Data sovereignty is not a demand that every byte remain at home. It is the power to govern access, encryption, transfer, audit and exit.
Sovereignty requires control, not isolation
African governments need cloud and AI services, but dependence becomes strategic risk when officials cannot determine where sensitive data are stored, who can access them or how the state can leave a vendor.
The African Union’s data and AI strategies call for stronger national governance and regional cooperation, while UNCTAD stresses compatibility between protection rules and legitimate international data flows.
Seven minimum rules should apply to public and critical-sector contracts: classification of data before migration; state control of encryption keys for the most sensitive workloads; auditable access logs; breach-notification deadlines; restrictions on secondary AI training; transparent subcontractors and jurisdictions; tested portability and deletion at contract end.
Local storage alone is insufficient
A data centre inside the country can still be remotely administered, dependent on foreign software or subject to contractual access that officials do not understand. Conversely, properly encrypted and governed data stored abroad may be more resilient than a vulnerable local facility. Regulation should therefore be risk-based rather than driven by slogans.
Independent data-protection authorities need investigative power, technical staff and sanctions. Critical systems should undergo resilience tests, including loss of international connectivity, cloud-region failure and vendor withdrawal. Governments should also require open formats and documented interfaces so public records can migrate.
WARYATV Assessment
Africa’s strongest sovereignty principle is not “localize everything.” It is “no public institution should lose lawful control of its data, keys or continuity.” States that sign cheap, closed cloud contracts may discover later that switching provider is technically and financially impossible.
Procurement law should make data ownership, encryption, audit and exit rights non-negotiable. Regional standards would give smaller markets greater bargaining power and reduce compliance fragmentation.
