Storing data locally does not automatically guarantee data sovereignty. During a panel discussion titled: Borderless business, local data: Navigating data sovereignty in 2026, top IT leaders unpacked how to balance global cloud scale with strict local compliance under Popia and GDPR.
In the session featuring Lonwabo Malghas, head of IT at Kagiso Trust and Thandeka Mcoki, senior global information security and GRC specialist at Cloud Essentials, Virgin Active’s chief digital officer Ankit Shah shared how the global fitness firm manages its data across 10 countries’ AI and digital tools from one central place, while following different rules in each market.
For Ankit, protecting data across borders means looking after it at every stage, with good governance, clear tracking and clear responsibility.
He explained that data sovereignty centres on who holds access and control rather than just physical location. For Virgin Active, managing data across 10 distinct jurisdictions requires balancing central operational scale with strict local compliance.
“When data moves from South Africa into a North European Azure data centre, we must ensure every movement is recorded, explainable, and every person accessing it is governed. We do not want to stop data from moving or prevent central capability, but everyone accessing that information must remain accountable.”
Virgin Active has to work within different data laws, including South Africa’s Protection of Personal Information Act (Popia), Europe’s General Data Protection Regulation (GDPR) and the Australian Privacy Act. To manage this, it keeps its company-wide operating standards separate from the legal decisions made in each region.
Central teams run the core platforms so that clubs around the world have a consistent experience, while each country operates as its own legal entity. Cross-border data privacy agreements and non-disclosure agreements (NDAs) set out the legal ground rules, which lets South Africa process data on behalf of European entities, and the other way around.
Distinguishing sovereignty, residency, and localisation
Adding to the debate on data sovereignty, Thandeka said it’s important to untangle three terms that are frequently used interchangeably: data localisation, data residency, and data sovereignty.
Data localisation refers to where data is legally required to remain, such as statutory mandates requiring specific data never to cross South African borders. While data residency refers strictly to physical location and data sovereignty determines which legal jurisdictions and regulations govern data based on where it sits and its localisation rules.
“Data residency does not equate to data sovereignty. You can have your data in a South African data centre and that would immediately check your data residency box, but it will not check your data sovereignty because that becomes a much more complex concept to navigate. You start having to look at things like who's operating the infrastructure, who controls the services, where administrators are located, where backups sit, and what foreign laws apply to security telemetry and metadata,” she told attendees.
Rather than creating costly “sovereignty silos” that duplicate datasets and inflate storage expenses, organisations require a modular, jurisdictionally intelligent architecture capable of applying region-specific controls across a globally connected ecosystem.
Protecting the entire data journey
Securing cross-border workflows requires shifting focus from static database security to safeguarding the full data journey. Ankit identified five critical checks every technology leader must answer before granting cross-border access: Who holds ultimate control over the data, who oversees access management, can access be revoked immediately if needed, does the organisation possess capabilities to detect and control data exploitation and are third-party partners equally compliant?
Highlighting that cross-border evaluation cannot be a one-size-fits-all exercise, Lonwabo noted that governance hinges on precise categorisation. “It comes down to a risk-aware classification process: identifying which data must remain strictly under internal organisational control and which data can be safely processed by third-party providers.”
Throughout the discussion, Thandeka was firm in her position that South Africa and Africa possesses rich data insights that must be protected from “data colonisation”.
“I will leave you with one question to ponder: if African organisations produce such enormous amounts of data, yet that data is processed, stored and economically exploited in other regions, what does data sovereignty actually mean?”
She emphasised that understanding who benefits from the data is often overlooked. “Once you have that clear picture of what that is, it will shift your focus from just data location to data movement. And it will force you to treat your data movement as more than just the compliance tick box or an IT tick box and treat it as an essential critical business process.”
