Guide
Local hosting, data residency and POPIA: what backup buyers must ask
Data residency is a legitimate concern. Here is how to ask the right questions — and how to tell a real answer from a marketing claim.
For South African organisations — and the MSPs that serve them — where backup data is stored is a practical, regulatory and governance concern. POPIA does not mandate local storage outright, but it does create conditions under which local data residency becomes the simplest way to demonstrate control.
What POPIA actually says about data transfers
Section 72 of POPIA restricts the transfer of personal information outside South Africa unless certain conditions are met — such as the recipient being subject to comparable law, binding agreements, or the data subject's consent. In practice, this means organisations must either ensure adequate cross-border protections or keep data within South African borders.
Local storage does not automatically satisfy POPIA — compliance requires lawful basis, purpose limitation, security safeguards, breach notification and governance. But local storage does remove the cross-border transfer question from the compliance conversation, which simplifies it considerably.
Questions to ask any backup provider
- Where is backup data stored at rest? Name the specific facilities.
- Does data leave the country during processing, replication or management?
- Who has access to the encryption keys?
- What certifications do the hosting facilities hold?
- What happens to data if the contract ends — is it deleted, returned or retained?
- Can the provider produce a written data-processing agreement that addresses POPIA's conditions?
The difference between local and locally hosted
"Local" can mean many things: a local sales office, a local support desk, or local infrastructure. The question that matters for data residency is where the data physically resides at rest. Ask for the name and location of the data-centre facility — not just the country.
Where Soteria Cloud fits
Soteria Cloud's backup infrastructure is hosted in Teraco data centres in Johannesburg and Cape Town. Teraco is Africa's largest carrier-neutral colocation provider, and its facilities are ISO 27001-certified. Data stored through Soteria Cloud resides within South African borders.
Soteria Cloud does not claim that local hosting alone constitutes POPIA compliance. It is one element of a broader compliance programme that includes encryption (AES-256 in transit and at rest), access controls, data-processing agreements and governance.
Frequently asked questions
Does local hosting guarantee POPIA compliance?
No. POPIA compliance requires a full set of organisational and technical controls — lawful basis for processing, purpose limitation, security safeguards, breach notification and more. Local hosting supports the data-residency element, but compliance is a broader programme, not a product feature.
Where does Soteria Cloud store backup data?
Backup and recovery data is stored on Soteria Cloud infrastructure hosted in Teraco data centres in Johannesburg and Cape Town. Teraco facilities are ISO 27001-certified and carrier-neutral.
Can data leave South Africa during processing?
The distinction matters: where data is stored at rest versus where it may travel during processing or management. Ask any provider to confirm both, and document the answers for governance records.
Keep your backup data in South Africa
Explore Soteria Cloud's local infrastructure and data-residency approach.