The cloud has a country.
Most major AI services process data outside South Africa. POPIA section 72 only allows that on specific grounds.
Section 72 grounds
One Must Apply
- The recipient is bound by law, binding rules or an agreement giving adequate protection
- The person consents
- It's needed for a contract with the person
- It benefits them, and consent isn't practical
Ask the vendor
Before You Sign
- Which countries process our data?
- Can we choose the region?
- Who are your sub-processors?
- Does the agreement cover transfers?
Sources: popia.co.za ↗ · Computerworld ↗
Know where it goes. Have a basis.