Регуляторы Африки ужесточают правила трансграничной передачи данных для защиты информации от ИИ

From Nigeria to Kenya and South Africa, regulators are introducing rules requiring certain categories of sensitive information to remain within national borders or imposing stricter conditions on their transfer abroad. The push reflects a broader concern: as data becomes increasingly valuable to artificial intelligence, governments want greater control over the information generated by their citizens, businesses and public institutions. For global cloud providers, that creates a difficult market to navigate. AI systems need access to large volumes of data to be useful, but the same data is increasingly subject to rules about where it can be stored, processed and accessed. Amazon Web Services (AWS) is betting that it can resolve that tension, giving African organisations access to AI and global cloud infrastructure while allowing them to retain control over sensitive data. The strategy is becoming central to AWS’s pitch to African enterprises. Rather than treating data sovereignty as a barrier to cloud adoption, the company is presenting it as something that can be built into cloud service architecture. But localisation comes with costs. Keeping data in-country can reduce latency to below 15 milliseconds, which is valuable for real-time services such as banking and payments. Yet local hosting can also be more expensive, particularly in markets where unreliable power supplies force data centres to rely on costly backup generation. Companies facing strict localisation rules may also need hybrid setups that keep sensitive data locally while accessing AI tools and other services from infrastructure abroad, adding to their infrastructure and licensing costs. The complexity increases for businesses operating across Africa’s 54 markets. Different rules under Nigeria’s NDPA, South Africa’s POPIA and Kenya’s Data Protection Act can require companies to manage separate compliance and risk requirements in each market. Using sovereign cloud products such as AWS Outposts or Azure Local can also increase reliance on the platforms and APIs of major cloud providers. At the AWS Summit in Johannesburg on August 19, Jonathan Allen, AWS executive in residence, said the company is focused on complying with the laws of the more than 100 countries where it operates and adapting its infrastructure to meet local requirements. “We’re always focused on complying with the laws of the countries in which we operate,” Allen said. That may sound like a straightforward commitment to regulation, but it reflects a broader shift in the cloud market. Governments are no longer asking only whether cloud providers can secure their data; they increasingly want control over where data is stored, who can access it, which laws apply, and how it is governed. Nigeria is one of the clearest examples. The Central Bank of Nigeria has introduced data-localisation and market-oversight requirements for the payments sector, putting greater pressure on financial institutions to demonstrate control over how sensitive data is stored and managed. The same push is taking shape across other major African markets, although the rules vary. South Africa has called for greater local control over strategic government and public-service data through its National Policy on Data and Cloud, while POPIA places conditions on the cross-border transfer of personal information. Kenya has adopted a more targeted approach, requiring certain sensitive data, including civil-registration records, to be processed or stored locally and imposing safeguards on cross-border transfers. Rwanda has gone further in critical sectors, with localisation requirements covering sensitive financial, payment and telecommunications data. Together, these policies point to a broader shift: African governments increasingly see data as strategic infrastructure rather than simply a business asset, and are seeking greater control over how it is stored, processed and transferred. That is making data sovereignty an increasingly important part of the operating environment for technology companies on the continent. For AWS, the response is what it calls a “sovereign-by-design” approach. The company says its cloud infrastructure gives customers greater control over where their data is stored and processed, how it is encrypted, and who can access sensitive information. AWS’s infrastructure includes Local Zones and Outposts, while its Nitro System provides hardware-based isolation for workloads running on Amazon EC2. Customers can also use customer-managed encryption keys, including options that keep cryptographic material outside AWS’s control. The significance is not simply that AWS has added more security features. It is that the company is trying to separate using global cloud infrastructure from giving up control of data. That distinction matters as AI becomes embedded in everyday business operations. Fred Kitunga, chief information officer at Kenya Airways, is seeing that shift firsthand. The airline is increasingly looking at AI and data not as isolated IT projects but as tools for making better business decisions — from determining flight profitability to understanding customers and responding to cybersecurity threats. “We are looking at how we can transform the business in terms of the strategic intent,” Kitunga told TechCabal on the sidelines of the AWS Summit. “We don’t look at what technologies we can deploy. It’s what business problems are then resolved.” That approach requires access to reliable organisational data. But Kenya Airways operates across borders, with customers and operations spanning multiple jurisdictions. Kitunga said the airline therefore relies on international data protection standards while maintaining a board-level policy governing data and AI. “We leverage more on GDPR global standards that are there,” he said. His comments illustrate why Africa’s sovereignty debate is more complex than simply demanding that all data remain within national borders. For a multinational company, the challenge is often not to keep every piece of information physically within one country. It is to know which data is subject to which rules and to have enough technical and organisational controls to demonstrate compliance. That is the gap AWS says it wants to fill. The company wants enterprises to believe they can use the computing power and AI capabilities of a global cloud provider while retaining control over sensitive workloads. In AWS’s model, sovereignty becomes a question of architecture and governance rather than simply geography. But that proposition will face growing scrutiny. As AI systems become more powerful, the data they consume becomes more strategically important. Financial records, identity information, health data, government databases, and customer histories can all serve as inputs to AI systems. Governments, therefore, have a stronger incentive to regulate not only where that information is stored but also how it is processed. That is particularly important for financial institutions. AWS says its cloud infrastructure is built to meet the security and compliance needs of highly regulated organisations. The company has operated in Nigeria since opening its Lagos office in 2022 and has invested in local infrastructure, including an AWS Local Zone. It also says it has trained more than 180,000 Nigerians in cloud skills since 2017. But a local presence does not resolve the bigger question facing global cloud providers: who controls the infrastructure and data that increasingly underpin national economies? As governments place greater value on data sovereignty, cloud companies are having to offer customers more control over where data is stored, how it is accessed and which laws govern it. AWS is not alone in adapting to this shift. Microsoft has built its sovereignty strategy around several models, including Sovereign Public Cloud, Sovereign Private Cloud through Azure Local, and National Partner Cloud. These options are designed to help governments and businesses keep sensitive workloads within required jurisdictions while still accessing Microsoft’s wider cloud services. Google Cloud takes a similar approach through its Data Boundary and Google Distributed Cloud offerings. Customers can control encryption keys and restrict where data is stored or transferred, while more sensitive workloads can run on infrastructure deployed on-premises or in isolated environments. Huawei Cloud puts greater emphasis on local infrastructure and control. Its model involves deploying dedicated cloud infrastructure within a country, with local operations and controls governing data storage, logging and deletion. The aim is to keep sensitive data within national borders and meet local sovereignty requirements. Oracle has taken another route, allowing telecommunications companies, financial institutions and governments to run dedicated cloud environments within their own facilities or through local partners. These deployments are designed to keep data and cloud operations within the required jurisdiction while remaining compatible with Oracle’s broader cloud ecosystem. For AWS, the challenge is to make its global cloud model flexible enough to accommodate these different national requirements. Allen pointed to Europe as an example where AWS has developed cloud infrastructure tailored to specific regional sovereignty needs. The same approach could become increasingly important as African governments demand greater control over the data and infrastructure supporting their digital economies. “We operate in well over 100 different countries around the world,” he said. “When you look at Europe, for example, we have specifically created the European Sovereign Cloud to meet those specific needs. And we continue to evaluate all countries and areas as we operate around the world to address their specific needs and concerns.” The approach is likely to become increasingly important in Africa as governments develop their own digital sovereignty frameworks. But there is a tension here. Strong localisation rules can give governments greater control over sensitive information, but they can also raise the cost of cloud services and make it harder for businesses to access global infrastructure and AI capabilities. Fragmented rules across 54 countries could also make it more difficult for African companies to scale digital products across borders. For governments, the challenge is therefore to protect strategic data without creating a digital environment so restrictive that it limits innovation. For AWS, the opportunity is to show governments that data sovereignty and AI adoption do not have to be competing goals. Its new Forward Deployed Engineering organisation, backed by a $1 billion investment, is designed to put AWS engineers alongside enterprise teams to move AI projects into production faster. In Africa’s highly regulated markets, that proposition matters because deploying AI requires more than a powerful model; it also requires strong data governance, security and compliance. Africa’s AI ambitions will depend on access to computing power, data and infrastructure at scale. Governments therefore need to protect sensitive information without making cloud services too expensive or creating 54 separate digital markets. A practical approach would be to localise genuinely sensitive data, control how it moves across borders and give organisations clear tools to demonstrate where and how their data is being used. For AWS and its rivals, sovereignty is becoming a competitive advantage, not just a compliance issue. The providers that can give African businesses access to global AI capabilities while meeting local data requirements will be better positioned for the next wave of cloud growth. For Africa, the goal should be to make data sovereignty a foundation for AI adoption and local digital capacity, rather than a rule that slows both down. True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.