Data sovereignty: where your business data really lives
Data sovereignty is the principle that data is subject to the laws of the place where it is held, and of the company that holds it. For a South African business, that turns into three practical questions: where is our customers' information stored, which country's law applies to it, and who could be required to hand it over? The answers depend less on where your own office is than on which provider runs your email, files and systems. This article explains what South African and European law say about data abroad, how a foreign law can reach data held outside its borders, and what choosing an independent host changes.
Your provider is part of your data
Under the Protection of Personal Information Act (POPIA), the business that decides why and how personal information is processed is the responsible party. A hosting or software provider that holds it on the business's behalf is an operator. Three duties follow, whoever the provider is:
- Security safeguards (section 19). The business must protect the personal information it holds or controls with appropriate, reasonable technical and organisational measures, identify foreseeable risks, and check the safeguards regularly.
- A written contract with the operator (section 21). The contract must require the provider to keep those safeguards, and the provider must tell the business immediately if it has reason to believe the information was accessed without authority.
- Openness about transfers (section 18). When collecting information, the business must tell people, where it applies, that it intends to send it to another country, and the level of protection there.
Sending data abroad: POPIA section 72
Section 72 of POPIA allows personal information to be sent to a third party in a foreign country only in set cases:
- the recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA's, including on onward transfers
- the person the information is about consents
- the transfer is needed to perform a contract with that person, or steps they asked for before one
- it is needed for a contract made in that person's interest with someone else
- it benefits the person, consent is not reasonably practicable, and they would be likely to give it
A transfer that does not meet one of these is itself an interference with the protection of personal information under section 73, which can be the subject of a complaint to the Information Regulator. The Regulator's 2024/25 annual report says it is working on guidance about how adequate protection in another country should be assessed.
When the law follows the provider
Where a server sits is only part of the answer. Laws in several countries let authorities require a provider to disclose data that is in its possession or control, wherever that data is stored.
The United States CLOUD Act is a well-documented example. According to the US Department of Justice, it confirmed that a provider subject to US jurisdiction must disclose communications and records within its possession, custody or control, whether they are stored inside or outside the United States. The same Department of Justice paper makes a point worth keeping in proportion: many governments have comparable powers over providers in their own jurisdictions, and countries that are party to the Budapest Convention on cybercrime are required to have them.
The practical consequence is simple. A business's data is subject to the laws of the country where it is held, and also to the laws that apply to the company holding it. Choosing a provider is choosing those laws.
If you have European customers
For personal data from the European Union, the General Data Protection Regulation (GDPR) applies its own rules in Chapter V. A transfer out of the European Economic Area is simplest to a country with an adequacy decision from the European Commission. South Africa does not have one, so transfers from the EU to South Africa rely on safeguards such as standard contractual clauses, or on the narrow exceptions in Article 49. Article 48 adds that a court or authority in a non-EU country cannot on its own authority require disclosure of EU personal data; such an order is recognised only where it rests on an international agreement, such as a mutual legal assistance treaty.
What independent hosting changes
An independent host is a named company that runs its own servers, under terms you can read. It does not remove the law; it makes the law knowable. For Noiz, that means:
- A named company. Noiz Cybersecurity (Pty) Ltd, with tickets answered by the people who run the servers.
- Software you can take with you. Our services are built on GNU/Linux and free and open-source software, so a client is never locked into a proprietary system it cannot leave.
- Systems you can run yourself. Because the software is free, you can host it yourself, and then you decide where the data lives.
Data sovereignty is not only about one provider. Email, files, accounting, chat and backups each have a provider, and each sits somewhere. A business that knows where every one of them is, and under which law, is in a far better position to keep its customers' trust and its POPIA obligations.
A short check for your business
- List each system that holds customer or staff information.
- For each, write down the provider, the country of the provider and the country where the data is stored.
- Check that you have a written contract with each provider that covers security and breach notification.
- Where data goes abroad, note which section 72 ground applies, and whether your privacy notice says so.
Our About page sets out who Noiz is and the values behind how it runs, and a ticket reaches the people who run the servers.
Sources
Checked 19 October 2026.
South Africa
- Protection of Personal Information Act 4 of 2013: sections 18 to 21 and 72 to 74
- Information Regulator: POPIA
- Information Regulator Annual Report 2024/25, section 2.1.5.2
United States
- US Department of Justice: CLOUD Act white paper (2019)
- US Department of Justice: CLOUD Act resources
European Union and Ireland
- Data Protection Commission: transfers to third countries
- EDPB Guidelines 02/2024 on Article 48 GDPR
- European Commission: adequacy decisions
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
