3 September 2026LANTEK Computers
Nobody asks where the cloud is until somebody in a tender or a due diligence questionnaire asks them. Then it becomes urgent, and the honest answer is usually that nobody knows.
This is not legal advice, and the cross-border question in particular is one for your attorney.
What POPIA actually says about sending information abroad
POPIA restricts transferring personal information about somebody to a third party in another country, unless one of a set of conditions is met.
The conditions, in general terms, include: the recipient being subject to a law or agreement that provides an adequate level of protection comparable to POPIA, the person having consented, the transfer being necessary to perform a contract with them, or it being for their benefit and consent being impracticable to obtain.
Two things follow that matter more than the detail.
It is a restriction, not a prohibition. Using an international cloud service is not automatically a breach. Most reputable providers address this contractually, and that contract is the mechanism most businesses actually rely on.
It is your obligation, not the provider’s. The cloud company is a processor acting on your instruction. The duty to have a basis for the transfer sits with you, which is why the answer is a document rather than a setting.
Why we are not listing which providers have local regions
The obvious next question is which services keep data in South Africa.
We are not answering it here, deliberately. The major providers have added and expanded regions in South Africa, but which specific services are available in a given region, and where a particular workload’s data actually sits, changes over time and differs by service within the same provider. A list printed today would be partly wrong within a year, and being confidently wrong about this is worse than telling you to check.
What is durable is knowing what to ask, and getting it in writing.
The questions to put to a provider
Ask these of whoever supplies the service, and keep the answers. If your IT provider resells it, ask them and expect them to find out rather than guess.
In which country is our data stored at rest? Note at rest. It is the specific question, and a vague answer about a global network is not an answer.
Where are the backups? Frequently a different answer to the primary storage, and frequently in another country for resilience reasons. Legitimate, and it is part of the picture.
Who can access it, and from where? Support staff in other countries accessing your data to help you is a transfer, even if the data never moves. This is the part most often overlooked.
Is there a data processing agreement, and does it address cross-border transfer? Reputable providers have one. Ask for the current version rather than assuming the one signed three years ago still governs.
Can we choose the region, and what does choosing cost or limit? Sometimes a local region is available but a feature you rely on is not available in it. That is a genuine trade-off and worth knowing before rather than after.
What happens on exit? How you get your data out, in what format, and how long they keep it afterwards.
Where it matters more than usual
For most businesses this is a documentation exercise rather than a design constraint. It becomes a design constraint in a few situations:
Public sector work, or supplying somebody who does, where tenders increasingly ask directly. Regulated sectors with their own rules on top of POPIA. Anything holding health information or other more sensitive categories, which raises the general standard. And contracts where a client has imposed a residency requirement of their own, which is now common enough to expect.
If any of those apply, establish the position before choosing the service rather than after.
What to actually do
Write down where things are. One page listing each cloud service you use, what personal information is in it, which country it is stored in, and where the agreement is filed. This is the document that answers a questionnaire in five minutes instead of two weeks, and it slots straight into the inventory described in what POPIA requires from a business with no IT department.
Keep the processing agreements. Not a link to them. A copy, with the date.
Make your privacy notice honest about it. If personal information may be processed outside South Africa, say so.
Take advice once, properly. An hour with your attorney establishing which condition you are relying on for your main services is worth considerably more than repeated worrying, and it produces the written basis you would need if asked.
The thing to be careful of
Suppliers occasionally use data residency as a selling point in a way that implies international services are non-compliant. They are not, and the implication is misleading. The requirement is that a basis for the transfer exists, not that the data stays inside the borders.
Equally, be careful of the opposite: a supplier who cannot tell you which country your data is in and treats the question as unnecessary. That is not compliance confidence, that is not knowing.
The wider compliance picture is on Compliant by design and the services on Cloud Computing. If a client questionnaire has landed and you need the answers assembled, that is something we can help with.