POPIA and Cloud Storage: What You Need to Know.

Published: 3 September 2026  |  By AOLC

South African businesses have embraced cloud storage at pace. Microsoft OneDrive, SharePoint, Google Drive, Dropbox, AWS S3 — these services make file sharing and collaboration faster and cheaper than ever. But here is a question too few IT managers are asking: does moving your data to the cloud relieve you of your POPIA obligations?

The short answer is no. The Protection of Personal Information Act (POPIA) applies to every byte of personal information your organisation processes, regardless of whether that data sits on a server in your Johannesburg office or in a Microsoft data centre in Dublin. If you collect, store, share, or use personal information — and almost every business does — POPIA applies. Cloud changes the tooling, not the liability.

What Counts as "Personal Information" in the Cloud?

Under POPIA, personal information is any data that can identify a living natural person — directly or indirectly. Where applicable, the Act also covers identifiable existing juristic persons (companies and other legal entities). This is a broad definition, and it almost certainly covers data your business already stores in the cloud:

• Employee records — names, ID numbers, salary information, leave history, performance reviews, and employment contracts stored in cloud HR systems or SharePoint.
• Customer data — contact details, purchase history, support tickets, email correspondence, or any CRM data stored in cloud platforms.
• Financial records — invoices, payment details, and bank account numbers uploaded to cloud accounting software like Xero or Sage.
• Email — Microsoft 365 or Google Workspace inboxes contain personal information in almost every thread. Your email is cloud storage, and it is in scope.
• Documents and scans — signed contracts, identity document copies, and medical certificates shared via Dropbox, OneDrive, or Google Drive.

The Responsible Party vs the Operator: Who Is Liable?

POPIA draws a clear line between two roles. Understanding this distinction is the foundation of cloud compliance:

The Responsible Party is the organisation that determines the purpose and means of processing personal information — that is your business. If you collect customer data and store it in Google Drive, you are the responsible party. POPIA places the primary duty of care on you.

The Operator is any third party that processes personal information on your behalf — that is your cloud provider. Microsoft, Google, Amazon, Dropbox, and similar services are operators under POPIA. They process your data, but they do so under your instruction and on your behalf.

This matters because you remain liable for what your operator does with your data. If Microsoft suffers a breach that exposes your customer records, you — the responsible party — have reporting obligations to the Information Regulator and potentially to your affected customers. Your cloud provider's terms of service do not transfer that liability to them.

Operator Agreements: What Your Cloud Provider Must Sign.

Section 21 of POPIA requires you to have a written agreement with every operator that processes personal information on your behalf. This is not optional. If you are using a cloud service without a formal data processing agreement, you are already non-compliant.

A compliant operator agreement must include:

• Processing instructions — the operator must only process data in accordance with your instructions. They cannot use your customer data for their own marketing or analytics without your consent.
• Security measures — the operator must implement appropriate technical and organisational security measures to protect your data. Ask specifically about encryption at rest, encryption in transit, access controls, and penetration testing frequency.
• Sub-operators — your cloud provider may use sub-processors (other cloud services they rely on). Your agreement must cover the chain — you need to know who they are and what controls apply.
• Breach notification — if the operator discovers a breach of your data, they must notify you as soon as reasonably possible after discovery so you can meet your own POPIA Section 22 notification obligations to the Information Regulator and affected data subjects.
• Data deletion or return — when the agreement ends or you request it, the operator must delete or return your data. Make sure this is explicit — many free-tier services retain data indefinitely after account closure.

The good news: major cloud providers like Microsoft, Google, and Amazon all offer compliant data processing agreements as standard. The challenge is smaller, local, or niche SaaS products that have not yet aligned to POPIA requirements. These need special attention.

Cross-Border Data Transfers: When Your Data Leaves South Africa.

Most large cloud providers store data outside South Africa. Microsoft 365 data may sit in Netherlands, Ireland, or the United States. Google Workspace may route through multiple international jurisdictions. This triggers Section 72 of POPIA, which restricts cross-border transfers of personal information.

Under Section 72, you may only transfer personal information to a foreign country if:

• The recipient country has adequate data protection laws — the European Union (GDPR) and several other jurisdictions meet this standard, though South Africa has not yet published a formal adequacy list.
• The recipient is subject to binding corporate rules — used by multinational groups with internal data governance frameworks.
• The data subject has consented — you have explicit permission from the individual for their data to be transferred internationally.
• The transfer is necessary for a contract — for example, processing a payment that requires data to be sent to an international payment gateway.
• The operator has adequate protections in place — contractual clauses that require the recipient to apply protection equivalent to POPIA.

Most South African businesses using major cloud platforms store data outside the country without realising it — and many have never assessed their cross-border transfer obligations under Section 72. For businesses using Microsoft 365 or Google Workspace, the providers' standard DPAs typically include Standard Contractual Clauses (SCCs) designed to meet this requirement — but you should verify that those clauses apply to your specific data flows and provide protection substantially equivalent to POPIA. The greater risk lies with smaller or niche cloud services that have not aligned to these requirements at all, or where businesses have never reviewed the terms.

Security: What POPIA Expects of Your Cloud Environment.

POPIA requires that personal information be protected against risks such as loss, damage, or unauthorised destruction, and against unlawful access or processing. For cloud environments, this means your IT governance practices must include:

• Multi-factor authentication (MFA) — every account with access to cloud-stored personal information must require MFA. A compromised password alone should not be enough to access your customer data or employee records.
• Role-based access control (RBAC) — employees should only have access to the data their role requires. A sales rep does not need access to HR files; a receptionist does not need financial records. Apply the principle of least privilege.
• Encryption — confirm your cloud provider encrypts data at rest and in transit. Most enterprise-grade providers do this as standard. Verify — do not assume.
• Audit logging — you need to know who accessed what data and when. Cloud platforms like Microsoft 365 and Google Workspace offer audit log functionality, but it must be configured and retained.
• Regular access reviews — former employees, contractors, and vendors whose access was never revoked are one of the most common causes of data breaches. Review cloud access quarterly.
• Backup and retention policies — know where your cloud backups are stored, how long data is retained, and what your recovery process looks like. Cloud ≠ backup.

---

A Practical POPIA Cloud Compliance Checklist.

Use this checklist to assess your current cloud compliance posture. If you cannot answer "yes" to each item, you have work to do before the Information Regulator comes knocking.

• Data mapping done — you know which personal information your business holds, where it is stored (including which cloud services), who has access, and why you hold it.
• Operator agreements in place — you have signed data processing agreements with every cloud service that handles personal information on your behalf.
• Cross-border transfer assessment completed — you have checked whether your cloud providers store data outside South Africa and confirmed the legal basis for each transfer.
• MFA enforced organisation-wide — multi-factor authentication is mandatory for all cloud accounts, with no exceptions for "senior" staff.
• Access controls reviewed in the last 90 days — you have confirmed that only current employees with a legitimate need can access personal information in your cloud environment.
• Incident response plan updated for cloud — your breach response procedure includes steps specific to cloud incidents: who to notify at the provider, how to preserve logs, and your timeline for reporting to the Information Regulator.
• Staff awareness training completed — employees who handle personal information understand their POPIA obligations when using cloud tools.
• Retention and deletion policy defined — you have a documented schedule for how long you keep personal information in the cloud, and a process for securely deleting it when the retention period expires.

If you are uncertain about your cloud compliance posture, the safest first step is a structured assessment with an IT provider who understands both the technical landscape and the POPIA framework. AOLC's cloud and security services include POPIA readiness reviews for South African businesses — we assess your cloud configuration against the Act's requirements and give you a prioritised remediation plan.

← Back to Blog