South Africa: Cloud in Public Sector

The State Information Technology Agency (SITA) is the government agency responsible for providing centralised information technology, information systems, and related services in a maintained information systems security environment according to approved policy and standards.

National and provincial government departments must procure cloud services through SITA and SITA must certify all services procured by national and provincial government departments for compliance with its standards. Public entities and municipalities may also make use of SITA's services but are not compelled to do so.

SITA has recognized the need for cloud services across government to eliminate the unnecessary duplication of information technology goods and services and leverage economies of scale to provide cost effective services.⁴ As a result SITA is currently working with Microsoft to leverage the benefits of the cloud, amongst other things.⁵

Yes, cloud services are permitted. A move to cloud services would facilitate the achievement of a number of government policy objectives and regulatory requirements relating to co-operative governance, public participation and procedural fairness, information security, service delivery, rational decision-making, and administrative efficiency. However, certain processes may need to be followed and certain requirements may need to be met prior to migrating to cloud services.

Microsoft is proud to confirm that it meets regulatory and compliance requirements for use of the cloud in some of the most highly regulated industries across the globe and can help you to achieve compliance with the regulatory and compliance requirements applicable in this sector.

A move to cloud services would require consideration of a number of regulatory regimes.

(i) Public procurement
A public sector body must ensure that when it contracts for information, communication, and technology services it does so in a manner that is fair, equitable, transparent, cost-effective, and competitive.⁶ This will ordinarily mean that a public sector body cannot contract directly with a supplier but instead must follow a competitive public tender process. National and provincial government departments must procure cloud services through SITA, while municipalities, public entities, and municipal entities may run their own procurement process.⁷ The procurement process must be evaluated in terms of the preferential procurement points system.⁸ It may be possible to deviate from a competitive public tender process and approach a supplier directly in circumstances where the procurement is urgent, takes place in emergency circumstances or involves a sole supplier.⁹ It is also possible in certain circumstances, through transversal contracting, for public sector bodies to opt in to contracts for cloud services procured by other organs of state without having to follow a separate tender process.¹⁰ Transversal contracting also allows organs of state to realise financial benefits through economies of scale.

(ii) Access to information, transparency, and public participation
The public sector is required to be accountable, responsive, and open.¹¹ As a result it is obliged to make information publically accessible to allow the public to participate in government processes.

The public has the right of access to records of public sector bodies and the information officer of public sector bodies must consider the request and, where it is granted make the documents available within 30 days of the request being made.¹² Public sector bodies may be faced with requests for a significant number of records. Storage of information on the cloud will ensure that all information held by the public body is accessible, searchable, and easy to find with minimal effort to ensure that access to information requests can be addressed timeously.

South Africa is also a founding member and the current chair of the global Open Government Partnership. As signatory to this partnership, the South African Government has committed to making key non-personal public information and data freely available for everyone to use, reuse, and republish as long as certain conditions are met.¹³

Microsoft's cloud solutions offer significant data storage capacity and multiple access channels to facilitate the achievement of South Africa's commitment to open data.

(iii) Data security
Each government department is required to implement a department-specific information security policy, and the establishment of an information security function and staff to provide for the protection of classified information.¹⁴ These policies must be consistent with the Minimum Information Security Standards policy approved by Cabinet. Thus before making a decision to move data to the cloud, a public sector body should consider what types of data will be stored in the cloud, the manner in which the information will be stored (using private cloud infrastructure, including on-premises, or hyperscale cloud infrastructure) and whether the cloud service provider meets the relevant security and other requirements¹⁵ for the type of information that will be stored.

In additional all cloud services procured by national and provincial departments must be certified by SITA for compliance with its comprehensive information security environment standards.¹⁶ SITA has already certified Microsoft's Office 365 solution, and Microsoft is engaging with SITA to ensure that its other solutions, which meet the highest international standards (as set out more fully in the Recommended Resources below), are also so certified.

(iv) Co-operative governance and interoperability
All spheres of government and all organs of state within each sphere are required to act in accordance with the principles of co-operative government which include co-operating with one another in mutual trust and good faith by informing one another of and consulting one another on matters of common interest and co-ordinating their actions and legislation with one another so as to avoid wasteful duplication and ensure coherent government and effective provision of services.¹⁷

The heads of national departments, provincial departments, municipalities, and national or provincial government components will soon be required to acquire and use information technology in a manner that:

• leverages economies of scale
• ensures interoperability of information systems with information systems of other institutions
• eliminates unnecessary duplication of information and communication technologies
• ensures security of information systems¹⁸

In addition, they will be required to use information and communication technologies to develop and enhance the delivery of its services, align the use by staff of information and communication technologies to achieve optimal service delivery and promote the access to public services through the use of information and communication technologies.¹⁹

All of these obligations can be met cost effectively and comprehensively through the use of cloud services.

In additional all cloud services procured by national and provincial departments must be certified by SITA for compliance with its interoperability standards.²⁰

Under the Protection of Personal Information Act (POPIA), personal information may be transferred out of South Africa as long as the requirements of POPIA are met. POPIA permits the transfer of personal information to a third party who is in a foreign country in specific circumstances, including if the recipient is subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection as contemplated in POPIA or with the data subject's consent.

Microsoft holds itself accountable to and is subject to laws of regions in which it maintains data centres, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.