Industry shipping cranes
South Africa: Cloud in oil and gas

South Africa: Cloud in Oil and Gas

An Interactive Guide for Legal and Compliance Professionals


Download now


To support the world’s expanding economies and populations, many in the oil and gas (O&G) sector are looking for new ways to keep up with a growing demand for dwindling natural resources. Upstream, midstream, and downstream O&G businesses are quickly shifting away from using the cloud primarily for infrastructure. The cloud is becoming an enabler for successful digital transformation, helping to optimize exploration and production. The O&G sector needs better, faster, and cheaper ways to manage and analyse increasing amounts of data. The cloud offers the solution. It gives companies an ability to vastly improve operational excellence, safety, and productivity, using cloud technologies like advanced analytics, machine learning, and Artificial Intelligence; all of which enable the real-time use of information to deliver more effective decision-making and business process efficiencies.


Our mission at Microsoft is to empower every person and every organization on the planet to achieve more. Microsoft has partnered with a number of O&G organizations across the world and witnessed first-hand the transformational power of the cloud in the O&G sector. Microsoft's Intelligent Cloud, Intelligent Edge platform strategy, supported by an extensive and competent ecosystem of leading industry partners, means the O&G industry is able to create innovative products and services, execute with excellence, and improve customer engagement while at the same time reaping the benefits of mobile tools and increased employee productivity and engagement. Our Microsoft Azure platform has consistently delivered leading edge capabilities through its IaaS, PaaS, and SaaS services, providing efficiency and empowering the O&G industry to reduce the complexity of managing costly infrastructure, while improving agility and innovation. In addition, the platform offers significant benefits including reliable security and greater flexibility to adapt to the O&G industry’s business cycles.

In addition, Microsoft will soon deliver the intelligent Microsoft Cloud for the first time from data centres located in South Africa. The new cloud regions will offer enterprise-grade reliability and performance combined with data residency to help enable the tremendous opportunity for economic growth, and increase access to cloud and internet services for organisations and people across South Africa, and the African continent. This new investment is a recognition of the enormous opportunity for digital transformation in Africa and is a major milestone in the company’s mission to empower every person and every organisation on the planet to achieve more in a safe, secure and legally compliant manner.

Microsoft and our partner ecosystem are ready to support O&G businesses in South Africa. The Microsoft Cloud in South Africa - including Microsoft Azure, Office 365, and Dynamics 365 - offers enterprise-grade reliability and performance to customers across the country and region. Microsoft experts are also available to understand your requirements and provide detailed information on the technical, contractual, and practical aspects of any proposed cloud project. This is all part of our commitment to helping our O&G customers to smoothly navigate their way to the Microsoft cloud with confidence and reap the benefits of a digital transformation journey.


Currently, the SA O&G industry is characterised by a fragmented regulatory regime, with different regulators and laws regulating different activities in the upstream, midstream, and downstream sectors, including:

  • O&G and mining industries1
  • the construction and operation of petroleum pipelines, loading facilities, and storage facilities2
  • the downstream sector in respect to the licensing of wholesalers, retailers, and manufacturers of petroleum products3
  • the construction and operation of gas transmission, storage, distribution, liquefaction, and re-gasification facilities, and trading in gas4
  • various activities requiring environmental authorisation, including oil and gas exploration, production, and decommissioning5
  • the import and export of petroleum and petroleum products6
  • the imposition of royalties on the transfer of mineral resources7
  • the administration of matters in connection with the imposition of royalties on the transfer of mineral resources8
  • the taxation of oil and gas activities in South Africa9.
  • The key regulators for the O&G industry are:

    • Department of Mineral Resources, which administers the Mineral and Petroleum Resources Development Act (MPRDA) and is the competent authority to issue environmental authorisations under the National Environmental Management Act (NEMA) where the listed activities are directly related to prospecting/exploration or extraction and primary processing of a mineral/petroleum resource
    • Department of Energy, which is the controller of petroleum products within the Department of Energy and the licensing authority under the Petroleum Products Act
    • Petroleum Agency of South Africa (Agency), which promotes exploration for onshore and offshore oil and gas resources and their optimal development on behalf of the South African government. The Agency regulates exploration and production activities, and acts as the custodian of the national petroleum exploration and production database
    • National Energy Regulator of South Africa (NERSA), which administers and is the competent licensing authority under the Petroleum Pipelines Act and the Gas Act.
  • The use of cloud services is not expressly addressed in any particular SA O&G legislation. There may however be laws of application to the SA O&G industry which may need to be taken into account (see below). In making the decision to move to the cloud, it is crucial for industry participants to consider and ensure compliance with all applicable legislation.

    Microsoft is proud to confirm that it meets regulatory and compliance requirements for use of the cloud in some of the most highly regulated industries across the globe, and can help you to achieve compliance with the regulatory and compliance requirements applicable in the O&G sector.

  • There is presently no uniform regulation of cloud services in SA. Role-players within the O&G industry would, however, need to be mindful of certain regulatory provisions in moving to the cloud, including provisions:

    • precluding disclosure of certain types of information and data10
    • for certain licensed activities, prescribing where certain types of records and data must be held11
    • requiring the submission of complete and correct data12. There is therefore an imperative to store information in a manner which ensures integrity of data and security
    • regulating confidentiality13

    In addition, there may also be licence and/or contractual provisions (including confidentiality undertakings)14 which may need to be considered.

  • Approval is not required from any O&G regulator, as none of the O&G sector legislation specifically address cloud services.

    An O&G industry participant which is an organ of state (such as a national oil company) may be required to follow specific procurement processes in procuring cloud services under applicable public procurement laws. This may necessitate certain approvals but any such requirement is unlikely to relate specifically to the aspect of cloud computing.

  • O&G regulators possess fairly broad inspection powers which include the power to search and seize a wide range of information and records.15

  • There are no offshore data transfer requirements specific to the O&G industry.

    However, the processing of personal information will soon be regulated under the Protection of Personal Information Act 4 of 2013 (POPIA). Under POPIA, personal information may be transferred out of South Africa as long as the requirements of POPIA are met. POPIA permits the transfer of personal information to a third party who is in a foreign country in specific circumstances, including if the recipient is subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection as contemplated in POPIA, or with the person's consent.16

    Microsoft holds itself accountable to, and is subject to laws of regions in which it maintains data centres, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring that its products and services comply with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.

    • 1The Mineral and Petroleum Resources Development Act No. 28 of 2002
    • 2The Petroleum Pipelines Act No. 60 of 2003
    • 3The Petroleum Products Act No. 120 of 1977
    • 4The Gas Act No. 48 of 2001
    • 5The National Environmental Management Act No. 107 of 1999
    • 6The International Trade and Administration Act No. 71 of 2002
    • 7The Mineral and Petroleum Resources Royalty Act 28 of 2008
    • 8The Mineral and Petroleum Resources Royalty (Administration) Act 29 of 2008
    • 9Tenth Schedule, Income Tax Act, No 58 of 1962
    • 10Section 30(2) of the MPRDA provides that no information or data may be disclosed to any person if it contains information or data supplied in confidence by the supplier of the information or data.
    • 11Section 69(2)(a) of the MPRDA, as read with sections 21 and 28, requires the holder of an exploration right and/or reconnaissance permit to keep proper records, at its registered office or place of business, of reconnaissance or exploration operations and the results and expenditure connected therewith, as well as borehole core data and core-log data, where appropriate. This applies to exploration and reconnaissance for O&G. In relation to production, there is currently no analogous requirement, however the legislature seems to have recognised this lacuna and is seeking to amend this in terms of Mineral and Petroleum Resources Development Amendment Bill B15D of 2013.
    • 12The MPRDA requires rights holders and applicants to submit information which is complete and correct (including under section 43). Rights granted under the MPRDA may also be cancelled, suspended or revoked for submission of inaccurate, false, fraudulent, incorrect or misleading information (including under section 47).
    • 13Section 30(5) of the MPRDA stipulates that any data, information or reports lodged with the Council for Geoscience must be kept confidential for a certain period of time. Furthermore, under section 29 of the Gas Act, no information obtained by NERSA which is of a non-generic, confidential, personal, commercially sensitive or proprietary nature may be made public or otherwise disclosed to any person without the permission of the person to whom that information relates, except in terms of an order of the High Court.
    • 14These include those required in relation to any granting instrument and information or data obtained through and from the Agency. In addition, section 21(1)(c) of the Gas Act provides that NERSA may impose licence conditions relating to certain requirements and limitations, including that the gas transmission, storage, distribution, trading, liquefaction and regasification activities of vertically integrated companies must be managed separately with separate accounts and data and there must be no cross-subsidisation.
    • 15Section 91(4) of MPRDA allows for broad powers of entry, search and seizure, including the right to inspect any book, record, statement or other document including electronic records, documents or data and for making copies or excerpts. Sections 41(1) and 45(g) of The International Trade and Administration Act also grants an investigating officer broad powers of entry, search, inspection and seizure, including the right to use any computer system on the premises to search for any data contained in or available to that computer system and to reproduce any record from that data. Section 29 of the Gas Act allows for NERSA to authorise a person to enter any property on which a licensed activity is taking place to (i) inspect any facility, equipment, machinery, book, account or other document found on that property; and (ii) require any person to furnish NERSA with such information as may be necessary for the proper application of the Gas Act.
    • 16Section 72 of POPIA.




We build our services from the ground up to help safeguard your data

Learn more


Our policies and processes help keep your data private and in your control

Learn more


We provide industry-verified conformity with global standards

Learn more


We make our policies and practices clear and accessible to everyone

Learn more









*EXPLANATORY NOTE AND DISCLAIMER: This website is intended to provide a summary of key legal obligations that may affect customers using Microsoft cloud services. It indicates Microsoft’s view of how its cloud services may facilitate a customer's compliance with such obligations. This website/document is intended for informational purposes only and does not constitute legal advice nor any assessment of a customer's specific legal obligations. You remain responsible for ensuring compliance with the law. As far as the law allows, use of this website/document is at your own risk and Microsoft disclaims all representations and warranties, implied or otherwise.