Storing data in a POPI world

Thomas Dubus, VP EMEA at Aiven.

---

With the Protection of Personal Information Act (POPI Act or POPIA) being enforced, more and more South African companies must reconsider their data storage location policy, especially when a public cloud is in the picture.

The problem with cloud storage

Cloud companies are global entities – how would you know if your South Africa specific data was being sent to India or Spain for processing?

The answer is to check that the cloud provider can offer services in a geographically limited area. Many providers will in fact simply ask you to define technical requirements, but some will let you specify the cloud service region that the services will use and where data will be stored.

Database as a service providers

With DBaaS being more and more popular, including open source Apache Kafka, PostgreSQL, MySQL, Redis, Cassandra, Elasticsearch, M3 and Grafana, it is now critical to choose wisely the region where you store your data. A limited number of providers offer South Africa as a region and even less offer a South African multicloud option.

Cloud service regions can be the answer

Both Microsoft Azure and AWS have data centres in South Africa. By selecting a South Africa service region from already compliant DBaaS providers, you know your data will always be stored within the borders of the Republic of South Africa. That’s what will make your cloud service POPI compliant.

To get an idea of how it works, try the Aiven site. You can set Microsoft Azure or AWS as the cloud and South Africa North or Cape Town as the region, choose a service plan on your preferred open source data management solution, migrate from one region to another or deploy multicloud redundant services for more security.