Data Localisation In The Public Sector: Where Should Government Data Reside?

As the South African government accelerates its adoption of cloud computing, AI and other data-intensive technologies, one question is becoming increasingly important: where does government data actually reside and where should it reside?

The answer is not always as straightforward as the location of a cloud provider’s data centre.

The Minister for Department of Public Service Administration approved the Determination and Directive on the Usage of Cloud Computing Services in the Public Service on 12 January 2022. The directive was approved under the Public Service Act, 1994 and its purpose is to provide guidance to government departments on the adoption and use of cloud services, where government data is either stored or processed. The directive's position is clear – government data must reside within the borders of South Africa and where this is not possible and government data is hosted outside of South Africa, the directive places the onus on the relevant head of department to ensure compliance with section 72 (Transborder Information Flows) of the Protection of Personal Information Act, 2013 ("POPIA").

The directive has significant implications for the adoption of modern cloud environments as they can involve data being replicated, backed up, monitored or accessed across multiple jurisdictions. A solution may therefore be hosted in a South African cloud region while other elements of the service operate offshore.

The directive recognises this complexity. Before adopting a cloud service, departments must consider where data will be stored and processed. Contracts with cloud service providers must also address the ownership rights in government data, identify the geographic locations where data storage and processing will occur and the jurisdiction governing the contract.

For government institutions and their technology providers, this means considering the entire data lifecycle, including:

• Where data is stored, backed up and replicated;
• Who can access or process the data, including offshore personnel and service providers;
• Which jurisdictions may become involved through cloud infrastructure, support or subcontractors; and
• What contractual and regulatory controls apply to those data flows.

This makes data localisation more than an IT consideration. It is increasingly a legal, procurement, contracting and governance issue.

The directive should also be considered alongside the National Data and Cloud Policy, 2024, which provides the broader policy framework for South Africa’s cloud and data ecosystem. We have written on the National Data and Cloud Policy before, read more here.

As cloud adoption continues to grow across the public sector, the question is no longer simply whether government should move to the cloud but rather there should be a focus on where the hosting will occur, access, and whether the election of hosting government data offshore complies with law and most importantly section 72 of POPIA.

Should you or your organisation require assistance with navigating data localisation, cloud contracting or data sovereignty requirements in the public sector, please feel free to contact one of our experts below.