Decision-making is often about identifying trade-offs. When considering the development of Digital Public Infrastructure (DPI), one of the trade-offs that might arise is between prioritising sovereignty and service stability.
Thando Ndita and Dr Gray Manicom from the Policy Innovation Lab at Stellenbosch University recently attended the National Digital Capability Workshop on Sovereign Digital Capability: Cloud, AI and Security. Their participation formed part of the Lab’s work within the Policy, Regulation and Legislation Workstream of South Africa’s Digital Transformation initiative, which supports The Presidency on the policy, legal and regulatory foundations for digital transformation. The workshop focused on establishing a common baseline for sovereign digital capability across cloud, AI, cybersecurity and data governance, and on identifying existing capabilities, gaps, dependencies and areas requiring further policy or regulatory work. The Lab was specifically included in discussions on the existing policy baseline, data sovereignty and related definitions and capability gaps, as they have been driving much of this work for DPI.
The Director-General of the DCDT opened proceedings, followed by an in-depth conversation around what sovereignty entails. Data sovereignty for DPI is about ensuring that the government remains in control of citizen data throughout its lifecycle. This can conflict with the requirements to deploy DPI securely, quickly, affordably, stably and scalably, since achieving these objectives may involve using technologies, cloud infrastructure or service providers that are owned or controlled by entities outside South Africa. A key component is determining who controls the data centres that store this data and run government services.
These data centres may reside in South Africa, but that does not mean the government has meaningful long-term control over the data stored there or the services that run on them. For example, a data centre may be located within South Africa while being operated or owned by a foreign company and potentially subject to foreign legal jurisdictions. Governments may also face strategic or economic dependencies when they become reliant on a single provider or lack sufficient control over the technologies and services supporting critical public infrastructure. Indeed, even local companies can wrest control or ownership of citizen data intended for service delivery if it is not carefully governed.
After the discussion on sovereignty, the spotlight swung to capabilities. Putting the principles of sovereignty into practice requires a pragmatic understanding of the current technical capabilities that exist in government or that are available to them. Sovereignty is not possible if the government does not have reasonable local alternatives to foreign service providers. Sovereignty does not require that all software and hardware must be owned by the government; rather, it means that you may desire different levels of control depending on the data being considered – sometimes using a foreign or private service provider (with appropriate contracts in place) would not pose any significant risks, while in other instances the government might want to maintain strict controls on secret or sensitive data.
Participants from SITA, CSIR and Telkom discussed their capabilities for enabling the launch of digital government services quickly, reliably, and at scale. These insights assist with the Lab’s ability to appropriately develop pragmatic systems to classify data by their sovereignty risk and determine the corresponding levels of control that each classification should warrant.
This workshop was a meaningful engagement between the Lab and important stakeholders in government and other public entities. Ultimately, the discussion highlighted that digital sovereignty is not simply a question of ownership. It is about understanding where control sits, what dependencies exist, and what level of control is appropriate for different types of data and infrastructure. For South Africa’s digital transformation, this provides an important basis for developing digital public infrastructure that can balance sovereignty considerations with the practical need to deliver effective government services at scale.
The insights shared and gained will help the country move towards DPI and data governance that is sustainable, reliable and trusted, which, in turn, can lead to a government that delivers better services and offers digital infrastructure to be used for inclusive economic growth.