What African and EU firms must know about data residency

Cloud platforms are now the primary building block for how organisations build and run digital services. As data crosses borders, questions about where it sits, who can reach it and which laws govern it have moved from a compliance detail to an architectural decision.

For organisations spanning Europe and South Africa, data residency and sovereignty already shape cloud architecture , risk management and regulatory strategy. Much of the rest of the continent is heading for the same reckoning as cloud adoption deepens.

Distributed systems make the problem harder. Gartner predicted that 75% of enterprise-generated data would be created and processed outside traditional centralised data centres by 2025, up from around 10% in 2018, driven by cloud, edge computing and AI workloads. As data decentralises, residency and sovereignty get harder to manage, and regulators are paying closer attention – GDPR and the Schrems II ruling in Europe, Popia and a widening set of frameworks across Africa.

For CIOs and CTOs, sovereignty has stopped being a compliance afterthought. It is a design decision.

Europe has one of the most developed regulatory regimes for data sovereignty. GDPR sets strict rules on how personal data is collected and processed, and requires cross-border transfers to offer protection equivalent to EU standards, through mechanisms such as standard contractual clauses and the transfer impact assessments introduced after the Schrems II ruling reshaped EU-US data flows in 2020.

Serious violations can draw fines of up to €20-million or 4% of global annual turnover, whichever is higher. The EU Data Act and AI Act push expectations further on transparency, access governance and the use of AI training data.

African data protection regulation is moving quickly. More than 40 African countries have enacted national data protection laws, and most now have a regulator in place. South Africa’s Protection of Personal Information Act (Popia), Nigeria’s Data Protection Act and Kenya’s Data Protection Act are among the frameworks shaping how organisations handle personal data and cross-border transfers.

Unlike the EU’s single regime, Africa’s rules differ country by country on residency, transfers and oversight. For a multinational, one residency decision has to satisfy several regimes at once.

“Because of the proximity of nations within the African region, the collaborative effort in cross-border business, and the growing proliferation of cloud on the continent, it will be interesting to see how these data protection laws are not only tested, but enacted as the continent takes its seat as a global citizen,” said BBD CIO and head of cloud managed services Tony van der Linden.

Delivery location is part of the conversation too. Organisations have to weigh where data is stored and where the teams building and running those systems sit. That is one reason South Africa has become a trusted delivery location for international technology services, combining Popia’s protections, a mature financial and regulatory environment and close time-zone alignment with Europe.