Data sovereignty without infrastructure sovereignty is legal fiction

Johannesburg, 02 Jun 2026
Augustine Tumi Mogashoa, Director of IT and Business Continuity Management Specialist, ASQE (Image: Supplied)
Augustine Tumi Mogashoa, Director of IT and Business Continuity Management Specialist, ASQE (Image: Supplied)

Africa currently hosts only 0.6% of the global data centre capacity at 360MW. Currently, 238MW are under construction, with an additional 656MW planned, but, says the report, this growth doesn’t deliver any gains in share, it simply keeps the existing balance intact.[1] South Africa’s data centre presence hosts around 408MW of capacity and remains the largest on the continent, ahead of Nigeria, Kenya, Egypt and Morocco.[2] And within this, only South Africa currently hosts four AI-focused data centres and only two of them are capable of training large models. While this puts the country in the top 13 globally and makes it Africa’s primary AI-capable infrastructure hub, it still isn’t enough.[3]

“South Africa may be closer to the centre of Africa’s AI future than many realise, but the infrastructure needed to ensure that data and AI sovereignty remain a reality is still not sufficient,” says Augustine Tumi Mogashoa, IT and Business Continuity Management Specialist at ASQE. “Sovereignty doesn’t live in laws, compliance documents or server locations exclusively, it also resides in cables, chips, clouds, data centres, grids, recovery plans, cyber security controls and the power required to keep systems running when disruption hits.”

Over the past few years, the digital sovereignty debate has primarily focused on where the data lives. Who hosts it? Where is it stored? While these are still important questions, AI has changed the nuance significantly. While a country may host its data locally or a company may meet its residency requirements, if the infrastructure below that data is fragile or controlled by foreign entities, then how sovereign is it?

“If countries don’t have reliable power and grid capacity for AI data centres, then the definition of sovereign is only as far as infrastructure can hold it,” says Mogashoa. “Currently, the physical stack for African AI is being built largely by foreign hyperscalers, even when facilities sit on African soil. And this limits true infrastructure sovereignty as well.”

South Africa is at a crossroads. The country is at a point where it needs to decide whether it becomes a passive landing zone for imported digital infrastructure or whether it becomes the resilience layer for Africa’s digital economy. It’s also what many leaders miss – South Africa shouldn’t be the server room for Africa, it should become the resilience layer for Africa’s digital economy.

“Data residency defines where the information lives, but infrastructure sovereignty determines whether or not it can survive,” says Mogashoa. “It’s a distinction that should matter to every CIO, CISO, CDO and board member, because so many companies are modernising and migrating to the cloud or experimenting with AI, but few can answer the hard questions.”

These questions come down to understanding what cloud environments support critical workloads and what controls recovery pathways. What jurisdictions influence platforms and how dependent is the business on specific vendors, connectivity routes, data centres or compute providers? And what happens to the organisation’s AI strategy if access to infrastructure is constrained or compromised?

It is essential that South African companies look deeper into their infrastructure and gain an understanding of the invisible dependencies that they rely on, often without realising, and that can have a serious impact on their sovereignty requirements and expectations. For the CISO, it is a security question where third-party infrastructure risk is a priority. For the CDO, data that cannot be securely processed or reliably accessed during disruption is a stranded asset. And for the CIO, AI is about to expose the difference between modernised infrastructure and companies that have moved old risks into new environments.

“Africa doesn’t need to copy Europe’s sovereignty debate, our realities are different,” says Mogashoa. “What we do need is a sovereignty model built for our challenges and infrastructure that can hold our data and remain resilient on our terms.”

[1] http://africadca.org/en/data-centres-in-africa-2026-the-economic-report

[2] https://www.wsp.com/en-za/insights/capitalising-on-africas-data-centre-boom

[3] https://iafrica.com/south-africa-invests-r484-million-in-ai-and-emerging-tech-as-it-joins-global-ai-infrastructure-leaders/

Share