Two recent developments stand out in the POPIA landscape. The first is the Information Regulator’s draft code of conduct for the processing of personal information at gated accesses. The second is the growing international focus on AI-generated imagery and the privacy risks created when realistic images or videos of identifiable individuals can be generated without their knowledge or consent. Both developments are reminders that POPIA applies just as much to everyday operational practices as it does to new technologies.