NBConsult says true sovereign cloud requires control over identities, encryption keys, operations and recovery, not just local data residency. According to Nicolas Blank, organisations should adopt governance that addresses technical, legal and AI-related dependencies to ensure genuine cloud sovereignty.
As South African organisations weigh up sovereign cloud offerings, many are still equating sovereignty with a single decision: choosing a local data centre region. According to Nicolas Blank, CTO of NBConsult, a division of Cyberlogic, that assumption doesn't hold up to scrutiny and it can leave businesses with the appearance of control rather than the substance of it.
Control, or just its appearance?
“It delivers real control only when sovereignty extends beyond data location,” says Blank. “A South African Azure region does not resolve who controls identities, encryption keys, privileged administration, software dependencies and recovery.”
He points to the US CLOUD Act as a practical illustration of why residency alone is not sovereignty: the law can compel covered US providers to produce data within their control, even when that data is physically stored abroad. For Blank, this means sovereignty must be measured across five dimensions: data, identity, operations, technology and jurisdiction, rather than one.
“Otherwise, local residency can create the appearance of control without changing the underlying dependency,” he says.
AI is raising the stakes
Blank believes AI is reshaping the sovereignty conversation in a fundamental way. “AI turns stored data into continuously processed, inferred and generated information,” he explains. “Organisations must now understand where prompts go, whether data trains models, which jurisdictions host inference, and who governs autonomous agents.”
This shift also changes where power sits in the market, he says, because AI concentrates control among the relatively small number of providers with the compute, models and data needed to operate at scale. He cites the EU AI Act as an early regulatory response to this concentration, noting that prohibited uses under the Act can carry significant penalties.
“Sovereign AI therefore requires governance of models, data, compute, identities and decisions and not merely sovereign hosting,” Blank says.
What POPIA actually requires
On the domestic regulatory picture, Blank is clear that South Africa's Protection of Personal Information Act (POPIA) does not rule offshore cloud out of bounds. “POPIA does not prohibit offshore cloud services,” he says. “It requires accountable processing, appropriate security and lawful cross-border transfers.”
For buyers, that translates into a set of specific questions that need answers before a contract is signed: where personal information is processed, which subcontractors can access it, what foreign laws apply to it, how breaches are handled, and whether information can be returned or deleted at the end of the relationship. Blank notes that penalties under the Act can be severe, including custodial sentences for certain offences.
“Cloud procurement must therefore evaluate the complete legal and operational chain, not simply select a South African region,” he says.
Building sovereignty into governance
Asked what good sovereign cloud governance looks like in practice, Blank sets out a starting point rooted in classification and ownership. “Good governance begins by classifying workloads according to sensitivity and identifying the sovereignty controls each requires,” he says. “It assigns ownership for identity, keys, data movement, provider access, resilience and regulatory evidence.”
From there, he argues, Zero Trust principles turn those governance decisions into enforceable controls through explicit verification, least privilege, segmentation and continuous monitoring. Organisations should also regularly test their recovery and exit arrangements, rather than assuming they will work when needed.
“Sovereignty is not the absence of dependency; it is knowing where dependency exists, consciously accepting it, and retaining credible control when conditions change,” Blank concludes. Ends
About NBConsult
NBConsult is a specialist cybersecurity and governance consultancy and a division of Cyberlogic, part of the Hyperclear Tech group. NBConsult works with organisations to strengthen their security posture, governance frameworks, and operational resilience against evolving cyber threats.
For more information:
Samantha Hogg-Brandjes | GinjaNinja | samantha@ginjaninja.co.za | +27-84-458-4857