Data residency in South Africa: what it means for public-sector and enterprise platforms

"Where will our data be hosted?" is now one of the first questions in South African tenders for learning platforms, portals and case systems. The answer affects your POPIA position, your risk register and sometimes your budget. Here is what the terms mean and what to check.

Residency, sovereignty and localisation

The three overlap, but they are not the same. A platform can be hosted in Cape Town by a company headquartered elsewhere, and still send copies of data abroad through support tools or third-party services.

What POPIA says about hosting abroad

POPIA does not prohibit hosting personal information outside South Africa. Section 72 instead limits transfers to a third party in a foreign country to specific grounds. In summary, a transfer is permitted where:

• the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to POPIA;
• the data subject consents to the transfer;
• the transfer is necessary to perform a contract with the data subject, or a contract concluded in their interest; or
• the transfer benefits the data subject, it is not reasonably practicable to obtain consent, and they would be likely to give it.

In practice, many organisations decide that keeping personal information in the country is simpler than documenting a lawful basis for every transfer, especially for large populations of citizens, learners or members.

Why the public sector asks for local hosting

Public bodies hold information about large numbers of people, and they answer to oversight bodies as well as to POPIA. Government policy on data and cloud services, including the National Data and Cloud Policy published in 2024, has put residency and sovereignty on the agenda, and recent tender specifications for learning platforms ask for data to be hosted in South Africa. If you are preparing a specification, state the requirement explicitly and ask bidders to name the region.

South Africa now has hyperscale cloud regions

Local hosting no longer means a trade-off with modern cloud services. Microsoft opened its South Africa North and South Africa West Azure regions in 2019. Amazon Web Services opened the AWS Africa (Cape Town) region, af-south-1, in April 2020 with three Availability Zones. Google Cloud opened its Johannesburg region in 2024.

Prices in African regions are often higher than in the largest US and European regions, so budget for the difference when you compare quotes.

Residency is not compliance

Hosting in Cape Town is a strong control, but it is only one. Data can still leave the country through routes that are easy to miss:

• backups or disaster-recovery copies stored in another region;
• logs and monitoring data sent to an overseas service;
• email and SMS delivery providers that receive names and contact details;
• AI services that receive learner answers, case notes or chat messages;
• support staff who can access production data from abroad.

None of these is automatically unlawful, but each should be known, documented and covered by an agreement.

Questions to ask a vendor

1. In which region are production data, backups and logs stored?
2. Which third-party services receive personal information, and where are they located?
3. Can support staff access production data, from where, and how is that access logged?
4. Do any AI features send data outside South Africa? Is it used for model training?
5. What happens to backups and copies when the contract ends?
6. Will you sign an operator agreement that names the hosting region?
7. How is the hosting region reflected in the service levels and the exit plan?

How AINEXIM approaches it

We agree the hosting location before a build starts. Client platforms can run in the AWS Africa (Cape Town) region, and we document every service that touches personal information so you can see the full picture, not just the main server. Our managed hosting includes monitoring, tested backups, patching and an exit plan with your data in open formats.