The question of who controls data, and where it resides, has become one of the most pressing strategic issues for multinational organisations operating across Africa.
By Sunil Geness, director: global government affairs and CSR Africa, global sustainability lead Africa at SAP
Data sovereignty, the principle that data generated within a country is subject to its national laws, is reshaping how technology companies invest in infrastructure, build partnerships, and serve customers.
For global businesses accustomed to cloud-first, centralised operating models, Africa’s shift towards data localisation marks a profound inflection point. With 39 African countries now having enacted data protection laws and 36 African Union members maintaining some form of regulation, multinational organisations can no longer rely solely on global infrastructure strategies. Instead, they must adapt to an environment that increasingly demands localised, hybrid approaches.
Navigating a fragmented regulatory landscape
The first and perhaps greatest challenge for multinational organisations lies in Africa’s fragmented regulatory environment. While nearly every major economy on the continent has implemented or drafted data protection legislation, the rules differ significantly. Nigeria enforces strict localisation for economic reasons; South Africa’s Protection of Personal Information Act (POPIA) permits cross-border transfers under defined conditions; and Kenya restricts the transfer of “public data” without prior authorisation.
This creates a complex compliance puzzle for multinational organisations operating across multiple jurisdictions. Building scalable business models in such a landscape is no easy task, especially when paired with Africa’s acute infrastructure deficit. Despite hosting 17% of the world’s population, Africa accounts for less than 1% of colocation data centre capacity. The continent averages only 0,1 data centres per 1-million internet users, compared to a global benchmark of 0,9.
The concentration of facilities in a handful of markets, with Nigeria, Kenya, and South Africa together hosting about 60% of sub-Saharan Africa’s commercial data centres, further complicates compliance for companies operating regionally. For many multinational organisations, the choice is stark: absorb the costs of building local processing capabilities or establish partnerships with local providers and hyperscalers.
Either way, global operating models must be re-engineered to align with Africa’s sovereignty-first trajectory.
Localisation as trust, performance driver
While compliance drives much of the conversation, local data hosting is not simply about avoiding regulatory penalties. It is also a source of competitive advantage. Locally hosted services can reduce latency by up to threefold, with websites loading in 1.8 seconds compared to over 4 seconds for content hosted overseas.
This matters in markets like South Africa, where more than half of users abandon a website that takes longer than three seconds to load.
For fintech platforms and other data-intensive services, the stakes are even higher. Localised hosting supports real-time payments, bolsters security, and ensures that sensitive data never leaves the jurisdiction, improving both performance and resilience.
The benefits extend beyond technology to trust: consumers feel more secure knowing their personal data is protected under national regulations, and businesses demonstrate accountability to regulators and customers alike.
Governments are reinforcing these dynamics by tightening compliance requirements. South Africa’s National Data and Cloud Policy, for instance, mandates that government data must be hosted domestically and requires providers to meet stringent uptime and self-sufficiency standards.
These measures are catalysing large-scale investments by global cloud leaders such as Google, Amazon, and Microsoft, which have all launched or expanded local cloud regions in Africa.
The result is a virtuous cycle: stronger regulation drives investment in infrastructure, which in turn enhances service quality and strengthens consumer confidence in the digital economy.
Local, global – or both
Multinational organisations now face critical strategic choices in balancing local sovereignty requirements with global operational efficiency. Localised data centres offer regulatory compliance, lower latency, and stronger security. They also contribute to broader economic goals, creating jobs, developing technology skills, and supporting GDP growth.
However, these benefits come at a cost. Local centres often face higher operational expenses, challenges in ensuring reliable power and connectivity, and potential limitations in redundancy compared to international cloud platforms.
By contrast, global hyperscale solutions offer scalability, redundancy, and access to cutting-edge innovations. But they expose companies to compliance risks under evolving sovereignty laws and potential geopolitical vulnerabilities if foreign jurisdictions exert influence over data governance.
The emerging solution is a hybrid model. Across the continent, MNOs and technology providers are adopting multi-cloud strategies, storing sovereignty-sensitive workloads locally while relying on global platforms for less regulated activities. This approach allows them to maintain compliance, build resilience, and continue leveraging international expertise and scale.
Regional cooperation will be critical to making this balance sustainable. Initiatives such as the African Union’s Malabo Convention and frameworks from ECOWAS, EAC, and SADC aim to harmonise standards and reduce the complexity of cross-border data flows. If successful, these efforts will help unlock Africa’s digital potential, enabling smoother partnerships between local players and global providers.
Africa’s data sovereignty movement is a defining force shaping the continent’s digital future. For multinational organisations and technology companies, success depends on the ability to localise without losing global efficiency, to build trust while maintaining innovation, and to invest strategically in infrastructure and partnerships that align with both regulatory demands and customer expectations.
The stakes are high. Africa’s data centre market is projected to grow to over US$9 billion by 2029, yet it remains only a fraction of the global total. Organisations that embrace sovereignty as a catalyst rather than a constraint will not only secure compliance but also position themselves at the forefront of Africa’s digital transformation.