Many South African organisations evaluating sovereign cloud, treat it as a choice of local data centre region. Nicolas Blank, the CTO of NBConsult (a Division of Cyberlogic), explains why sovereignty depends largely on who controls identity, encryption keys, operation and recovery, as well as how AI and POPIA affect the decision. 

Why a local region is only one part of sovereignty

As sovereign cloud offerings reach the local market, many buyers still see sovereignty merely as a single decision about where their data is stored. As Nicolas Blank explains, this limited view leaves some of the most important control questions unanswered.  

“Real control is delivered only when sovereignty extends beyond just the data location. A South African Azure region alone does not resolve unanswered variables like who control identities, what happens to encryption keys, and who manages the privileged administration and software dependencies.”

Blank further refers to the US Cloud Act as an explanation why. This law is designed to be able to compel covered US providers to produce data within their control, even when that data is physically stored in another country. A local region may therefore leave the organisation’s underlying dependency on the provider unchanged. 

He highlights the five dimensions across which sovereignty can be measured: (1) data, (2) identity, (3) operations, (4) technology, and (5) jurisdiction. An assessment that covers data location alone, he says, can give a sense of control the organisation does not really have.

How AI has changed the type of questions organisations need to ask

“AI turns stored data into continuously processed, inferred and generated information,” Blank explains. “Organisations must now understand where prompts go, whether data trains models, which jurisdictions host inference, and who governs autonomous agents.” 

AI is also shifting power in the market. Only a relatively small number of providers have the necessary compute, models and data to run AI at scale, which concentrates control with them. Blank points to the EU AI Act as an early regulatory response to that concentration, and notes that prohibited uses under the Act can carry significant penalties.

For organisations adopting AI, sovereignty means governing the models, data, compute, identities and decisions involved. Where  the AI is being hosted is one consideration among several.

POPIA requirements when using cloud service

Blank is clear that South Africa’s POPIA Act*, allows organisations to use offshore cloud services, as long as they meet the act’s conditions.

“POPIA does not prohibit offshore cloud services. It requires accountable processing, appropriate security and lawful cross-border transfers.” 

He suggests that before signing a cloud contract, that buyers first search for clear answers on where personal information is processed and which subcontractors can access it. They should also be aware of:

• which foreign laws apply to the information,
• how the provider handles breaches,
• whether the information can be returned or deleted when the relationship ends.

Penalties under POPIA can be severe, and certain offences carry custodial sentences.

His advice: Assess the full legal and operational chain of a cloud service during the procurement process. The choice of region is crucial during that assessment.

Building sovereignty into cloud governance

Good sovereign cloud governance in practice, starts with classification and ownership.

“Good governance begins by classifying workloads according to sensitivity and identifying the sovereignty controls each requires. It assigns ownership for identity, keys, data movement, provider access, resilience and regulatory evidence.”

Zero Trust principles then turn those governance decisions into controls that can be enforced, through explicit verification, least privilege, segmentation and continuous monitoring. 

Recovery and exit arrangement should be tested regularly for the organisation to have the necessary evidence that these work before they are needed during an emergency.

Most organisations will always depend on cloud providers to some degree. What matters is knowing where those dependencies are, accepting them deliberately, and keeping enough control to respond when conditions change.

Talk to NBConsult 

If you are evaluating sovereign cloud options or reviewing how your organisation controls identity, keys and data across its cloud services, speak to NBConsult today! 

*POPIA = South Africa’s Protection of Personal Information Act.