South Africa Data Sovereignty: Managing Cloud Provider Access Risks

• South Africa's digital sovereignty debate highlights that data residency (where data is stored) does not equate to data sovereignty (who controls access to it).
• The 2024 National Policy on Data and Cloud only mandates in-country storage for national security government data, leaving other cross-border transfers to POPIA.
• Foreign cloud providers, even with local data centers, may be legally compelled by their home country's laws to provide data to foreign authorities, as demonstrated by a Microsoft legal director's testimony in France.
• Effective data sovereignty risk management requires South African organizations to scrutinize who holds encryption keys, who can access data via credentials, who patches underlying infrastructure, and who holds copies of their data.
• King V Principle 10 emphasizes managing risks from outsourced services and third parties, including those operating across different jurisdictions, which is critical for data control.

Lawyers and compliance officers must advise clients that data residency in South Africa does not automatically confer data sovereignty, especially with foreign cloud providers.

South Africa engaged in extensive discussions regarding digital sovereignty throughout September, with the national conversation often centering on the physical location of data. Events like GovTech, held in Durban under the theme “architect of its digital destiny,” underscored a national agenda for sovereignty, while the President emphasized in July that a nation's ability to secure its data is the true measure of its sovereignty. For many organizations, the question of *where* their data resides is already answered, with much of it located within South Africa's borders.

However, the crucial distinction lies between data residency and data sovereignty. While residency addresses the physical location of data centers, sovereignty pertains to who ultimately controls and can access that data. Major hyperscale cloud providers, including Microsoft, Google, and Amazon, have established regions within South Africa, with Microsoft having launched Azure regions in Johannesburg and Cape Town in 2019 and committing an additional R5.4 billion to local cloud and AI infrastructure by the close of 2027. Despite this, the promise of in-country processing for Microsoft 365 Copilot prompts and responses, initially slated for South Africa in 2026, was later revised, removing South Africa from the 2026 rollout for this specific functionality, while retaining it for five other nations.

The policy landscape also reflects this nuanced approach. The National Policy on Data and Cloud, approved by Cabinet in 2024, mandates in-country storage exclusively for government data related to national security. Crucially, it explicitly states that it imposes “no further data localisation requirements” and defers regulations concerning cross-border data transfers to the Protection of Personal Information Act (POPIA). This context highlights why, despite significant local infrastructure investment and policy, the physical address of data does not automatically equate to complete national control, a sentiment echoed by 45% of organizations in PwC’s latest Africa cloud survey, which indicated that geopolitics now influences their infrastructure decisions.

The notion that data residency in South Africa automatically confers data sovereignty is challenged by the realities of international legal frameworks, particularly when engaging with foreign cloud providers. A stark illustration of this emerged last July when Microsoft’s legal director in France testified under oath before a Senate inquiry. He candidly admitted that he could not guarantee that data belonging to French public bodies, even if stored by Microsoft, would never be disclosed to United States authorities without French consent. He clarified that while such an event had not occurred and the company is contractually obligated to resist unfounded requests, the underlying statute is American law, not corporate policy.

This fundamental legal reality means that any American cloud provider holding data, regardless of its physical location, would be bound by the same legal obligations, necessitating a similar response. This situation underscores that the question of who controls data transcends geographical boundaries. In response to these challenges, the industry has shifted its focus from mere promises to engineering solutions, such as establishing data boundaries, implementing in-country processing capabilities, and offering customer-held encryption keys. As one analyst observed this April, true cloud sovereignty is no longer solely about where data resides; it is fundamentally about effective risk management, especially concerning potential cloud provider data access by foreign governments.

For South African organizations navigating the complexities of data sovereignty, a proactive risk management approach is paramount, moving beyond simply asking where data is stored. This involves critically examining four key areas to ensure robust POPIA compliance and genuine control over sensitive information. Firstly, organizations must ascertain: *Who holds the keys?* While all three major hyperscalers now provide options for customers to encrypt their own data using keys stored in their own vaults, adoption among South African enterprises remains low, meaning the vendor often retains effective control over encryption.

Secondly, a crucial question is: *Who can reach it?* The Sophos 2026 ransomware study revealed that for 85% of South African organizations attacked in the past year, the ransomware incident coincided with their most severe identity compromise, significantly higher than the 67% global average. This indicates that the primary vector for unauthorized access to South African data is often through compromised credentials that already possess legitimate access. Therefore, data sovereignty is intrinsically linked to the security of these credentials.

Thirdly, organizations must consider: *Who patches the engine beneath it?* A database located within South Africa but running on an unsupported software version is not sovereign; it is exposed. For instance, SQL Server 2017 has only 12 months of support remaining, and Windows Server 2016 has just three months. Relying on outdated or unpatched infrastructure, even if locally hosted, introduces significant vulnerabilities. Finally, the question of *Who else holds a copy?* is vital. This directly aligns with King V’s Principle 10, which states that the governing body governs data, information, and technology in a way that enables the organisation to sustain and optimise its strategy and objectives. This principle extends accountability to risks associated with outsourced services, suppliers, and third parties, particularly those operating across different jurisdictions. Lawyers and compliance officers must advise clients that data residency in South Africa does not automatically confer data sovereignty, especially with foreign cloud providers. They need to scrutinize cloud contracts for true data control mechanisms, such as customer-held encryption keys, and assess the full spectrum of data security risks, including potential access by foreign governments and the management of credentials and patching, to ensure robust POPIA compliance.

Lawyers and compliance officers must advise clients that data residency in South Africa does not automatically confer data sovereignty, especially with foreign cloud providers. They need to scrutinize cloud contracts for true data control mechanisms, such as customer-held encryption keys, and assess the full spectrum of data security risks, including potential access by foreign governments and the management of credentials and patching, to ensure robust POPIA compliance.

Source: Insights derived from recent industry reporting.