By: Theo Spickett - Lead for Data Platforms, Altron Digital Business 

During the past 25 years working in the industry, I have seen how data has changed from essentially a set of integrated databases towards becoming the engine room for growth within organisations. 

And now, as regulations tighten and countries reassert control over their digital borders, data sovereignty has moved from a legal checkbox to something that could impact business in a multitude of ways. 

Across boardrooms in South Africa, many companies are still struggling with data governance and may be under-prepared for the way data sovereignty is going to shift the way we do business. 

The compliance trap that's killing innovation 

Although we have come a long way, data sovereignty is still perceived to be about ticking legal boxes. The General Data Protection Regulation (GDPR) and then our Protection of Personal Information Act (POPIA) have both provided us with legal frameworks, but that's just the starting point. The real opportunity lies in what happens when we stop treating data sovereignty as a compliance exercise and start seeing it as economic policy. 

Data sovereignty involves ensuring that data generated by and for citizens remains under local control and complies with local regulations. It's an attempt to ensure that when a South African company or citizen generates data, that information remains within our regulatory framework and doesn't fall under the jurisdiction of foreign laws or governments. This concept has become crucial for organisations like Altron, which prioritise embedding compliance into their solutions from the outset. 

For me, there is no tension between regulatory compliance and innovation. Innovation that cannot be scaled out in production or as industry solutions ultimately does not add value. Ensuring that investment remains focused on innovations that can be safely taken to market within the regulatory framework, is how this balance is maintained. 

What people get wrong about data sovereignty    

Several misconceptions continue to 'cloud' the data sovereignty discussion. The belief that data localisation automatically increases security is the most common one. While keeping data within national borders aims to enhance security, it can sometimes have the opposite effect: a poorly secured local data centre can be far more vulnerable than a well-protected international one. Security comes from good practices, not geography. This is not so much about security as it is about jurisdiction – and the problem cannot be solved using the same thinking we use in drawing physical borders between countries. 

Similarly, the assumption that data localisation is cheaper often overlooks significant operational costs involved in many cases. Building and maintaining local infrastructure can be expensive – especially for new incumbents that scale rapidly. The financial benefits often only emerge later and may not be directly visible, through job creation, skills development, and maintaining local economic value. 

By taking a protectionist view of data, localisation can hurt innovation if it's poorly done. Cut off access to global innovation and international collaboration, and you limit what your developers and researchers can accomplish. 

The economic reality nobody's talking about 

Altron has invested in technology-backed innovation at scale in South Africa, for a number of years now. The key for us has been in recognising that data sovereignty is not just about where data is stored – it's about creating localised data ecosystems that are necessary for nurturing AI industries, creating jobs, and retaining value within borders. 

By asserting control over cloud infrastructure and data flows, we believe that organisations can drive economic development and innovation. This approach can enhance both security and analytical capability, allowing organisations to make more informed decisions while maintaining a competitive advantage in the market.  The mechanisms to achieve this are available but not well understood by executives at all levels. 

There are, however, compelling reasons to invest in local data capabilities. Trust is probably the biggest one. When customers know their data isn't subject to foreign surveillance laws or government access requests, they're more comfortable sharing information. This is particularly important for government clients or businesses in sensitive sectors. 

This is, of course, a dual-edged sword, as some countries offer better protection for foreign companies' data, particularly where the local government has poor infrastructure, regulatory, or enforcement capabilities. This is improving, and the number of instances where this remains a concern is decreasing. 

The competitive edge hidden in your data strategy 

Local data capabilities enable businesses to understand regional customer behaviour and preferences better. This localised insight can be used to tailor products and services to meet the specific needs and expectations of the local market. A good example is the use of local language interactions and awareness of locally sensitive social and cultural issues. 

From a technical perspective, storing data locally can reduce latency, resulting in faster access and processing times. This significantly enhances the user experience, making products and services more responsive and reliable. As real-time, interactive, high-quality, multi-media AI-driven customer interactions become more prevalent, we may see a return of this challenge as a critical differentiator. 

How Altron navigates data sovereignty 

We have developed specific strategies to navigate the complexities of data sovereignty. Legal compliance serves as our first and terminal consideration. Having a good understanding of the legal boundaries within which we must operate is non-negotiable. This means that both specialists and product owners, designers, and architects must understand these boundaries at an appropriate level of detail. 

We embed assurance into solutions through contracts, audits, product reviews, quality processes, and certifications. However, compliance alone is insufficient. Altron has a well-defined culture of solving problems that matter, creating smarter, simpler, and safer outcomes while adhering to the highest ethical standards. 

The most crucial strategy is understanding the value that must be derived from navigating data sovereignty. Compliance for the sake of compliance delivers no value in itself. Data sovereignty can provide value for us as a company and for our customers. Understanding, quantifying, prioritizing and investing accordingly is foundational. 

The regulatory reality check 

Data sovereignty is an evolving concept. Most legislation in this regard is relatively new and fast-changing. Even regulators acknowledge the need to engage, revisit, and refine existing regulations continually. Being part of the engagement and contributing to the discussion that drives data sovereignty regulation is key to ensuring that our insights and experiences remain relevant. 

Altron works closely with customers, service providers, and advisory entities to ensure that the guidance we provide is contextual and tailored to meet specific needs. There is no single approach that works for every customer, as outcomes vary for each one. What works for a bank won't work for a retailer, and what makes sense for a multinational corporation won't make sense for a local startup. 

The identity revolution that changes everything 

I am a strong advocate for self-sovereign IDs (SSIDs), and I am hopeful that we can successfully drive the adoption of this concept in the industry in the future. Self-sovereign IDs are digital identities that individuals own and control entirely, without relying on a central authority for validation or verification. 

SSIDs have the potential to significantly impact how businesses use, collect, and process data in several ways. 

With SSIDs, individuals have greater control over their data, deciding what information to share and with whom. This has the potential to reduce the risk of data breaches and unauthorised access, as businesses only receive the data necessary for specific transactions. Since individuals manage their own identities, the potential is there for the data provided to be accurate and up to date. This can enhance the quality of data that businesses collect and utilise, resulting in more informed decision-making and more reliable customer interactions. 

SSIDs can simplify compliance with data protection regulations such as the General Data Protection Regulation (GDPR) and POPIA. By allowing individuals to control their data, businesses can more easily adhere to requirements for data consent, access, and deletion. Managing and securing large volumes of personal data can be costly for companies. SSIDs shift the responsibility of data management to individuals, potentially reducing the complexity associated with data security, and compliance. 

Most importantly, SSIDs has the potential to streamline customer interactions by enabling seamless and secure authentication processes. By giving individuals control over their data, SSIDs foster greater transparency and trust between businesses and customers. Customers are more likely to trust companies that respect their privacy and provide clear, transparent data practices. 

SSIDs open up new possibilities for innovative services and business models. For example, businesses can develop personalised services that leverage verified identity attributes without compromising privacy.  For example, sharing deeply personal health, social or religious information remains a challenge for most customers due to the lack of trust. Control can set us on a path to improving this. 

Overall, self-sovereign IDs represent a shift towards more user-centric data management, where individuals have greater control over their personal information. This can lead to enhanced privacy, security, and trust, while also providing businesses with more accurate and reliable data for their operations.  Of course, our biggest challenge in driving this is infrastructure and the level of digitalization within society and within our customer base. Not everyone has the desire or skill to effectively manage their own digital identities better than the companies that use them. 

The companies that see beyond the immediate challenge to the underlying opportunity are the ones that win. Data sovereignty isn't just about compliance; it's about building the digital infrastructure that will power South Africa's economic future.