Our data, our sovereignty: Why South Africa must own hyperscale data centres

IN THE digital economy, data is often described as the new oil. Unlike oil, data cannot simply be extracted, traded, and refined without exposing nations to profound risks. For as long as South Africa's and Africa’s data resides in hyperscale data centres owned by the United States or China, that data is not safe from infiltration by either power.

- LUVO GREY

The uncomfortable truth is that both Washington and Beijing have given themselves the legal instruments to pry into the data stored by their technology giants, whether that data belongs to their citizens or not.

In 2018, the United States passed the Cloud Act (Clarifying Lawful Overseas Use of Data Act). This legislation compels US-based technology companies including Microsoft (Azure), Amazon (AWS), Google, and others, to essentially hand over data under their control if requested by U.S. law enforcement or intelligence agencies, even if that data is physically stored on servers outside the US.

In practice, this means that African government records, corporate intellectual property, and even personal health information stored in US-owned hyperscale facilities are subject to foreign scrutiny.

China has gone even further. Under its National Intelligence Law (2017) and Cybersecurity Law (2016), Chinese companies, including Huawei Cloud and Alibaba Cloud, are legally obligated to provide the Chinese state with any data relevant to “national security” This includes data stored outside China, giving Beijing direct leverage over African states and enterprises using Chinese hyperscale facilities.

In both cases, sovereignty is compromised. Data that should be protected as a national asset becomes vulnerable to foreign intelligence operations, with no guarantee of transparency or recourse.

South Africa once recognised this risk. In 2021, a bold draft legislation on electronic communications and digital infrastructure envisioned a state-led framework where government would exercise direct oversight over data localisation and the control of critical information flows. This draft proposed mechanisms that would have kept sovereignty intact, ensuring that South African data remained governed by South African law, with the state playing a central role in enforcement.