Privacy guide
POPIA and cloud software hosted outside South Africa
Section 72 does not stop you using an overseas provider. It does mean you have to know where your data goes and be able to say so.
Almost every cloud product a South African business buys stores data abroad. POPIA permits that. What it does not permit is not knowing, and not being able to explain it when somebody asks.
What section 72 actually says
Section 72 of the Protection of Personal Information Act 4 of 2013 governs sending personal information outside the Republic. It permits the transfer where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, or where the data subject consents, or where the transfer is necessary for performance of a contract.
In practice, for a business buying cloud software, the route is almost always the binding agreement. The provider's data processing terms commit them to a standard of protection, and those terms are what you rely on.
There is no residency requirement
POPIA does not require personal information to be stored in South Africa. This is a common misunderstanding, sometimes encouraged by vendors selling local hosting.
Local hosting can be a good thing for latency or for a specific contractual requirement, but it is not a legal obligation under POPIA. Do not pay a premium for it believing you have to.
What you actually have to do
Know where the data goes. Get the provider to tell you which region hosts your data and keep the answer. Read the data processing terms, or at least confirm they exist and that they bind the provider to a protection standard.
Then reflect it in your own privacy notice. If you tell customers their information stays in South Africa when your payroll runs on infrastructure abroad, the problem is not the transfer, it is the statement you made about it.
The questions worth putting to a vendor
Which region stores our data, and can you confirm that in writing. Do you have data processing terms and where are they published. Do you use subprocessors, and are they listed. What is your breach notification commitment and how quickly would we hear.
A provider serving business customers will answer all of these quickly because they are asked constantly. A provider that cannot answer them has told you something useful.
Where the real risk usually sits
In most small businesses the cross border question is the least of it. The greater exposure is a spreadsheet of employee salaries on somebody's laptop, a shared login to the payroll, or a former employee whose access was never removed.
Cloud providers generally have better security than the business buying from them. Spend your attention on access control, on removing leavers promptly, and on who in your organisation can export the whole employee database.
Keep a short record of what you decided
Write down, in a page, which systems hold personal information, where each one processes it, and what you relied on to permit the transfer. That is your answer if the Information Regulator ever asks, and it takes an hour to produce.
Review it when you add a system. Most compliance failures here are not decisions taken badly, they are systems adopted by one team that nobody else knew about.
Common questions
01Does POPIA require data to be stored in South Africa?
No. There is no data residency requirement. Section 72 permits cross border transfer where an adequate level of protection applies, which for cloud software is usually established through the provider's data processing terms.
02Can I use Xero or QuickBooks under POPIA?
Yes. Both store data outside South Africa and both publish data processing terms. Your obligation is to know where the data goes, rely on those terms, and describe it accurately in your own privacy notice.
03Who is responsible if my cloud provider has a breach?
You remain the responsible party towards the people whose information it is. The provider is your operator and is bound by your agreement with them, but the duty to notify the Information Regulator and affected people sits with you.
Editorial note
This guide is general buying guidance and not accounting, legal or tax advice. Amounts and deadlines set by SARS change, so confirm the current figures for your own business before you rely on them.