take appropriate technical and organisational measures to prevent loss of, or unauthorised access to, personal information. If there is a security compromise, they must notify the Regulator and the data subjects as soon as reasonably possible. Transfers outside South Africa are only allowed under specific conditions, for example to a country offering adequate protection or with the person's consent.

The Regulator does enforce. In July 2023, it imposed an administrative fine of R5 million on the Department of Justice and Constitutional Development. The department had failed to comply with an enforcement notice after letting its security licences lapse, including anti-virus, SIEM and intrusion detection software.

What a South African ID number reveals

The number follows the format YYMMDD SSSS C A Z. Take a fictitious example: 8804125123080.

1. 880412: the date of birth, here 12 April 1988.

2. 5123: a sequence number that also indicates gender. 0000 to 4999 for women, 5000 to 9999 for men.

3. 0: status, 0 for a South African citizen, 1 for a permanent resident.

4. 8: a digit with no particular meaning today.

5. 0: a check digit calculated with the Luhn algorithm.

A single number therefore gives away age, gender and citizenship status. Combined with a name or a file, it identifies someone with certainty. That is why it should be treated as sensitive data, even though it is not on the Act's list of special personal information.

Detecting an ID number in a prompt

A simple search for 13 consecutive digits produces many false positives: account numbers, order references, internal codes. Reliable detection combines several checks.

• Format: 13 digits, sometimes with spaces after the date and the sequence.

• Date: the first six digits must form a real date, month 01 to 12 and a day that fits the month.

• Status: the eleventh digit is 0 or 1.

• Luhn check: the last digit must be valid. This test alone removes about nine false positives out of ten.

• Context: words such as "ID", "identity number", "ID no" or "RSA ID" nearby raise the score.

The same reasoning applies to other common identifiers: phone numbers in +27 format, passport numbers, tax numbers and bank details. This is what separates precise detection from a filter that blocks everything and that teams end up bypassing, a problem we cover in why email and network DLP fails on ChatGPT.

Anonymising without breaking AI use

Deleting the number often makes the answer useless. If an analyst asks the AI to check the consistency of a file, they need numbers that look like real numbers. The right approach is format preserving anonymization.

1. The real number 8804125123080 is replaced, before sending, with a fictitious one such as 9107235412081.

2. The replacement stays valid: real date, consistent status and correct Luhn digit. Gender can be preserved if the analysis depends on it.

3. The mapping is kept locally, on the device, for the session.

4. When the AI replies, the fictitious numbers can be swapped back to the real ones for the user.

The AI never sees the real data, yet the user gets a usable answer. We explain the method in detail in format preserving anonymization.

Where to place this control

A network-level control has limited visibility into encrypted sessions and misses files dragged into the browser. A control on the workstation sees the text at the moment it is pasted or sent. That is where to act, before the data leaves the device. To see how a leak actually happens, read the anatomy of an AI data leak.

The regulatory context points the same way. On 10 April 2026, the Department of Communications and Digital Technologies published a draft National AI Policy, open for comment until 10 June 2026. It is not binding, but it signals a risk-based approach.

Summary

The South African ID number packs date of birth, gender and citizenship status into 13 digits. POPIA requires it to be protected, and the Information Regulator has shown that it penalises missing technical controls. ZeusLock detects these numbers and other South African identifiers directly on the device, anonymises them while preserving their format, warns or blocks according to your rules and logs every event as compliance evidence.

Want to test detection on your own use cases? Book a ZeusLock demo.