Key takeaways

Residency answers where. Sovereignty answers who – A data centre inside the border settles the first question and says nothing about the second: who holds the keys, who can reach the data, who patches the engine beneath it and whether you could take all of it back.
Control leaks through copies, not borders – Every extract, staging database, spreadsheet and supplier feed is another place the data lives, with its own permissions, its own patch state and its own jurisdiction. Most estates have never counted them.
September’s breaches needed no foreign border – Institutions whose own systems were never touched wrote to their customers anyway, because a copy of those customers’ identities sat with a supplier. Residency was never the problem.
The sovereignty decisions are being taken by administrators – A tenant setting that sends AI prompts to another continent is switched on in an afternoon because a dashboard needed the feature. Nobody minutes it.
Residency can be bought. Control cannot – In-country regions and customer-held keys are here; in-country AI processing is arriving, on the vendors’ timetable. What no vendor can supply is the organisation’s own knowledge of where its copies are and who can reach them.

South Africa spent September talking about digital sovereignty. GovTech ran in Durban under the banner “architect of its digital destiny”, the Minister set out a national sovereignty agenda and the President had told a hyperscaler’s summit in July that sovereignty is now measured by “a nation’s ability to secure its data”.

Nearly all of it turns on one question: where – where the data centre stands, which border the bytes rest inside. For most enterprises that is already answered: their data is in South Africa. The harder question is whether it is theirs. Residency answers where. Sovereignty answers who.

Where

The where question is being answered for us, and answered well. Microsoft has run Azure regions in Johannesburg and Cape Town since 2019 and has committed a further R5.4-billion to South African cloud and AI infrastructure by the end of 2027. Google and Amazon have regions of their own. Even in-country processing for Microsoft 365 Copilot – prompts and responses handled inside the border – was promised to South Africa for 2026 last November; an April revision kept the 2026 date for five other countries and gave South Africa none.

Policy has gone the same way, deliberately. The National Policy on Data and Cloud that Cabinet approved in 2024 requires only government data touching national security to be stored inside the country, states that it imposes “no further data localisation requirements” and leaves cross-border transfers to Popia. PwC’s latest Africa cloud survey has 45% of organisations saying geopolitics now shapes their infrastructure decisions – and the adjustment, in most conversations I hear, is a question to the vendor about where the region is.

If sovereignty were an address, then, we would be close to done.

It is not. In June last year Microsoft’s legal director in France told a Senate inquiry, under oath, that he could not guarantee that data held for French public bodies would never be handed to the United States authorities without French consent – adding that it had never happened, and that the company is contractually bound to resist unfounded requests. It was an honest answer, and it was not Microsoft’s to change: the statute behind it is American law, not company policy, and every American provider that holds the data would have to give the same reply.

The response since has been engineering rather than promises: data boundaries, in-country processing, customer-held encryption keys. One analyst put the shift plainly this April: sovereignty in the cloud “is no longer simply about where data resides, it is about managing risks”.

Who

Strip the flags off the phrase and data sovereignty comes down to four questions a South African organisation can put to itself.

Who holds the keys? All three hyperscalers now let a customer encrypt its own data with keys it holds in its own vault. In my experience few South African enterprises have taken up the option, which means the answer, in practice, is “the vendor, on our behalf”.

Who can reach it? Sophos’s 2026 ransomware study, drawing on 135 South African organisations attacked in the past year, found that in 85% of cases the ransomware and the organisation’s most serious identity compromise were the same event – against 67% globally. The route into South African data is a credential that already had access. Sovereignty is a question about that credential.

Who patches the engine beneath it? A database inside the border on an unsupported version is not sovereign; it is exposed with a local address. SQL Server 2017 has 12 months of support left. Windows Server 2016 has three months.

And who else holds a copy? King V’s Principle 10 asks the board to manage the risks of “outsourced services, suppliers and third parties, including across jurisdictions”. It is this last question that September answered, loudly.

The copies

Here is what I see in most estates, and I see it without looking hard.

A finance extract that runs every night from the ERP to a reporting server, because reporting was slowing production down in 2017. The server was never added to the backup schedule, its database engine is two versions behind the source, and its data is readable by a group called Everyone.

A customer table that exists once in the core system and then again in the CRM, the marketing platform, the loyalty programme, the identity-verification vendor’s platform and a warehouse that was built to consolidate all of them and became a seventh copy instead.

A spreadsheet on the file share with 40 000 identity numbers in it, exported for a project in 2022 and attached to an email twice since.

Each of those is a place the data lives. Each has its own permissions, its own patch state, its own backup and its own jurisdiction. None of them appears in the asset register, because the asset register lists systems, and copies are not systems. Redgate’s June survey of 2 150 database professionals found 77% of organisations with no formal data governance process. The copy count in most estates is not known because it has never been asked for.

That is where sovereignty is lost – copy by copy, inside the border.

A domestic address

On 9 September the Dire Wolf ransomware group claimed to have taken 200GB of data from RelyComply, a South African provider of identity-verification and anti-money-laundering checks to regulated financial firms – “production databases and Amazon S3 cloud storage”, in the attackers’ own words, some 3.57 billion rows. RelyComply confirmed an incident and an investigation.

Within days, several regulated institutions were writing to their customers – and, where the law required it, to the Information Regulator – each able to say, truthfully, that its own systems had not been breached. One of the country’s largest banks was investigating whether the identity checks it runs at account opening were in scope. A fortnight earlier the same group had hit a vehicle-tracking company with more than two million subscribers; that data was on the dark web by 8 September.

The month’s third case reached further down the chain. A policy-administration provider to the life insurers disclosed that a June intrusion – an employee’s password reused on an unrelated site, a support-ticket system the provider was decommissioning – had exposed, by its own count, some 400 000 records belonging to the customers of around 45 insurers. The policy databases were untouched; the data left in files. A ransom was paid for a promise to destroy it, and by 7 September the first insurer was on the leak site. The regulators then said the same thing twice. Under Popia, the Information Regulator noted, the obligation “rests on the responsible party” – the insurer, not its supplier. Under Joint Standard 2, said the Prudential Authority, “the obligation, again, lies with the insurers”: the 24-hour clock is theirs, whichever server the data left from.

Craig Rosewarne of Wolfpack calls these “digital supply chain” or “hub-and-spoke” attacks: one provider, many clients. I would put it more plainly. In the identity-verification case the institutions had a South African supplier under a South African contract. Where the copy itself sat is another matter – the supplier’s own privacy notice, quite properly, allows processing in South Africa, the United Kingdom, the European Economic Area, the United States “or other countries” – and I doubt many of its clients could have said which. What none of them had was control over a copy of their own customers’ identities, and the difference arrived as a breach notification.

One thing follows. The way in varies – a reused password, a zero-day in a supplier’s application – but what leaves is always the same: the database, or, as in the administrator’s case, a copy of it in transit – an export, a transfer file, an attachment on a support ticket. The perimeter is where the attacker starts. It is not where the data is.

A setting, not a resolution

Sovereignty is also decided in smaller rooms than the boardroom.

Take a Microsoft Fabric capacity in the South Africa North region, where every Fabric workload is available and OneLake storage rests inside the border. Copilot in Fabric is switched off in that tenant by default, because the Azure OpenAI service behind it runs in United States and European data centres. Microsoft documents this in plain language and ships the setting off, which is exactly right.

To use it, a Fabric administrator enables a tenant setting called “Data sent to Azure OpenAI can be processed outside your capacity’s geographic region, compliance boundary or national cloud instance”. From that moment, prompts and results leave the country.

That is a sovereignty decision. In most organisations it is taken by an administrator on a Tuesday afternoon, because a dashboard needed the feature, and it is recorded nowhere a director will read. Microsoft’s part is in order – the default is right and the documentation is candid. The gap is on the customer’s side of the screen: who decides, against what policy and where is it minuted.

The sovereign estate

An organisation that is sovereign over its data can do five things. It can count its copies – extracts, spreadsheets and suppliers included – and say who owns each one. It holds its own keys where the platform allows. It knows which credentials can reach personal information and has reviewed them this year. It knows the support status of every engine holding that information. And it knows what each supplier holds, under what terms, in which jurisdiction – and could take it all back if it had to.

Not one of those five is about a border. All five are about control, and all five are questions a board is now accountable for asking.

The national debate will run its course and produce what such debates produce – a policy, a tracker, more data centres, all of it welcome. The question that will actually be put to South African enterprises in the year ahead, by their boards, their insurers and the Regulator, is the other one. Who has it.

The last word

I have spent my working life at the layer where a country’s digital destiny is actually decided – the database, and the people who run it – and I have never seen sovereignty lost at a border. I have seen it lost in a nightly extract, a shared folder and a supplier’s schema, one copy at a time.

Residency is now something you can buy, and South Africa is a good place to buy it. Control is not for sale. It has to be counted, held and reviewed, and the organisations that do that this year will be the ones with an answer when the who question arrives.